=====================================
WARNING: bad unlock balance detected!
6.19.0-rc5-next-20260116 #1 Not tainted
-------------------------------------
syz-executor.2/284 is trying to release lock (rcu_read_lock) at:
[<ffffffff81c1dee5>] __wait_on_freeing_inode+0x105/0x350
but there are no more locks to release!

other info that might help us debug this:
4 locks held by syz-executor.2/284:
 #0: ffff88800f53a3f8 (sb_writers#3){.+.+}-{0:0}, at: filename_create+0xf7/0x400
 #1: ffff88801ac903e0 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x1b1/0x400
 #2: ffff88800f53e950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0
 #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890

stack backtrace:
CPU: 0 UID: 0 PID: 284 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xca/0x120
 print_unlock_imbalance_bug+0x118/0x130
 lock_release+0x1ee/0x270
 __wait_on_freeing_inode+0x10a/0x350
 insert_inode_locked+0x25f/0x890
 __ext4_new_inode+0x223d/0x4cd0
 ext4_mkdir+0x331/0xb30
 vfs_mkdir+0x6d8/0xc00
 filename_mkdirat+0x118/0x430
 __x64_sys_mkdir+0x6e/0xd0
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0d6522cc27
Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffedf1f45e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007ffedf1f4670 RCX: 00007f0d6522cc27
RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007ffedf1f4670
RBP: 00007ffedf1f464c R08: 0000000000000000 R09: 0000000000000003
R10: 00007ffedf1f4387 R11: 0000000000000206 R12: 0000000000000032
R13: 00000000000277a4 R14: 0000000000000001 R15: 00007ffedf1f46b0
 </TASK>
------------[ cut here ]------------
WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#0: syz-executor.2/284
Modules linked in:
CPU: 0 UID: 0 PID: 284 Comm: syz-executor.2 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__rcu_read_unlock+0x25f/0x5c0
Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9
RSP: 0018:ffff88806ce08cb8 EFLAGS: 00010086
RAX: 00000000ffffffff RBX: ffff8880199e8000 RCX: 0000000000000005
RDX: 0000000000000000 RSI: ffffffff85e25fc0 RDI: ffff8880199e83fc
RBP: ffff8880199e8000 R08: 0000000000000000 R09: ffffffff84e98ac0
R10: 0000000000000000 R11: 0000000000000018 R12: ffff8880199e8000
R13: 0000000000000000 R14: ffff88806ce379c0 R15: ffff88806ce37a20
FS:  000055555d091400(0000) GS:ffff8880e5342000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555d0a2c98 CR3: 000000000eb3d000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 sched_tick+0x232/0x6e0
 update_process_times+0x116/0x210
 tick_nohz_handler+0x4ff/0x8c0
 __hrtimer_run_queues+0x654/0xbb0
 hrtimer_interrupt+0x369/0x830
 __sysvec_apic_timer_interrupt+0xbb/0x300
 sysvec_apic_timer_interrupt+0x6b/0x80
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:__report_bug+0x4a9/0x5b0
Code: 79 67 86 48 89 de e8 56 31 b0 fc 49 39 dc 48 c7 c3 c0 79 67 86 75 3e eb 5e e8 b3 36 b0 fc 48 89 d8 48 c1 e8 03 42 0f b6 14 28 <48> 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 b0 00 00 00 48
RSP: 0018:ffff88801b2af790 EFLAGS: 00000212
RAX: 1ffffffff0cd010e RBX: ffffffff86680870 RCX: ffffffff84c54bdf
RDX: 0000000000000000 RSI: ffffffff84c54bad RDI: 0000000000000006
RBP: ffffffff8152d665 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8152d665 R11: 0000000000000000 R12: ffffffff815d742f
R13: dffffc0000000000 R14: 0000000000000002 R15: 000000000000000b
 report_bug+0x7c/0x120
 handle_bug+0x2e8/0x4f0
 exc_invalid_op+0x35/0x80
 asm_exc_invalid_op+0x1a/0x20
RIP: 0010:__rcu_read_unlock+0x25f/0x5c0
Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9
RSP: 0018:ffff88801b2af9e0 EFLAGS: 00010286
RAX: 00000000ffffffff RBX: ffff8880199e8000 RCX: ffffffff815660f7
RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff8880199e83fc
RBP: ffff8880199e8000 R08: 0000000000000000 R09: fffffbfff0ba7040
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880199e8000
R13: 0000000000000001 R14: ffffffff85c0cb60 R15: ffff8880481345d0
 __wait_on_freeing_inode+0x10f/0x350
 insert_inode_locked+0x25f/0x890
 __ext4_new_inode+0x223d/0x4cd0
 ext4_mkdir+0x331/0xb30
 vfs_mkdir+0x6d8/0xc00
 filename_mkdirat+0x118/0x430
 __x64_sys_mkdir+0x6e/0xd0
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0d6522cc27
Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffedf1f45e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007ffedf1f4670 RCX: 00007f0d6522cc27
RDX: 0000000000000000 RSI: 00000000000001ff RDI: 00007ffedf1f4670
RBP: 00007ffedf1f464c R08: 0000000000000000 R09: 0000000000000003
R10: 00007ffedf1f4387 R11: 0000000000000206 R12: 0000000000000032
R13: 00000000000277a4 R14: 0000000000000001 R15: 00007ffedf1f46b0
 </TASK>
irq event stamp: 223857
hardirqs last  enabled at (223857): [<ffffffff84d19a7c>] _raw_spin_unlock_irqrestore+0x2c/0x50
hardirqs last disabled at (223856): [<ffffffff84d197d3>] _raw_spin_lock_irqsave+0x53/0x60
softirqs last  enabled at (223852): [<ffffffff812cda79>] kernel_fpu_end+0x59/0x70
softirqs last disabled at (223850): [<ffffffff812ce94b>] kernel_fpu_begin_mask+0x1bb/0x300
---[ end trace 0000000000000000 ]---
mac80211_hwsim hwsim13 wlan1: entered promiscuous mode
mac80211_hwsim hwsim13 wlan1: left promiscuous mode
loop2: detected capacity change from 0 to 1348
loop7: detected capacity change from 0 to 4
EXT4-fs (loop7): VFS: Can't find ext4 filesystem
loop2: detected capacity change from 0 to 1348
vfat: Unknown parameter 'U©+Û<rFŽÑ—¯aäÇoåjæÅlÿ™Zˆ#à‡'
vfat: Unknown parameter 'U©+Û<rFŽÑ—¯aäÇoåjæÅlÿ™Zˆ#à‡'
----------------
Code disassembly (best guess):
   0:	79 67                	jns    0x69
   2:	86 48 89             	xchg   %cl,-0x77(%rax)
   5:	de e8                	fsubrp %st,%st(0)
   7:	56                   	push   %rsi
   8:	31 b0 fc 49 39 dc    	xor    %esi,-0x23c6b604(%rax)
   e:	48 c7 c3 c0 79 67 86 	mov    $0xffffffff866779c0,%rbx
  15:	75 3e                	jne    0x55
  17:	eb 5e                	jmp    0x77
  19:	e8 b3 36 b0 fc       	callq  0xfcb036d1
  1e:	48 89 d8             	mov    %rbx,%rax
  21:	48 c1 e8 03          	shr    $0x3,%rax
  25:	42 0f b6 14 28       	movzbl (%rax,%r13,1),%edx
* 2a:	48 89 d8             	mov    %rbx,%rax <-- trapping instruction
  2d:	83 e0 07             	and    $0x7,%eax
  30:	83 c0 03             	add    $0x3,%eax
  33:	38 d0                	cmp    %dl,%al
  35:	7c 08                	jl     0x3f
  37:	84 d2                	test   %dl,%dl
  39:	0f 85 b0 00 00 00    	jne    0xef
  3f:	48                   	rex.W