=====================================
WARNING: bad unlock balance detected!
6.19.0-rc5-next-20260116 #1 Not tainted
-------------------------------------
syz-executor.4/4289 is trying to release lock (rcu_read_lock) at:
[<ffffffff81c1dee5>] __wait_on_freeing_inode+0x105/0x350
but there are no more locks to release!

other info that might help us debug this:
4 locks held by syz-executor.4/4289:
 #0: ffff88800fa6a3f8 (sb_writers#3){.+.+}-{0:0}, at: path_openat+0x1764/0x2d60
 #1: ffff88801b1b16f0 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: path_openat+0xe32/0x2d60
 #2: ffff88800fa6e950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xe32/0x12d0
 #3: ffffffff85c16898 (inode_hash_lock){+.+.}-{3:3}, at: insert_inode_locked+0xf9/0x890

stack backtrace:
CPU: 1 UID: 0 PID: 4289 Comm: syz-executor.4 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xca/0x120
 print_unlock_imbalance_bug+0x118/0x130
 lock_release+0x1ee/0x270
 __wait_on_freeing_inode+0x10a/0x350
 insert_inode_locked+0x25f/0x890
 __ext4_new_inode+0x223d/0x4cd0
 ext4_create+0x2e2/0x4e0
 lookup_open.isra.0+0xc03/0x1030
 path_openat+0xea4/0x2d60
 do_file_open+0x209/0x460
 do_sys_openat2+0xe7/0x210
 __x64_sys_creat+0xcc/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2fc435eb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2fc18d4188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f2fc4471f60 RCX: 00007f2fc435eb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200003c0
RBP: 00007f2fc43b8f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd3fcd5cef R14: 00007f2fc18d4300 R15: 0000000000022000
 </TASK>
------------[ cut here ]------------
WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x25f/0x5c0, CPU#1: syz-executor.4/4289
Modules linked in:
CPU: 1 UID: 0 PID: 4289 Comm: syz-executor.4 Not tainted 6.19.0-rc5-next-20260116 #1 PREEMPT(lazy) 
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:__rcu_read_unlock+0x25f/0x5c0
Code: f2 02 00 00 c7 43 58 01 00 00 00 bf 09 00 00 00 e8 d6 b7 de ff 4d 85 f6 0f 84 73 fe ff ff e8 38 8a 20 00 fb e9 68 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e e9 81 4d 74 03 e8 2c 5d 56 00 e9
RSP: 0018:ffff8880168c7510 EFLAGS: 00010286
RAX: 00000000ffffffff RBX: ffff88801a8f0000 RCX: ffffc90001a02000
RDX: 0000000000000000 RSI: ffffffff81566100 RDI: ffff88801a8f03fc
RBP: ffff88801a8f0000 R08: 0000000000000000 R09: fffffbfff0ba7040
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88801a8f0000
R13: 0000000000000001 R14: ffffffff85c0fa90 R15: ffff88801772d8e0
FS:  00007f2fc18d4700(0000) GS:ffff8880e5442000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f09b94da7e0 CR3: 00000000487be000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 __wait_on_freeing_inode+0x10f/0x350
 insert_inode_locked+0x25f/0x890
 __ext4_new_inode+0x223d/0x4cd0
 ext4_create+0x2e2/0x4e0
 lookup_open.isra.0+0xc03/0x1030
 path_openat+0xea4/0x2d60
 do_file_open+0x209/0x460
 do_sys_openat2+0xe7/0x210
 __x64_sys_creat+0xcc/0x120
 do_syscall_64+0xbf/0x420
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2fc435eb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2fc18d4188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f2fc4471f60 RCX: 00007f2fc435eb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200003c0
RBP: 00007f2fc43b8f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffd3fcd5cef R14: 00007f2fc18d4300 R15: 0000000000022000
 </TASK>
irq event stamp: 1009
hardirqs last  enabled at (1009): [<ffffffff84d19a7c>] _raw_spin_unlock_irqrestore+0x2c/0x50
hardirqs last disabled at (1008): [<ffffffff84d197d3>] _raw_spin_lock_irqsave+0x53/0x60
softirqs last  enabled at (1004): [<ffffffff812cda79>] kernel_fpu_end+0x59/0x70
softirqs last disabled at (1002): [<ffffffff812ce94b>] kernel_fpu_begin_mask+0x1bb/0x300
---[ end trace 0000000000000000 ]---
tmpfs: Invalid gid '0x00000000ffffffff'
loop7: detected capacity change from 0 to 4096
EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
tmpfs: Invalid gid '0x00000000ffffffff'
UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_register_driver returned -16
loop3: detected capacity change from 0 to 2048
ext4: Unknown parameter 'fowner<00000000000000000000'
loop3: detected capacity change from 0 to 2048
ext4: Unknown parameter 'fowner<00000000000000000000'
sr 1:0:0:0: [sr0] CDROM not ready.  Make sure there is a disc in the drive.
sr 1:0:0:0: [sr0] CDROM not ready.  Make sure there is a disc in the drive.
tmpfs: Unknown parameter 'LrPƒ“3áÒýϺCÛKÉ.f}f<sf-J«3¹›So²AäµVÁàJå¯S§-ñ_YÉ&ÉGmªÿ6|¥vî�দÚD°Ýµ´“´ÝnrUîR5�©ö3¹à2èÁ¡Â¬ƒ[÷ö»ý¸LJ¨N‹â'
sr 1:0:0:0: [sr0] CDROM not ready.  Make sure there is a disc in the drive.
UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
misc raw-gadget: fail, usb_gadget_register_driver returned -16
sr 1:0:0:0: [sr0] CDROM not ready.  Make sure there is a disc in the drive.
loop7: detected capacity change from 0 to 270
vfat: Unknown parameter 'subj_role'
loop7: detected capacity change from 0 to 270
sr 1:0:0:0: [sr0] CDROM not ready.  Make sure there is a disc in the drive.
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.6'.
ieee80211 phy18: Selected rate control algorithm 'minstrel_ht'
9pnet_fd: Insufficient options for proto=fd
sr 1:0:0:0: [sr0] CDROM not ready.  Make sure there is a disc in the drive.
netlink: 20 bytes leftover after parsing attributes in process `syz-executor.6'.
ieee80211 phy19: Selected rate control algorithm 'minstrel_ht'
sr 1:0:0:0: [sr0] CDROM not ready.  Make sure there is a disc in the drive.