From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f77.google.com (mail-oo1-f77.google.com [209.85.161.77]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1647618CBE1 for ; Fri, 24 Apr 2026 05:09:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.77 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777007378; cv=none; b=bJELKF52t8hFWXVKWQBTryafdjbWLfMKfMNCFE2oxhAdWmgIW8KdPg0rqY2ncPvyOk/Dute6REMHSKwh8iGCGf69DSt8ZQAkcadVTFXw+wWpqr4NxtesuMFHT6GiF2JBYYpYqycJqjTT3msNaXwerwt5pYd+KWi/RO7v76h4vCM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777007378; c=relaxed/simple; bh=GY0UM6vQTwXfbi0JHIv17J7csufNv6o5ftJdzkZnaAA=; h=MIME-Version:Date:Message-ID:Subject:From:To:Content-Type; b=oucMfH0Vm/LOjslznffw37RT6VUgR2FpKOGcMDDq4ZHE7tqhH8Y/jSvvi+ehdefYC/9Z27XFMylWhC/4dKQSWXy7L7lKTVEpBtmgQf9BX3X2lX1guDucRtbuQ6KhxrLmvTpU7Y3PswGi8l2wOj2PbEjHzrV/NnuNVuJAZsOxo7I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.77 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f77.google.com with SMTP id 006d021491bc7-68826165bc9so7719556eaf.0 for ; Thu, 23 Apr 2026 22:09:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777007374; x=1777612174; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=TGSO3ahEc0c0N8cTVgjQ3/FQCivWnlbeOFkHgcHPRLc=; b=hxV5aJ4HjdpkpJHGZj+/njD2Zl0mfqJSKWlG0kBMKiYx+3nDVhkck2NQ/bZwAIK80E jCPEFKZyHSuAqajzRZdL62bv9XpWjZzMh6P/yGD2xDIk9ld5MrDvhDSbZJZy12PmVJyB V6N6gTTINrJqsiUB6uEjMeKsqKBI8EJInq96oXpFgeDg0OGaQeFUl4qJ2Dni+ZulFhTx 6ySTH90H2PQy3vpNCTQmP+e09MsYwR6JJCcgb/5viqzxGUNbwpIxbDZxKeixgPP37ZVK jC8jiyGULOST/t0rU08rL0tsddtR+Mebp1FanaSJDgkXWP5EiKYXQAK5JJ/o7WaO8wfE +HKg== X-Forwarded-Encrypted: i=1; AFNElJ/pbinvdDrYXjph4dxM+N+1dEzLLyeffPuUlBLlTAAfz/MysQWJY4UgZ41kG9MxjwPzhRpPYdGhVymeUoo=@vger.kernel.org X-Gm-Message-State: AOJu0Yyh2NAXpxumat9hOdne5ifBOjNN/CImag2XfAAdnDfZABgbJAKa c548Rpg8/aD1DYjBKSPBv7X7EjuLXrf5bRwbhlRnQ5ZbJGa9i0gUelravrWYG2Mj7IqIiOCbL4k rRbcpNx6QkSqVH0fdpDNj6stGGOut6SfFyOVnslcbH9T3BHHvA8E/zhgys6w= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:4c06:b0:694:8f3a:3f41 with SMTP id 006d021491bc7-6948f3a4683mr9280211eaf.41.1777007374371; Thu, 23 Apr 2026 22:09:34 -0700 (PDT) Date: Thu, 23 Apr 2026 22:09:34 -0700 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69eafb0e.a00a0220.9259.0031.GAE@google.com> Subject: [syzbot] [mm?] WARNING: bad unlock balance in folios_put_refs From: syzbot To: akpm@linux-foundation.org, axelrasmussen@google.com, baohua@kernel.org, bhe@redhat.com, chrisl@kernel.org, kasong@tencent.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, nphamcs@gmail.com, qi.zheng@linux.dev, shakeel.butt@linux.dev, shikemeng@huaweicloud.com, syzkaller-bugs@googlegroups.com, weixugc@google.com, youngjun.park@lge.com, yuanchu@google.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot found the following issue on: HEAD commit: c1f49dea2b8f Merge tag 'mm-hotfixes-stable-2026-04-19-00-1.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=140711ba580000 kernel config: https://syzkaller.appspot.com/x/.config?x=507c1c0a12a79510 dashboard link: https://syzkaller.appspot.com/bug?extid=c4f8158debe41f3bca37 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 userspace arch: i386 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-c1f49dea.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/98ce9fed1a97/vmlinux-c1f49dea.xz kernel image: https://storage.googleapis.com/syzbot-assets/b02e163ec959/bzImage-c1f49dea.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+c4f8158debe41f3bca37@syzkaller.appspotmail.com ===================================== WARNING: bad unlock balance detected! syzkaller #0 Not tainted ------------------------------------- dhcpcd/5934 is trying to release lock (rcu_read_lock) at: [] rcu_lock_release include/linux/rcupdate.h:310 [inline] [] rcu_read_unlock include/linux/rcupdate.h:869 [inline] [] lruvec_unlock_irqrestore include/linux/memcontrol.h:1493 [inline] [] folios_put_refs+0x50a/0xa90 mm/swap.c:1000 but there are no more locks to release! other info that might help us debug this: 1 lock held by dhcpcd/5934: #0: ffff8880134bf178 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:536 [inline] #0: ffff8880134bf178 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x22c/0xa10 mm/mmap.c:1308 stack backtrace: CPU: 2 UID: 0 PID: 5934 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_unlock_imbalance_bug.part.0+0xfb/0x106 kernel/locking/lockdep.c:5298 print_unlock_imbalance_bug kernel/locking/lockdep.c:5278 [inline] __lock_release kernel/locking/lockdep.c:5537 [inline] lock_release kernel/locking/lockdep.c:5889 [inline] lock_release+0x28d/0x310 kernel/locking/lockdep.c:5875 rcu_lock_release include/linux/rcupdate.h:310 [inline] rcu_read_unlock include/linux/rcupdate.h:869 [inline] lruvec_unlock_irqrestore include/linux/memcontrol.h:1493 [inline] folios_put_refs+0x50f/0xa90 mm/swap.c:1000 free_pages_and_swap_cache+0x22d/0x3b0 mm/swap_state.c:401 __tlb_batch_free_encoded_pages+0xe9/0x280 mm/mmu_gather.c:138 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu mm/mmu_gather.c:424 [inline] tlb_finish_mmu+0x1b0/0x810 mm/mmu_gather.c:549 exit_mmap+0x454/0xa10 mm/mmap.c:1313 __mmput+0x12a/0x410 kernel/fork.c:1178 mmput+0x67/0x80 kernel/fork.c:1201 exit_mm kernel/exit.c:581 [inline] do_exit+0x833/0x2a60 kernel/exit.c:963 do_group_exit+0xd5/0x2a0 kernel/exit.c:1117 __do_sys_exit_group kernel/exit.c:1128 [inline] __se_sys_exit_group kernel/exit.c:1126 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1126 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc4db37a6c5 Code: Unable to access opcode bytes at 0x7fc4db37a69b. RSP: 002b:00007fffbd1b3848 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc4db37a6c5 RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001 RBP: 00007fffbd1b3e58 R08: 000055eb8d7db2c0 R09: 0000000000000002 R10: 00000000000000e0 R11: 0000000000000206 R12: 00007fffbd1b3890 R13: 000055eb8d7dc8a0 R14: 00007fffbd1b3ad0 R15: 00007fffbd1b3880 ------------[ cut here ]------------ rrln < 0 || rrln > RCU_NEST_PMAX WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock kernel/rcu/tree_plugin.h:443 [inline], CPU#2: dhcpcd/5934 WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x235/0x5e0 kernel/rcu/tree_plugin.h:430, CPU#2: dhcpcd/5934 Modules linked in: CPU: 2 UID: 0 PID: 5934 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__rcu_read_unlock kernel/rcu/tree_plugin.h:443 [inline] RIP: 0010:__rcu_read_unlock+0x235/0x5e0 kernel/rcu/tree_plugin.h:430 Code: 74 11 c7 45 58 01 00 00 00 bf 09 00 00 00 e8 a2 a4 da ff e8 8d e0 22 00 9c 58 f6 c4 02 0f 85 dd 02 00 00 fb e9 57 fe ff ff 90 <0f> 0b 90 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc e8 14 62 87 RSP: 0018:ffffc900045df718 EFLAGS: 00010286 RAX: 00000000ffffffff RBX: ffff88802a092500 RCX: ffffffff81e80bfe RDX: 0000000000000000 RSI: ffffffff8df2c0ea RDI: ffff88802a0929c4 RBP: 000000000000001f R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000001 R12: ffffc900045df8fc R13: dffffc0000000000 R14: ffffc900045df920 R15: ffffc900045dfa20 FS: 0000000000000000(0000) GS:ffff8880972ee000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc4db4814c0 CR3: 000000004fd57000 CR4: 0000000000352ef0 Call Trace: rcu_read_unlock include/linux/rcupdate.h:871 [inline] lruvec_unlock_irqrestore include/linux/memcontrol.h:1493 [inline] folios_put_refs+0x514/0xa90 mm/swap.c:1000 free_pages_and_swap_cache+0x22d/0x3b0 mm/swap_state.c:401 __tlb_batch_free_encoded_pages+0xe9/0x280 mm/mmu_gather.c:138 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu mm/mmu_gather.c:424 [inline] tlb_finish_mmu+0x1b0/0x810 mm/mmu_gather.c:549 exit_mmap+0x454/0xa10 mm/mmap.c:1313 __mmput+0x12a/0x410 kernel/fork.c:1178 mmput+0x67/0x80 kernel/fork.c:1201 exit_mm kernel/exit.c:581 [inline] do_exit+0x833/0x2a60 kernel/exit.c:963 do_group_exit+0xd5/0x2a0 kernel/exit.c:1117 __do_sys_exit_group kernel/exit.c:1128 [inline] __se_sys_exit_group kernel/exit.c:1126 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1126 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc4db37a6c5 Code: Unable to access opcode bytes at 0x7fc4db37a69b. RSP: 002b:00007fffbd1b3848 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc4db37a6c5 RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001 RBP: 00007fffbd1b3e58 R08: 000055eb8d7db2c0 R09: 0000000000000002 R10: 00000000000000e0 R11: 0000000000000206 R12: 00007fffbd1b3890 R13: 000055eb8d7dc8a0 R14: 00007fffbd1b3ad0 R15: 00007fffbd1b3880 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup