WARNING: bad unlock balance in nvme_update_ns_info

Status: upstream: reported on 2026/09/19 00:10
Subsystems: nvme
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+64bc2169c92ee55ad31f@syzkaller.appspotmail.com
First crash: 4d06h, last: 4d06h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
464dc19f assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ WARNING: bad unlock balance in nvme_update_ns_info 2026/09/16 00:02 2026/09/16 00:02 2026/09/16 00:45 2daa4bb5
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [nvme?] WARNING: bad unlock balance in nvme_update_ns_info 0 (1) 2026/09/19 00:10

Sample crash report:
=====================================
WARNING: bad unlock balance detected!
syzkaller #0 Tainted: G             L     
-------------------------------------
kworker/u8:28/9220 is trying to release lock (&q->q_usage_counter(io)) at:
[<ffffffff85e833c7>] blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
[<ffffffff85e833c7>] nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
but there are no more locks to release!

other info that might help us debug this:
locks held by kworker/u8:28/9220: 2, last CPU#1:
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #0: ffff88801ae8d138 ((wq_completion)async){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
 #1: ffffc9000460fc40 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479

stack backtrace:
CPU: 1 UID: 0 PID: 9220 Comm: kworker/u8:28 Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: async async_run_entry_fn
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_unlock_imbalance_bug+0xdc/0xf0 kernel/locking/lockdep.c:5349
 __lock_release kernel/locking/lockdep.c:5590 [inline]
 lock_release+0x252/0x3c0 kernel/locking/lockdep.c:5964
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 nvme_update_ns_info+0xa07/0x1200 drivers/nvme/host/core.c:2623
 nvme_alloc_ns drivers/nvme/host/core.c:4293 [inline]
 nvme_scan_ns+0x34c1/0x46c0 drivers/nvme/host/core.c:4483
 async_run_entry_fn+0x9d/0x430 kernel/async.c:129
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/14 23:22 upstream 704340f1cd0d 924033e8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: bad unlock balance in nvme_update_ns_info
* Struck through repros no longer work on HEAD.