Warning: Permanently added '10.128.0.91' (ED25519) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 91.967898][ T1211] cfg80211: failed to load regulatory.db executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 103.460891][ T6144] [ 103.463263][ T6144] ===================================== [ 103.468818][ T6144] WARNING: bad unlock balance detected! [ 103.474400][ T6144] 6.16.0-rc2-next-20250616-syzkaller #0 Not tainted [ 103.481015][ T6144] ------------------------------------- [ 103.486564][ T6144] syz-executor427/6144 is trying to release lock (&mapping->i_mmap_rwsem) at: [ 103.495454][ T6144] [] move_pgt_entry+0xfa7/0x1170 [ 103.502003][ T6144] but there are no more locks to release! [ 103.507718][ T6144] [ 103.507718][ T6144] other info that might help us debug this: [ 103.515792][ T6144] 1 lock held by syz-executor427/6144: [ 103.521252][ T6144] #0: ffff8880213c1760 (&mm->mmap_lock){++++}-{4:4}, at: __se_sys_mremap+0x3c0/0xc60 [ 103.530845][ T6144] [ 103.530845][ T6144] stack backtrace: [ 103.536744][ T6144] CPU: 1 UID: 0 PID: 6144 Comm: syz-executor427 Not tainted 6.16.0-rc2-next-20250616-syzkaller #0 PREEMPT(full) [ 103.536764][ T6144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 103.536780][ T6144] Call Trace: [ 103.536790][ T6144] [ 103.536797][ T6144] dump_stack_lvl+0x189/0x250 [ 103.536826][ T6144] ? __pfx_dump_stack_lvl+0x10/0x10 [ 103.536851][ T6144] ? __pfx__printk+0x10/0x10 [ 103.536870][ T6144] ? print_lock_name+0xde/0x100 [ 103.536887][ T6144] ? move_pgt_entry+0xfa7/0x1170 [ 103.536908][ T6144] print_unlock_imbalance_bug+0xdc/0xf0 [ 103.536924][ T6144] lock_release+0x269/0x3e0 [ 103.536947][ T6144] ? move_pgt_entry+0xfa7/0x1170 [ 103.536969][ T6144] up_write+0x2d/0x420 [ 103.536985][ T6144] ? do_raw_spin_unlock+0x122/0x240 [ 103.537005][ T6144] move_pgt_entry+0xfa7/0x1170 [ 103.537028][ T6144] ? alloc_new_pud+0x185/0x310 [ 103.537050][ T6144] move_page_tables+0xcde/0x2940 [ 103.537078][ T6144] ? move_page_tables+0x5ae/0x2940 [ 103.537103][ T6144] ? __pfx_move_page_tables+0x10/0x10 [ 103.537134][ T6144] move_vma+0xd5e/0x2010 [ 103.537165][ T6144] ? __pfx_move_vma+0x10/0x10 [ 103.537187][ T6144] ? arch_get_unmapped_area_topdown+0x251/0xbc0 [ 103.537223][ T6144] ? mm_get_unmapped_area+0xa7/0xd0 [ 103.537239][ T6144] ? shmem_get_unmapped_area+0x2cf/0x910 [ 103.537265][ T6144] ? cap_mmap_addr+0xb0/0x100 [ 103.537284][ T6144] ? bpf_lsm_mmap_addr+0x9/0x20 [ 103.537308][ T6144] ? security_mmap_addr+0x71/0x270 [ 103.537325][ T6144] ? __get_unmapped_area+0x3e4/0x450 [ 103.537352][ T6144] ? vrm_set_new_addr+0x1a7/0x1f0 [ 103.537375][ T6144] mremap_to+0x7e7/0x8b0 [ 103.537399][ T6144] ? __pfx_mremap_to+0x10/0x10 [ 103.537422][ T6144] ? __pfx_down_write_killable+0x10/0x10 [ 103.537456][ T6144] ? __might_fault+0xb0/0x130 [ 103.537474][ T6144] __se_sys_mremap+0x8f5/0xc60 [ 103.537503][ T6144] ? __pfx___se_sys_mremap+0x10/0x10 [ 103.537525][ T6144] ? rcu_is_watching+0x15/0xb0 [ 103.537552][ T6144] ? do_syscall_64+0xbe/0x3b0 [ 103.537575][ T6144] ? __x64_sys_mremap+0x20/0xc0 [ 103.537597][ T6144] do_syscall_64+0xfa/0x3b0 [ 103.537620][ T6144] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.537635][ T6144] ? __switch_to_asm+0x39/0x70 [ 103.537651][ T6144] ? clear_bhb_loop+0x60/0xb0 [ 103.537669][ T6144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.537685][ T6144] RIP: 0033:0x7fae1b9d33b9 [ 103.537703][ T6144] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 103.537717][ T6144] RSP: 002b:00007fae1b962168 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 103.537733][ T6144] RAX: ffffffffffffffda RBX: 00007fae1ba563f8 RCX: 00007fae1b9d33b9 [ 103.537745][ T6144] RDX: 0000000000200000 RSI: 0000000000600600 RDI: 0000200000000000 [ 103.537756][ T6144] RBP: 00007fae1ba563f0 R08: 0000200000a00000 R09: 0000000000000000 [ 103.537767][ T6144] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fae1ba563fc [ 103.537777][ T6144] R13: 000000000000006e R14: 00007ffcf99e7e70 R15: 00007ffcf99e7f58 [ 103.537794][ T6144] [ 103.842598][ T6144] ------------[ cut here ]------------ executing program executing program executing program [ 103.848297][ T6144] DEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) != current) && !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE)): count = 0x0, magic = 0xffff888079b79f48, owner = 0x0, curr 0xffff88803097da00, list empty executing program [ 103.904150][ T6144] WARNING: kernel/locking/rwsem.c:1368 at up_write+0x3a2/0x420, CPU#0: syz-executor427/6144 [ 103.914319][ T6144] Modules linked in: [ 103.918244][ T6144] CPU: 0 UID: 0 PID: 6144 Comm: syz-executor427 Not tainted 6.16.0-rc2-next-20250616-syzkaller #0 PREEMPT(full) [ 103.930223][ T6144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 103.940368][ T6144] RIP: 0010:up_write+0x3a2/0x420 [ 103.945404][ T6144] Code: d0 48 c7 c7 60 ee 8a 8b 48 c7 c6 80 f0 8a 8b 48 8b 14 24 4c 89 f1 4d 89 e0 4c 8b 4c 24 08 41 52 e8 23 3b e6 ff 48 83 c4 08 90 <0f> 0b 90 90 e9 6d fd ff ff 48 c7 c1 34 81 a1 8f 80 e1 07 80 c1 03 [ 103.965355][ T6144] RSP: 0018:ffffc9000476f498 EFLAGS: 00010282 [ 103.971449][ T6144] RAX: a2690b5ea5a9e900 RBX: ffff888079b79f48 RCX: ffff88803097da00 [ 103.979499][ T6144] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 103.987539][ T6144] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 103.995602][ T6144] R10: dffffc0000000000 R11: fffffbfff1bfaa14 R12: 0000000000000000 [ 104.003600][ T6144] R13: ffff888079b79fa0 R14: ffff888079b79f48 R15: 1ffff1100f36f3ea [ 104.011622][ T6144] FS: 00007fae1b9626c0(0000) GS:ffff888125c40000(0000) knlGS:0000000000000000 [ 104.020609][ T6144] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 104.027254][ T6144] CR2: 00007fae1b9ec3c0 CR3: 000000002f152000 CR4: 00000000003526f0 [ 104.035274][ T6144] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 104.043271][ T6144] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 104.051359][ T6144] Call Trace: [ 104.054680][ T6144] [ 104.057636][ T6144] move_pgt_entry+0xfa7/0x1170 [ 104.062433][ T6144] ? alloc_new_pud+0x185/0x310 [ 104.067265][ T6144] move_page_tables+0xcde/0x2940 [ 104.072248][ T6144] ? move_page_tables+0x5ae/0x2940 [ 104.077430][ T6144] ? __pfx_move_page_tables+0x10/0x10 [ 104.082848][ T6144] move_vma+0xd5e/0x2010 [ 104.087174][ T6144] ? __pfx_move_vma+0x10/0x10 [ 104.091884][ T6144] ? arch_get_unmapped_area_topdown+0x251/0xbc0 [ 104.098209][ T6144] ? mm_get_unmapped_area+0xa7/0xd0 [ 104.103428][ T6144] ? shmem_get_unmapped_area+0x2cf/0x910 [ 104.109127][ T6144] ? cap_mmap_addr+0xb0/0x100 [ 104.113805][ T6144] ? bpf_lsm_mmap_addr+0x9/0x20 [ 104.118684][ T6144] ? security_mmap_addr+0x71/0x270 [ 104.123820][ T6144] ? __get_unmapped_area+0x3e4/0x450 [ 104.129179][ T6144] ? vrm_set_new_addr+0x1a7/0x1f0 [ 104.134252][ T6144] mremap_to+0x7e7/0x8b0 [ 104.138532][ T6144] ? __pfx_mremap_to+0x10/0x10 [ 104.143337][ T6144] ? __pfx_down_write_killable+0x10/0x10 [ 104.149079][ T6144] ? __might_fault+0xb0/0x130 [ 104.153783][ T6144] __se_sys_mremap+0x8f5/0xc60 [ 104.158601][ T6144] ? __pfx___se_sys_mremap+0x10/0x10 [ 104.163921][ T6144] ? rcu_is_watching+0x15/0xb0 [ 104.168750][ T6144] ? do_syscall_64+0xbe/0x3b0 [ 104.173460][ T6144] ? __x64_sys_mremap+0x20/0xc0 [ 104.178375][ T6144] do_syscall_64+0xfa/0x3b0 [ 104.182909][ T6144] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.189130][ T6144] ? __switch_to_asm+0x39/0x70 [ 104.193923][ T6144] ? clear_bhb_loop+0x60/0xb0 [ 104.198683][ T6144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.204666][ T6144] RIP: 0033:0x7fae1b9d33b9 [ 104.209106][ T6144] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 104.228767][ T6144] RSP: 002b:00007fae1b962168 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 104.237395][ T6144] RAX: ffffffffffffffda RBX: 00007fae1ba563f8 RCX: 00007fae1b9d33b9 [ 104.245533][ T6144] RDX: 0000000000200000 RSI: 0000000000600600 RDI: 0000200000000000 [ 104.253526][ T6144] RBP: 00007fae1ba563f0 R08: 0000200000a00000 R09: 0000000000000000 [ 104.261629][ T6144] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fae1ba563fc [ 104.269658][ T6144] R13: 000000000000006e R14: 00007ffcf99e7e70 R15: 00007ffcf99e7f58 [ 104.277690][ T6144] [ 104.280730][ T6144] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 104.288026][ T6144] CPU: 0 UID: 0 PID: 6144 Comm: syz-executor427 Not tainted 6.16.0-rc2-next-20250616-syzkaller #0 PREEMPT(full) [ 104.299935][ T6144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 104.310091][ T6144] Call Trace: [ 104.313380][ T6144] [ 104.316318][ T6144] dump_stack_lvl+0x99/0x250 [ 104.320939][ T6144] ? __asan_memcpy+0x40/0x70 [ 104.325550][ T6144] ? __pfx_dump_stack_lvl+0x10/0x10 [ 104.330762][ T6144] ? __pfx__printk+0x10/0x10 [ 104.335451][ T6144] panic+0x2db/0x790 [ 104.339363][ T6144] ? __pfx_panic+0x10/0x10 [ 104.343799][ T6144] __warn+0x334/0x4c0 [ 104.347806][ T6144] ? up_write+0x3a2/0x420 [ 104.352157][ T6144] ? up_write+0x3a2/0x420 [ 104.356589][ T6144] report_bug+0x2be/0x4f0 [ 104.360940][ T6144] ? up_write+0x3a2/0x420 [ 104.365366][ T6144] ? up_write+0x3a2/0x420 [ 104.369716][ T6144] ? up_write+0x3a4/0x420 [ 104.374066][ T6144] handle_bug+0x84/0x160 [ 104.378335][ T6144] exc_invalid_op+0x1a/0x50 [ 104.382846][ T6144] asm_exc_invalid_op+0x1a/0x20 [ 104.387707][ T6144] RIP: 0010:up_write+0x3a2/0x420 [ 104.392652][ T6144] Code: d0 48 c7 c7 60 ee 8a 8b 48 c7 c6 80 f0 8a 8b 48 8b 14 24 4c 89 f1 4d 89 e0 4c 8b 4c 24 08 41 52 e8 23 3b e6 ff 48 83 c4 08 90 <0f> 0b 90 90 e9 6d fd ff ff 48 c7 c1 34 81 a1 8f 80 e1 07 80 c1 03 [ 104.412274][ T6144] RSP: 0018:ffffc9000476f498 EFLAGS: 00010282 [ 104.418384][ T6144] RAX: a2690b5ea5a9e900 RBX: ffff888079b79f48 RCX: ffff88803097da00 [ 104.426374][ T6144] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002 [ 104.434352][ T6144] RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004 [ 104.442334][ T6144] R10: dffffc0000000000 R11: fffffbfff1bfaa14 R12: 0000000000000000 [ 104.450317][ T6144] R13: ffff888079b79fa0 R14: ffff888079b79f48 R15: 1ffff1100f36f3ea [ 104.458306][ T6144] move_pgt_entry+0xfa7/0x1170 [ 104.463094][ T6144] ? alloc_new_pud+0x185/0x310 [ 104.467872][ T6144] move_page_tables+0xcde/0x2940 [ 104.472826][ T6144] ? move_page_tables+0x5ae/0x2940 [ 104.477954][ T6144] ? __pfx_move_page_tables+0x10/0x10 [ 104.483347][ T6144] move_vma+0xd5e/0x2010 [ 104.487611][ T6144] ? __pfx_move_vma+0x10/0x10 [ 104.492301][ T6144] ? arch_get_unmapped_area_topdown+0x251/0xbc0 [ 104.498568][ T6144] ? mm_get_unmapped_area+0xa7/0xd0 [ 104.503774][ T6144] ? shmem_get_unmapped_area+0x2cf/0x910 [ 104.509424][ T6144] ? cap_mmap_addr+0xb0/0x100 [ 104.514198][ T6144] ? bpf_lsm_mmap_addr+0x9/0x20 [ 104.519072][ T6144] ? security_mmap_addr+0x71/0x270 [ 104.524191][ T6144] ? __get_unmapped_area+0x3e4/0x450 [ 104.529503][ T6144] ? vrm_set_new_addr+0x1a7/0x1f0 [ 104.534537][ T6144] mremap_to+0x7e7/0x8b0 [ 104.538790][ T6144] ? __pfx_mremap_to+0x10/0x10 [ 104.543563][ T6144] ? __pfx_down_write_killable+0x10/0x10 [ 104.549308][ T6144] ? __might_fault+0xb0/0x130 [ 104.553995][ T6144] __se_sys_mremap+0x8f5/0xc60 [ 104.558778][ T6144] ? __pfx___se_sys_mremap+0x10/0x10 [ 104.564081][ T6144] ? rcu_is_watching+0x15/0xb0 [ 104.568857][ T6144] ? do_syscall_64+0xbe/0x3b0 [ 104.573545][ T6144] ? __x64_sys_mremap+0x20/0xc0 [ 104.578422][ T6144] do_syscall_64+0xfa/0x3b0 [ 104.582949][ T6144] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.589018][ T6144] ? __switch_to_asm+0x39/0x70 [ 104.593829][ T6144] ? clear_bhb_loop+0x60/0xb0 [ 104.598511][ T6144] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.604407][ T6144] RIP: 0033:0x7fae1b9d33b9 [ 104.608829][ T6144] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 1d 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 104.628439][ T6144] RSP: 002b:00007fae1b962168 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 104.636863][ T6144] RAX: ffffffffffffffda RBX: 00007fae1ba563f8 RCX: 00007fae1b9d33b9 [ 104.644848][ T6144] RDX: 0000000000200000 RSI: 0000000000600600 RDI: 0000200000000000 [ 104.652820][ T6144] RBP: 00007fae1ba563f0 R08: 0000200000a00000 R09: 0000000000000000 [ 104.660791][ T6144] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fae1ba563fc [ 104.668769][ T6144] R13: 000000000000006e R14: 00007ffcf99e7e70 R15: 00007ffcf99e7f58 [ 104.676748][ T6144] [ 104.680001][ T6144] Kernel Offset: disabled [ 104.684329][ T6144] Rebooting in 86400 seconds..