------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(rt_mutex_owner(lock) != current) WARNING: kernel/locking/rtmutex_common.h:193 at debug_rt_mutex_unlock kernel/locking/rtmutex_common.h:193 [inline], CPU#0: syz.9.295/8499 WARNING: kernel/locking/rtmutex_common.h:193 at rt_mutex_slowunlock+0x732/0xa20 kernel/locking/rtmutex.c:1432, CPU#0: syz.9.295/8499 Modules linked in: CPU: 0 UID: 0 PID: 8499 Comm: syz.9.295 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 RIP: 0010:debug_rt_mutex_unlock kernel/locking/rtmutex_common.h:193 [inline] RIP: 0010:rt_mutex_slowunlock+0x739/0xa20 kernel/locking/rtmutex.c:1432 Code: 8b 8f 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 cf 02 00 00 83 3d db e6 61 04 00 75 13 48 8d 3d 3e 2b 65 04 48 c7 c6 a0 ff 4c 8b <67> 48 0f b9 3a 90 e9 d1 f9 ff ff 48 8d 3d 35 2b 65 04 67 48 0f b9 RSP: 0018:ffffc90004d8f940 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff88805fe1b130 RCX: 0000000000080000 RDX: ffffc90014e19000 RSI: ffffffff8b4cffa0 RDI: ffffffff8f8e56b0 RBP: ffffc90004d8fa38 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff1f16249 R12: dffffc0000000000 R13: 1ffff920009b1f30 R14: ffff88805fe1b0e0 R15: 0000000000000246 FS: 00007fb7efa9d6c0(0000) GS:ffff888126111000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b3200dff8 CR3: 0000000033a3a000 CR4: 00000000003526f0 Call Trace: inode_unlock include/linux/fs.h:1034 [inline] open_last_lookups fs/namei.c:4616 [inline] path_openat+0x186a/0x3850 fs/namei.c:4856 do_file_open+0x23e/0x4a0 fs/namei.c:4888 do_sys_openat2+0x115/0x200 fs/open.c:1368 do_sys_open fs/open.c:1374 [inline] __do_sys_openat fs/open.c:1390 [inline] __se_sys_openat fs/open.c:1385 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1385 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb7f186ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb7efa9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fb7f1ae6090 RCX: 00007fb7f186ce59 RDX: 000000000000275a RSI: 0000200000000200 RDI: ffffffffffffff9c RBP: 00007fb7f1902e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb7f1ae6128 R14: 00007fb7f1ae6090 R15: 00007fff0e488658 ---------------- Code disassembly (best guess): 0: 8b 8f 48 c1 e8 03 mov 0x3e8c148(%rdi),%ecx 6: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax b: 84 c0 test %al,%al d: 0f 85 cf 02 00 00 jne 0x2e2 13: 83 3d db e6 61 04 00 cmpl $0x0,0x461e6db(%rip) # 0x461e6f5 1a: 75 13 jne 0x2f 1c: 48 8d 3d 3e 2b 65 04 lea 0x4652b3e(%rip),%rdi # 0x4652b61 23: 48 c7 c6 a0 ff 4c 8b mov $0xffffffff8b4cffa0,%rsi * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: 90 nop 30: e9 d1 f9 ff ff jmp 0xfffffa06 35: 48 8d 3d 35 2b 65 04 lea 0x4652b35(%rip),%rdi # 0x4652b71 3c: 67 addr32 3d: 48 rex.W 3e: 0f .byte 0xf 3f: b9 .byte 0xb9