./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor814948598
<...>
Warning: Permanently added '10.128.1.165' (ED25519) to the list of known hosts.
execve("./syz-executor814948598", ["./syz-executor814948598"], 0x7ffcdb017430 /* 10 vars */) = 0
brk(NULL) = 0x55558e6e1000
brk(0x55558e6e1d00) = 0x55558e6e1d00
arch_prctl(ARCH_SET_FS, 0x55558e6e1380) = 0
set_tid_address(0x55558e6e1650) = 5834
set_robust_list(0x55558e6e1660, 24) = 0
rseq(0x55558e6e1ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor814948598", 4096) = 27
getrandom("\x17\x9a\x11\xa4\x46\xfe\x2d\x36", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55558e6e1d00
brk(0x55558e702d00) = 0x55558e702d00
brk(0x55558e703000) = 0x55558e703000
mprotect(0x7f8427bd4000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
executing program
write(1, "executing program\n", 18) = 18
socket(AF_PPPOX, SOCK_STREAM, 1) = 3
ioctl(3, SIOCSIFMTU, {ifr_name="dummy0", ifr_mtu=0}) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 4
[ 70.313783][ T5834]
[ 70.316152][ T5834] =====================================
[ 70.321668][ T5834] WARNING: bad unlock balance detected!
[ 70.327201][ T5834] 6.14.0-syzkaller-12504-g8bc251e5d874 #0 Not tainted
[ 70.333958][ T5834] -------------------------------------
[ 70.339482][ T5834] syz-executor814/5834 is trying to release lock (&dev_instance_lock_key) at:
[ 70.348327][ T5834] [<ffffffff89f41f56>] do_setlink+0xc26/0x43a0
[ 70.354487][ T5834] but there are no more locks to release!
[ 70.360179][ T5834]
[ 70.360179][ T5834] other info that might help us debug this:
[ 70.368217][ T5834] 1 lock held by syz-executor814/5834:
[ 70.373648][ T5834] #0: ffffffff900fc408 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xd68/0x1fe0
[ 70.382763][ T5834]
[ 70.382763][ T5834] stack backtrace:
[ 70.388644][ T5834] CPU: 0 UID: 0 PID: 5834 Comm: syz-executor814 Not tainted 6.14.0-syzkaller-12504-g8bc251e5d874 #0 PREEMPT(full)
[ 70.388657][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
[ 70.388665][ T5834] Call Trace:
[ 70.388670][ T5834] <TASK>
[ 70.388675][ T5834] dump_stack_lvl+0x241/0x360
[ 70.388695][ T5834] ? __pfx_dump_stack_lvl+0x10/0x10
[ 70.388707][ T5834] ? __pfx__printk+0x10/0x10
[ 70.388718][ T5834] ? print_lock+0x171/0x1a0
[ 70.388729][ T5834] ? do_setlink+0xc26/0x43a0
[ 70.388742][ T5834] print_unlock_imbalance_bug+0x185/0x1a0
[ 70.388762][ T5834] lock_release+0x1ed/0x3e0
[ 70.388772][ T5834] ? do_setlink+0xc26/0x43a0
[ 70.388783][ T5834] ? do_setlink+0xc26/0x43a0
[ 70.388794][ T5834] __mutex_unlock_slowpath+0xee/0x800
[ 70.388805][ T5834] ? validate_linkmsg+0x70e/0xa40
[ 70.388815][ T5834] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 70.388825][ T5834] ? __pfx_validate_linkmsg+0x10/0x10
[ 70.388835][ T5834] do_setlink+0xc26/0x43a0
[ 70.388849][ T5834] ? stack_trace_save+0x11a/0x1d0
[ 70.388863][ T5834] ? __pfx_do_setlink+0x10/0x10
[ 70.388875][ T5834] ? __lock_acquire+0xad5/0xd80
[ 70.388886][ T5834] ? __pfx___mutex_trylock_common+0x10/0x10
[ 70.388898][ T5834] ? rcu_is_watching+0x15/0xb0
[ 70.388910][ T5834] ? trace_contention_end+0x3c/0x120
[ 70.388920][ T5834] ? __mutex_lock+0x380/0x10c0
[ 70.388930][ T5834] ? __pfx_aa_get_newest_label+0x10/0x10
[ 70.388946][ T5834] ? rcu_is_watching+0x15/0xb0
[ 70.388956][ T5834] ? rtnl_newlink+0xd68/0x1fe0
[ 70.388966][ T5834] ? __pfx___mutex_lock+0x10/0x10
[ 70.388977][ T5834] ? ns_capable+0x8a/0xf0
[ 70.388986][ T5834] ? rtnl_link_get_net_capable+0x168/0x340
[ 70.388998][ T5834] rtnl_newlink+0x1619/0x1fe0
[ 70.389012][ T5834] ? __pfx_rtnl_newlink+0x10/0x10
[ 70.389022][ T5834] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 70.389035][ T5834] ? __lock_acquire+0xad5/0xd80
[ 70.389045][ T5834] ? __lock_acquire+0xad5/0xd80
[ 70.389054][ T5834] ? __lock_acquire+0xad5/0xd80
[ 70.389065][ T5834] ? is_bpf_text_address+0x26/0x2a0
[ 70.389076][ T5834] ? is_bpf_text_address+0x288/0x2a0
[ 70.389085][ T5834] ? is_bpf_text_address+0x26/0x2a0
[ 70.389095][ T5834] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 70.389107][ T5834] ? kernel_text_address+0xa7/0xe0
[ 70.389115][ T5834] ? __kernel_text_address+0xd/0x40
[ 70.389123][ T5834] ? aa_get_newest_label+0x101/0x6f0
[ 70.389135][ T5834] ? __lock_acquire+0xad5/0xd80
[ 70.389147][ T5834] ? __pfx_rtnl_newlink+0x10/0x10
[ 70.389157][ T5834] rtnetlink_rcv_msg+0x80f/0xd70
[ 70.389168][ T5834] ? rtnetlink_rcv_msg+0x1ba/0xd70
[ 70.389179][ T5834] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 70.389188][ T5834] ? __lock_acquire+0xad5/0xd80
[ 70.389199][ T5834] netlink_rcv_skb+0x208/0x480
[ 70.389211][ T5834] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 70.389221][ T5834] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 70.389234][ T5834] ? netlink_deliver_tap+0x2e/0x1b0
[ 70.389245][ T5834] ? netlink_deliver_tap+0x2e/0x1b0
[ 70.389256][ T5834] netlink_unicast+0x7f8/0x9a0
[ 70.389267][ T5834] ? __pfx_netlink_unicast+0x10/0x10
[ 70.389276][ T5834] ? skb_put+0x114/0x1f0
[ 70.389289][ T5834] netlink_sendmsg+0x8c3/0xcd0
[ 70.389302][ T5834] ? __pfx_netlink_sendmsg+0x10/0x10
[ 70.389313][ T5834] ? aa_sock_msg_perm+0x91/0x160
[ 70.389325][ T5834] ? __pfx_netlink_sendmsg+0x10/0x10
[ 70.389335][ T5834] __sock_sendmsg+0x221/0x270
[ 70.389346][ T5834] ____sys_sendmsg+0x523/0x860
[ 70.389356][ T5834] ? __pfx_____sys_sendmsg+0x10/0x10
[ 70.389366][ T5834] __sys_sendmsg+0x271/0x360
[ 70.389375][ T5834] ? __pfx___sys_sendmsg+0x10/0x10
[ 70.389393][ T5834] do_syscall_64+0xf3/0x230
[ 70.389403][ T5834] ? clear_bhb_loop+0x45/0xa0
[ 70.389413][ T5834] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 70.389421][ T5834] RIP: 0033:0x7f8427b614a9
[ 70.389434][ T5834] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 70.389441][ T5834] RSP: 002b:00007fff9b59f3a8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 70.389452][ T5834] RAX: ffffffffffffffda RBX: 00007fff9b59f578 RCX: 00007f8427b614a9
[ 70.389458][ T5834] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000004
[ 70.389464][ T5834] RBP: 00007f8427bd4610 R08: 000000000000000c R09: 00007fff9b59f578
[ 70.389475][ T5834] R10: 000000000000001b R11: 0000000000000246 R12: 0000000000000001
sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x34\x00\x00\x00\x10\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x00\x1b\x00\x00\x00\x00\x00\x0c\x00\x1a\x80\x08\x00\x02\x80\x04\x00\x01\x80", iov_len=52}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTWAIT|MSG_EOR}, 0) = 52
exit_group(0) = ?
+++ exited with 0 +++
[ 70.389480][ T5834] R13: