BTRFS info (device loop0): first mount of filesystem 92aec1fe-fee8-4e05-92dc-790b47b871d9 BTRFS info (device loop0): using xxhash64 (xxhash64-generic) checksum algorithm BTRFS info (device loop0): using free-space-tree ===================================== WARNING: bad unlock balance detected! 6.10.0-rc7-syzkaller #0 Not tainted ------------------------------------- syz.0.15/3989 is trying to release lock (&sb->s_type->i_mutex_key) at: [] btrfs_direct_write+0x321/0x380 fs/btrfs/direct-io.c:920 but there are no more locks to release! other info that might help us debug this: 2 locks held by syz.0.15/3989: #0: ffff8881083140c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x71/0xa0 fs/file.c:1191 #1: ffff888106311408 (sb_writers#12){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2854 [inline] #1: ffff888106311408 (sb_writers#12){.+.+}-{0:0}, at: vfs_write+0xdc/0x3a0 fs/read_write.c:586 stack backtrace: CPU: 0 PID: 3989 Comm: syz.0.15 Not tainted 6.10.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xa3/0x100 lib/dump_stack.c:114 print_unlock_imbalance_bug+0x17d/0x190 kernel/locking/lockdep.c:5194 __lock_release kernel/locking/lockdep.c:5431 [inline] lock_release+0x1cc/0x2c0 kernel/locking/lockdep.c:5774 up_write+0x2c/0x170 kernel/locking/rwsem.c:1631 btrfs_direct_write+0x321/0x380 fs/btrfs/direct-io.c:920 btrfs_do_write_iter+0xb2/0x1b0 fs/btrfs/file.c:1505 new_sync_write fs/read_write.c:497 [inline] vfs_write+0x30d/0x3a0 fs/read_write.c:590 ksys_write+0x70/0xe0 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xa0/0x1b0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5b2df773b9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f5b2ee0e048 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5b2e105f80 RCX: 00007f5b2df773b9 RDX: 0000000000182000 RSI: 0000000020000000 RDI: 0000000000000005 RBP: 00007f5b2dfe48e6 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f5b2e105f80 R15: 00007ffd36c7e958