===================================== WARNING: bad unlock balance detected! syzkaller #0 Not tainted ------------------------------------- dhcpcd/4655 is trying to release lock (rcu_read_lock) at: [] rcu_lock_release+0x18/0x40 include/linux/rcupdate.h:309 but there are no more locks to release! other info that might help us debug this: 1 lock held by dhcpcd/4655: #0: ffff0000d408acf8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline] #0: ffff0000d408acf8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x158/0xaf8 mm/mmap.c:1284 stack backtrace: CPU: 0 UID: 0 PID: 4655 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_unlock_imbalance_bug+0xf4/0xfc kernel/locking/lockdep.c:5298 __lock_release kernel/locking/lockdep.c:-1 [inline] lock_release+0x1dc/0x3b0 kernel/locking/lockdep.c:5889 rcu_lock_release+0x30/0x40 include/linux/rcupdate.h:310 rcu_read_unlock include/linux/rcupdate.h:869 [inline] pte_unmap include/linux/pgtable.h:117 [inline] zap_pte_range mm/memory.c:1948 [inline] zap_pmd_range mm/memory.c:2004 [inline] zap_pud_range mm/memory.c:2032 [inline] zap_p4d_range mm/memory.c:2053 [inline] __zap_vma_range+0x2f44/0x4040 mm/memory.c:2093 unmap_vmas+0x254/0x3b8 mm/memory.c:2162 exit_mmap+0x1e8/0xaf8 mm/mmap.c:1300 __mmput+0xe4/0x2f0 kernel/fork.c:1178 mmput+0x70/0xa8 kernel/fork.c:1201 exit_mm+0x134/0x1e8 kernel/exit.c:581 do_exit+0x518/0x1a6c kernel/exit.c:963 do_group_exit+0x194/0x22c kernel/exit.c:1117 __do_sys_exit_group kernel/exit.c:1128 [inline] __se_sys_exit_group kernel/exit.c:1126 [inline] pid_child_should_wake+0x0/0x110 kernel/exit.c:1126 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 ------------[ cut here ]------------ WARNING: kernel/rcu/tree_plugin.h:443 at __rcu_read_unlock+0x98/0x104 kernel/rcu/tree_plugin.h:445, CPU#1: dhcpcd/4655 Modules linked in: CPU: 1 UID: 0 PID: 4655 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __rcu_read_unlock+0x98/0x104 kernel/rcu/tree_plugin.h:445 lr : rcu_read_unlock include/linux/rcupdate.h:871 [inline] lr : pte_unmap include/linux/pgtable.h:117 [inline] lr : zap_pte_range mm/memory.c:1948 [inline] lr : zap_pmd_range mm/memory.c:2004 [inline] lr : zap_pud_range mm/memory.c:2032 [inline] lr : zap_p4d_range mm/memory.c:2053 [inline] lr : __zap_vma_range+0x2f48/0x4040 mm/memory.c:2093 sp : ffff800096d373e0 x29: ffff800096d373f0 x28: 0000aaaab45c4000 x27: 00e80001166bff43 x26: 0000aaaab45c5000 x25: dfff800000000000 x24: 00e80001166bff43 x23: 0000000000000000 x22: 0000000000000000 x21: dfff800000000000 x20: 1fffe0001a47db70 x19: ffff0000d23edb84 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 x11: 00000000000005ca x10: 0000000000000003 x9 : 0000000000000007 x8 : 0000000000000003 x7 : 0000000000000000 x6 : ffff8000804886d0 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008048c3e0 x2 : 0000000100000000 x1 : ffff0000d23ed700 x0 : ffff0000d23ed700 Call trace: __rcu_read_unlock+0x98/0x104 kernel/rcu/tree_plugin.h:445 (P) rcu_read_unlock include/linux/rcupdate.h:871 [inline] pte_unmap include/linux/pgtable.h:117 [inline] zap_pte_range mm/memory.c:1948 [inline] zap_pmd_range mm/memory.c:2004 [inline] zap_pud_range mm/memory.c:2032 [inline] zap_p4d_range mm/memory.c:2053 [inline] __zap_vma_range+0x2f48/0x4040 mm/memory.c:2093 unmap_vmas+0x254/0x3b8 mm/memory.c:2162 exit_mmap+0x1e8/0xaf8 mm/mmap.c:1300 __mmput+0xe4/0x2f0 kernel/fork.c:1178 mmput+0x70/0xa8 kernel/fork.c:1201 exit_mm+0x134/0x1e8 kernel/exit.c:581 do_exit+0x518/0x1a6c kernel/exit.c:963 do_group_exit+0x194/0x22c kernel/exit.c:1117 __do_sys_exit_group kernel/exit.c:1128 [inline] __se_sys_exit_group kernel/exit.c:1126 [inline] pid_child_should_wake+0x0/0x110 kernel/exit.c:1126 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 irq event stamp: 1233 hardirqs last enabled at (1233): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] hardirqs last enabled at (1233): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:198 hardirqs last disabled at (1232): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:130 [inline] hardirqs last disabled at (1232): [] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:166 softirqs last enabled at (1100): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (1098): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- BUG: sleeping function called from invalid context at mm/memory.c:2007 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 4655, name: dhcpcd preempt_count: 0, expected: 0 RCU nest depth: -1, expected: 0 INFO: lockdep is turned off. CPU: 1 UID: 0 PID: 4655 Comm: dhcpcd Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 __might_resched+0x350/0x4ac kernel/sched/core.c:9162 zap_pmd_range mm/memory.c:2007 [inline] zap_pud_range mm/memory.c:2032 [inline] zap_p4d_range mm/memory.c:2053 [inline] __zap_vma_range+0x3910/0x4040 mm/memory.c:2093 unmap_vmas+0x254/0x3b8 mm/memory.c:2162 exit_mmap+0x1e8/0xaf8 mm/mmap.c:1300 __mmput+0xe4/0x2f0 kernel/fork.c:1178 mmput+0x70/0xa8 kernel/fork.c:1201 exit_mm+0x134/0x1e8 kernel/exit.c:581 do_exit+0x518/0x1a6c kernel/exit.c:963 do_group_exit+0x194/0x22c kernel/exit.c:1117 __do_sys_exit_group kernel/exit.c:1128 [inline] __se_sys_exit_group kernel/exit.c:1126 [inline] pid_child_should_wake+0x0/0x110 kernel/exit.c:1126 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x25c arch/arm64/kernel/entry-common.c:723 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:742 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594