WARNING: bad unlock balance in gtp_encap_enable

WARNING: bad unlock balance in gtp_encap_enable_socket
Status: fixed on 2020/02/09 09:28
Reported-by: syzbot+aeb8f1daf63e840e3da8@syzkaller.appspotmail.com
Fix commit: 887b0296 gtp: fix bad unlock balance in gtp_encap_enable_socket
First crash: 296d, last: 293d

Fix bisection: fixed by (bisect log) :
commit 887b0296a905f8d5cc090ca08d309918fc24bf24
Author: Eric Dumazet <edumazet@google.com>
Date: Mon Jan 6 14:45:37 2020 +0000

gtp: fix bad unlock balance in gtp_encap_enable_socket

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	WARNING: bad unlock balance in gtp_encap_enable_socket	C	done		8	292d	296d	16/17	fixed on 2020/02/18 14:31
linux-4.19	WARNING: bad unlock balance in gtp_encap_enable_socket	C		done	2	294d	297d	1/1	fixed on 2020/02/07 14:13

Sample crash report:

audit: type=1400 audit(1578310052.917:36): avc:  denied  { map } for  pid=7091 comm="syz-executor204" path="/root/syz-executor204034520" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
=====================================
WARNING: bad unlock balance detected!
4.14.162-syzkaller #0 Not tainted
-------------------------------------
syz-executor204/7111 is trying to release lock (sk_lock-AF_INET6) at:
[<ffffffff83f7423c>] gtp_encap_enable_socket+0x10c/0x360 drivers/net/gtp.c:833
but there are no more locks to release!

other info that might help us debug this:
2 locks held by syz-executor204/7111:
 #0:  (rtnl_mutex){+.+.}, at: [<ffffffff8523c0b9>] rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0:  (rtnl_mutex){+.+.}, at: [<ffffffff8523c0b9>] rtnetlink_rcv_msg+0x339/0xb70 net/core/rtnetlink.c:4301
 #1:  (slock-AF_INET6){+...}, at: [<ffffffff8519b3e0>] spin_lock_bh include/linux/spinlock.h:322 [inline]
 #1:  (slock-AF_INET6){+...}, at: [<ffffffff8519b3e0>] release_sock+0x20/0x1b0 net/core/sock.c:2777

stack backtrace:
CPU: 1 PID: 7111 Comm: syz-executor204 Not tainted 4.14.162-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x142/0x197 lib/dump_stack.c:58
 print_unlock_imbalance_bug kernel/locking/lockdep.c:3548 [inline]
 print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3525
 __lock_release kernel/locking/lockdep.c:3765 [inline]
 lock_release+0x616/0x940 kernel/locking/lockdep.c:4013
 sock_release_ownership include/net/sock.h:1430 [inline]
 release_sock+0x175/0x1b0 net/core/sock.c:2787
 gtp_encap_enable_socket+0x10c/0x360 drivers/net/gtp.c:833
 gtp_encap_enable drivers/net/gtp.c:855 [inline]
 gtp_newlink+0x99f/0xc50 drivers/net/gtp.c:670
 rtnl_newlink+0xecb/0x1700 net/core/rtnetlink.c:2719
 rtnetlink_rcv_msg+0x3da/0xb70 net/core/rtnetlink.c:4306
 netlink_rcv_skb+0x14f/0x3c0 net/netlink/af_netlink.c:2432
 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:4318
 netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline]
 netlink_unicast+0x44d/0x650 net/netlink/af_netlink.c:1312
 netlink_sendmsg+0x7c4/0xc60 net/netlink/af_netlink.c:1877
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xce/0x110 net/socket.c:656
 ___sys_sendmsg+0x70a/0x840 net/socket.c:2062
 __sys_sendmsg+0xb9/0x140 net/socket.c:2096
 SYSC_sendmsg net/socket.c:2107 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2103
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x446ce9
RSP: 002b:00007fa109c79db8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000006dbc38 RCX: 0000000000446ce9
RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003
RBP: 00000000006dbc30 R08: 0000000000000004 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00000000006dbc3c
R13: 00007ffd6eefd73f R14: 00007fa109c7a9c0 R15: 000000000000002d

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Maintainers
ci2-linux-4-14	2020/01/06 11:30	linux-4.14.y	84f5ad46	438e1227	.config	log	report	syz	C		laforge@gnumonks.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, osmocom-net-gprs@lists.osmocom.org, pablo@netfilter.org
ci2-linux-4-14	2020/01/09 03:05	linux-4.14.y	84f5ad46	ddc3e859	.config	log	report	syz			laforge@gnumonks.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, osmocom-net-gprs@lists.osmocom.org, pablo@netfilter.org