[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.166' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program syzkaller login: [ 37.338063] [ 37.339709] ===================================== [ 37.344543] WARNING: bad unlock balance detected! [ 37.349367] 4.19.211-syzkaller #0 Not tainted [ 37.353869] ------------------------------------- [ 37.358688] syz-executor362/8161 is trying to release lock (&file->mut) at: [ 37.365777] [] ucma_destroy_id+0x221/0x4a0 [ 37.371566] but there are no more locks to release! [ 37.376555] [ 37.376555] other info that might help us debug this: [ 37.383205] 1 lock held by syz-executor362/8161: [ 37.387934] #0: 000000004aad7ca1 (&file->mut){+.+.}, at: ucma_destroy_id+0x1c2/0x4a0 [ 37.395896] [ 37.395896] stack backtrace: [ 37.400462] CPU: 1 PID: 8161 Comm: syz-executor362 Not tainted 4.19.211-syzkaller #0 [ 37.408318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 37.417734] Call Trace: [ 37.420395] dump_stack+0x1fc/0x2ef [ 37.424012] ? ucma_destroy_id+0x221/0x4a0 [ 37.428232] lock_release.cold+0xe/0x4a [ 37.432209] ? lock_downgrade+0x720/0x720 [ 37.436420] ? ucma_destroy_id+0x1c2/0x4a0 [ 37.440643] ? mutex_trylock+0x1a0/0x1a0 [ 37.444684] __mutex_unlock_slowpath+0x89/0x610 [ 37.449345] ? wait_for_completion_io+0x10/0x10 [ 37.454013] ? __radix_tree_lookup+0x216/0x370 [ 37.458581] ucma_destroy_id+0x221/0x4a0 [ 37.462622] ? ucma_query_route+0xdd0/0xdd0 [ 37.467016] ? __might_fault+0x192/0x1d0 [ 37.471065] ? _copy_from_user+0xd2/0x130 [ 37.475204] ? ucma_query_route+0xdd0/0xdd0 [ 37.479506] ucma_write+0x288/0x350 [ 37.483120] ? ucma_set_ib_path+0x5a0/0x5a0 [ 37.487420] ? __lock_acquire+0x6de/0x3ff0 [ 37.491643] __vfs_write+0xf7/0x770 [ 37.495252] ? ucma_set_ib_path+0x5a0/0x5a0 [ 37.499567] ? common_file_perm+0x4e5/0x850 [ 37.503875] ? kernel_read+0x110/0x110 [ 37.507748] ? apparmor_getprocattr+0x11e0/0x11e0 [ 37.512584] ? security_file_permission+0x1c0/0x220 [ 37.517592] vfs_write+0x1f3/0x540 [ 37.521201] ksys_write+0x12b/0x2a0 [ 37.524822] ? __ia32_sys_read+0xb0/0xb0 [ 37.528964] ? trace_hardirqs_off_caller+0x6e/0x210 [ 37.533957] ? do_syscall_64+0x21/0x620 [ 37.538003] do_syscall_64+0xf9/0x620 [ 37.541880] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 37.547045] RIP: 0033:0x7fc90e5c9a39 [ 37.550821] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 37.569817] RSP: 002b:00007fc90e55a308 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 37.577506] RAX: ffffffffffffffda RBX: 00007fc90e651418 RCX: 00007fc90e5c9a39 [ 37.584765] RDX: 0000000000000018 RSI: 0000000020000280 RDI: 0000000000000003 [ 37.592017] RBP: 00007fc90e651410 R08: 00007fc90e55a700 R09: 0000000000000000 [ 37.599279] R10: 00007fc90e55a700 R11: 0000000000000246 R12: 00007fc90e65141c [ 37.606536] R13: 00007fc90e61f074 R14: 006d635f616d6472 R15: 0000000000022000