=====================================
[ BUG: bad unlock balance detected! ]
4.9.80-g550c01d #29 Not tainted
-------------------------------------
syz-executor6/13475 is trying to release lock (mrt_lock) at:
[<ffffffff834e8ee4>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
but there are no more locks to release!

other info that might help us debug this:
2 locks held by syz-executor6/13475:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff815d3a5f>] __fdget_pos+0x9f/0xc0 fs/file.c:781
 #1:  (&p->lock){+.+.+.}, at: [<ffffffff815e8e5d>] seq_read+0xdd/0x1290 fs/seq_file.c:178

stack backtrace:
CPU: 0 PID: 13475 Comm: syz-executor6 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d763f8e8 ffffffff81d94b69 ffffffff849b6cf8 ffff8801d4520000
 ffffffff834e8ee4 ffffffff849b6cf8 ffff8801d4520888 ffff8801d763f918
 ffffffff81237e04 dffffc0000000000 ffffffff849b6cf8 00000000ffffffff
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81237e04>] print_unlock_imbalance_bug+0x174/0x1a0 kernel/locking/lockdep.c:3398
 [<ffffffff812408d8>] __lock_release kernel/locking/lockdep.c:3540 [inline]
 [<ffffffff812408d8>] lock_release+0x6f8/0xb80 kernel/locking/lockdep.c:3775
 [<ffffffff838b2fda>] __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline]
 [<ffffffff838b2fda>] _raw_read_unlock+0x1a/0x50 kernel/locking/spinlock.c:255
 [<ffffffff834e8ee4>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
 [<ffffffff815e9803>] seq_read+0xa83/0x1290 fs/seq_file.c:283
 [<ffffffff816c24ff>] proc_reg_read+0xef/0x170 fs/proc/inode.c:202
 [<ffffffff8156cc21>] do_loop_readv_writev.part.17+0x141/0x1e0 fs/read_write.c:714
 [<ffffffff81570a90>] do_loop_readv_writev fs/read_write.c:880 [inline]
 [<ffffffff81570a90>] do_readv_writev+0x520/0x750 fs/read_write.c:874
 [<ffffffff81570d44>] vfs_readv+0x84/0xc0 fs/read_write.c:898
 [<ffffffff81570e66>] do_readv+0xe6/0x250 fs/read_write.c:924
 [<ffffffff81574357>] SYSC_readv fs/read_write.c:1011 [inline]
 [<ffffffff81574357>] SyS_readv+0x27/0x30 fs/read_write.c:1008
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
audit: type=1400 audit(1518002955.432:108): avc:  denied  { create } for  pid=13612 comm="syz-executor0" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_scsitransport_socket permissive=1
device syz6 entered promiscuous mode
device syz6 left promiscuous mode
device syz6 entered promiscuous mode
device syz6 left promiscuous mode
audit: type=1400 audit(1518002955.712:109): avc:  denied  { setgid } for  pid=13702 comm="syz-executor2" capability=6  scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 13691 Comm: syz-executor5 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d53175d0 ffffffff81d94b69 ffff8801d53178b0 0000000000000000
 ffff8801b32db910 ffff8801d53177a0 ffff8801b32db800 ffff8801d53177c8
 ffffffff816624ba 1ffff1003aa62ebe ffff8801d5317720 00000001cca69067
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816624ba>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814d0da1>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0da1>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0da1>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0da1>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810de642>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407
 [<ffffffff810dede7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470
 [<ffffffff838b47c8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055
 [<ffffffff815ae71a>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff815ae71a>] do_vfs_ioctl+0x1aa/0x1140 fs/ioctl.c:679
 [<ffffffff815af73f>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff815af73f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 13712 Comm: syz-executor5 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cf43f5d0 ffffffff81d94b69 ffff8801cf43f8b0 0000000000000000
 ffff8801b32db010 ffff8801cf43f7a0 ffff8801b32daf00 ffff8801cf43f7c8
 ffffffff816624ba 0000000041b58ab3 ffff8801cf43f720 00000001d36ae067
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816624ba>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814d0da1>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0da1>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0da1>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0da1>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810de642>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407
 [<ffffffff810dede7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470
 [<ffffffff838b47c8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055
 [<ffffffff815ae71a>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff815ae71a>] do_vfs_ioctl+0x1aa/0x1140 fs/ioctl.c:679
 [<ffffffff815af73f>] SYSC_ioctl fs/ioctl.c:694 [inline]
 [<ffffffff815af73f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 13686 Comm: syz-executor6 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d056f4e0 ffffffff81d94b69 ffff8801d056f7c0 0000000000000000
 ffff8801b32da290 ffff8801d056f6b0 ffff8801b32da180 ffff8801d056f6d8
 ffffffff816624ba 00000000fe2006e4 ffff8801d056f630 00000001ccaa9067
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816624ba>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814d0da1>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0da1>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0da1>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0da1>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810de642>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407
 [<ffffffff810dede7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470
 [<ffffffff838b47c8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055
 [<ffffffff814342dc>] generic_perform_write+0x1dc/0x500 mm/filemap.c:2731
 [<ffffffff8143beb8>] __generic_file_write_iter+0x348/0x570 mm/filemap.c:2866
 [<ffffffff8143c3b5>] generic_file_write_iter+0x2d5/0x600 mm/filemap.c:2894
 [<ffffffff8156e89f>] new_sync_write fs/read_write.c:499 [inline]
 [<ffffffff8156e89f>] __vfs_write+0x4bf/0x680 fs/read_write.c:512
 [<ffffffff815701c9>] vfs_write+0x189/0x530 fs/read_write.c:560
 [<ffffffff81573cb9>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff81573cb9>] SyS_write+0xd9/0x1b0 fs/read_write.c:599
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
binder: 13771:13772 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
binder: 13771:13772 got transaction to invalid handle
binder: 13771:13772 transaction failed 29201/-22, size 0-0 line 3004
binder: undelivered TRANSACTION_ERROR: 29201
TCP: request_sock_TCPv6: Possible SYN flooding on port 20006. Sending cookies.  Check SNMP counters.
audit: type=1400 audit(1518002956.982:110): avc:  denied  { attach_queue } for  pid=13884 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=tun_socket permissive=1