===================================== [ BUG: bad unlock balance detected! ] 4.4.113-g202e079 #1 Not tainted ------------------------------------- syz-executor7/5989 is trying to release lock (mrt_lock) at: [] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553 but there are no more locks to release! other info that might help us debug this: 1 lock held by syz-executor7/5989: #0: (&p->lock){+.+.+.}, at: [] seq_read+0xdd/0x1270 fs/seq_file.c:178 stack backtrace: CPU: 1 PID: 5989 Comm: syz-executor7 Not tainted 4.4.113-g202e079 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 87da968f1deef4b7 ffff8800b44ff930 ffffffff81d0278d ffffffff84771c18 ffff8800b468df00 ffffffff833c5524 ffffffff84771c18 ffff8800b468e748 ffff8800b44ff960 ffffffff81232314 dffffc0000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_unlock_imbalance_bug+0x174/0x1a0 kernel/locking/lockdep.c:3266 [] __lock_release kernel/locking/lockdep.c:3408 [inline] [] lock_release+0x72a/0xc10 kernel/locking/lockdep.c:3611 [] __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline] [] _raw_read_unlock+0x1a/0x50 kernel/locking/spinlock.c:255 [] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553 [] seq_read+0xa80/0x1270 fs/seq_file.c:283 [] proc_reg_read+0xef/0x170 fs/proc/inode.c:202 [] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:680 [] do_readv_writev+0x5dd/0x6e0 fs/read_write.c:810 [] vfs_readv+0x78/0xb0 fs/read_write.c:834 [] SYSC_preadv fs/read_write.c:912 [inline] [] SyS_preadv+0x199/0x230 fs/read_write.c:898 [] entry_SYSCALL_64_fastpath+0x1c/0x98 netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. capability: warning: `syz-executor2' uses 32-bit capabilities (legacy support in use) netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. binder: 6504:6514 got transaction with invalid offsets ptr binder: 6504:6514 transaction failed 29201/-14, size 0-16 line 3156 binder: BINDER_SET_CONTEXT_MGR already set binder: 6504:6535 ioctl 40046207 0 returned -16 binder_alloc: 6504: binder_alloc_buf, no vma binder: 6504:6535 transaction failed 29189/-3, size 0-16 line 3128 binder: undelivered TRANSACTION_ERROR: 29189 binder: undelivered TRANSACTION_ERROR: 29201 audit: type=1400 audit(1517193235.272:22): avc: denied { accept } for pid=7508 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 keychord: unsupported version 65420 keychord: unsupported version 65420 SELinux: unrecognized netlink message: protocol=4 nlmsg_type=28 sclass=netlink_tcpdiag_socket SELinux: unrecognized netlink message: protocol=4 nlmsg_type=28 sclass=netlink_tcpdiag_socket nla_parse: 54 callbacks suppressed netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. audit: type=1400 audit(1517193237.092:23): avc: denied { ioctl } for pid=8169 comm="syz-executor4" path="socket:[14301]" dev="sockfs" ino=14301 ioctlcmd=891a scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 11 bytes leftover after parsing attributes in process `syz-executor7'. IPVS: Creating netns size=2552 id=9 IPVS: Creating netns size=2552 id=10 keychord: unsupported version 65420 keychord: unsupported version 65420 keychord: unsupported version 65420 keychord: unsupported version 65420 keychord: unsupported version 65420 keychord: unsupported version 65420 keychord: Insufficient bytes present for keycount 10