=====================================
[ BUG: bad unlock balance detected! ]
4.9.80-g550c01d #29 Not tainted
-------------------------------------
syz-executor0/5894 is trying to release lock (mrt_lock) at:
[<ffffffff834e8ee4>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
but there are no more locks to release!

other info that might help us debug this:
2 locks held by syz-executor0/5894:
 #0:  (&f->f_pos_lock){+.+.+.}, at: [<ffffffff815d3a5f>] __fdget_pos+0x9f/0xc0 fs/file.c:781
 #1: [   38.511639] FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 5907 Comm: syz-executor7 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c72af8a0
 ffffffff81d94b69 ffff8801c72afb80 0000000000000000 ffff8801b66f0710
 ffff8801c72afa70 ffff8801b66f0600 ffff8801c72afa98 ffffffff816624ba
 0000000000000000 ffff8801c72af9f0 00000001d9298067Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816624ba>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814d0da1>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0da1>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0da1>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0da1>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810de642>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407
 [<ffffffff810dede7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470
 [<ffffffff838b47c8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 5923 Comm: syz-executor7 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d6d078a0
 ffffffff81d94b69 ffff8801d6d07b80 0000000000000000 ffff8801b66f0890
 ffff8801d6d07a70 ffff8801b66f0780 ffff8801d6d07a98 ffffffff816624ba
 ffff8801d6ca9800 ffff8801d6d079f0 00000001d7afc067Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816624ba>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814d0da1>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0da1>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0da1>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0da1>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810de642>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407
 [<ffffffff810dede7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470
 [<ffffffff838b47c8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
 (&p->lock){+.+.+.}, at: [<ffffffff815e8e5d>] seq_read+0xdd/0x1290 fs/seq_file.c:178
stack backtrace:
CPU: 0 PID: 5894 Comm: syz-executor0 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c731f8e8 ffffffff81d94b69 ffffffff849b6cf8 ffff8801d6dec800
 ffffffff834e8ee4 ffffffff849b6cf8 ffff8801d6ded088 ffff8801c731f918
 ffffffff81237e04 dffffc0000000000 ffffffff849b6cf8 00000000ffffffff
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81237e04>] print_unlock_imbalance_bug+0x174/0x1a0 kernel/locking/lockdep.c:3398
 [<ffffffff812408d8>] __lock_release kernel/locking/lockdep.c:3540 [inline]
 [<ffffffff812408d8>] lock_release+0x6f8/0xb80 kernel/locking/lockdep.c:3775
 [<ffffffff838b2fda>] __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline]
 [<ffffffff838b2fda>] _raw_read_unlock+0x1a/0x50 kernel/locking/spinlock.c:255
 [<ffffffff834e8ee4>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
 [<ffffffff815e9803>] seq_read+0xa83/0x1290 fs/seq_file.c:283
 [<ffffffff816c24ff>] proc_reg_read+0xef/0x170 fs/proc/inode.c:202
 [<ffffffff8156cc21>] do_loop_readv_writev.part.17+0x141/0x1e0 fs/read_write.c:714
 [<ffffffff81570a90>] do_loop_readv_writev fs/read_write.c:880 [inline]
 [<ffffffff81570a90>] do_readv_writev+0x520/0x750 fs/read_write.c:874
 [<ffffffff81570d44>] vfs_readv+0x84/0xc0 fs/read_write.c:898
 [<ffffffff81570e66>] do_readv+0xe6/0x250 fs/read_write.c:924
 [<ffffffff81574357>] SYSC_readv fs/read_write.c:1011 [inline]
 [<ffffffff81574357>] SyS_readv+0x27/0x30 fs/read_write.c:1008
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
keychord: Insufficient bytes present for keycount 0
keychord: Insufficient bytes present for keycount 0
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51749 sclass=netlink_route_socket pig=6024 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=51749 sclass=netlink_route_socket pig=6027 comm=syz-executor6
binder: send failed reply for transaction 7 to 6025:6034
binder: BINDER_SET_CONTEXT_MGR already set
binder: 6025:6026 ioctl 40046207 0 returned -16
binder_alloc: 6025: binder_alloc_buf, no vma
binder: 6025:6026 transaction failed 29189/-3, size 0-0 line 3127
binder: undelivered TRANSACTION_ERROR: 29189
binder: undelivered TRANSACTION_COMPLETE
binder: undelivered TRANSACTION_ERROR: 29189
audit: type=1400 audit(1517965873.352:26): avc:  denied  { validate_trans } for  pid=6097 comm="syz-executor2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:security_t:s0 tclass=security permissive=1
binder: 6131:6139 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
binder: 6131:6139 got transaction to invalid handle
binder: 6131:6139 transaction failed 29201/-22, size 0-0 line 3004
binder: 6131:6157 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
binder: 6131:6157 got transaction to invalid handle
binder: 6131:6157 transaction failed 29201/-22, size 0-0 line 3004
binder: undelivered TRANSACTION_ERROR: 29201
binder: undelivered TRANSACTION_ERROR: 29201
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 6161 Comm: syz-executor6 Not tainted 4.9.80-g550c01d #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d506f4e0 ffffffff81d94b69 ffff8801d506f7c0 0000000000000000
 ffff8801c9d6d010 ffff8801d506f6b0 ffff8801c9d6cf00 ffff8801d506f6d8
 ffffffff816624ba 00000000fe2006e4 ffff8801d506f630 00000001bd347067
Call Trace:
 [<ffffffff81d94b69>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d94b69>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff816624ba>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814d0da1>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814d0da1>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814d0da1>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814d0da1>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810de642>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1407
 [<ffffffff810dede7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1470
 [<ffffffff838b47c8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1055
 [<ffffffff814342dc>] generic_perform_write+0x1dc/0x500 mm/filemap.c:2731
 [<ffffffff8143beb8>] __generic_file_write_iter+0x348/0x570 mm/filemap.c:2866
 [<ffffffff8143c3b5>] generic_file_write_iter+0x2d5/0x600 mm/filemap.c:2894
 [<ffffffff8156e89f>] new_sync_write fs/read_write.c:499 [inline]
 [<ffffffff8156e89f>] __vfs_write+0x4bf/0x680 fs/read_write.c:512
 [<ffffffff815701c9>] vfs_write+0x189/0x530 fs/read_write.c:560
 [<ffffffff81573cb9>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff81573cb9>] SyS_write+0xd9/0x1b0 fs/read_write.c:599
 [<ffffffff838b346e>] entry_SYSCALL_64_fastpath+0x29/0xe8
binder: 6251:6256 DecRefs 0 refcount change on invalid ref 3 ret -22
binder: 6251:6256 got reply transaction with no transaction stack
binder: 6251:6256 transaction failed 29201/-71, size 0-40 line 2920
binder: 6251:6276 DecRefs 0 refcount change on invalid ref 3 ret -22
binder: 6251:6276 got reply transaction with no transaction stack
binder: 6251:6276 transaction failed 29201/-71, size 0-40 line 2920
binder_alloc: binder_alloc_mmap_handler: 6284 2011a000-2051a000 already mapped failed -16
binder: undelivered TRANSACTION_ERROR: 29201
binder: undelivered TRANSACTION_ERROR: 29201
binder: 6314:6324 BC_DEAD_BINDER_DONE 0000000000000003 not found
binder: 6330:6332 ERROR: BC_REGISTER_LOOPER called without request
binder: 6314:6339 tried to acquire reference to desc 0, got 1 instead
binder: 6314:6339 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
binder: 6314:6324 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
binder: 6314:6324 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
binder: undelivered death notification, 0000000000000000
binder: undelivered TRANSACTION_COMPLETE
binder: undelivered transaction 19, process died.
binder: undelivered TRANSACTION_COMPLETE
binder: 6330:6352 ERROR: BC_REGISTER_LOOPER called without request
binder: 6330:6343 got reply transaction with bad transaction stack, transaction 21 has target 6330:0
binder: 6330:6343 transaction failed 29201/-71, size 24-0 line 2935
binder: release 6330:6343 transaction 21 out, still active
binder: undelivered TRANSACTION_COMPLETE
binder: undelivered TRANSACTION_ERROR: 29201
binder: send failed reply for transaction 21, target dead
TCP: request_sock_TCP: Possible SYN flooding on port 20026. Sending cookies.  Check SNMP counters.
IPVS: Creating netns size=2536 id=9
device eql entered promiscuous mode
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
audit_printk_skb: 5 callbacks suppressed
audit: type=1400 audit(1517965876.452:28): avc:  denied  { write } for  pid=6645 comm="syz-executor7" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1