batman_adv: batadv0: Interface activated: batadv_slave_1 IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready NOHZ: local_softirq_pending 08 ===================================== WARNING: bad unlock balance detected! 4.14.171-syzkaller #0 Not tainted ------------------------------------- syz-executor.5/8324 is trying to release lock (&file->mut) at: [] ucma_destroy_id+0x20d/0x420 drivers/infiniband/core/ucma.c:606 but there are no more locks to release! other info that might help us debug this: 1 lock held by syz-executor.5/8324: #0: (&file->mut){+.+.}, at: [] ucma_destroy_id+0x1aa/0x420 drivers/infiniband/core/ucma.c:604 stack backtrace: CPU: 0 PID: 8324 Comm: syz-executor.5 Not tainted 4.14.171-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 print_unlock_imbalance_bug kernel/locking/lockdep.c:3548 [inline] print_unlock_imbalance_bug.cold+0x114/0x123 kernel/locking/lockdep.c:3525 __lock_release kernel/locking/lockdep.c:3765 [inline] lock_release+0x616/0x940 kernel/locking/lockdep.c:4013 __mutex_unlock_slowpath+0x71/0x800 kernel/locking/mutex.c:1018 mutex_unlock+0xd/0x10 kernel/locking/mutex.c:614 ucma_destroy_id+0x20d/0x420 drivers/infiniband/core/ucma.c:606 ucma_write+0x231/0x310 drivers/infiniband/core/ucma.c:1672 __vfs_write+0x105/0x6b0 fs/read_write.c:480 vfs_write+0x198/0x500 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xfd/0x230 fs/read_write.c:582 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x45c6c9 RSP: 002b:00007f5dd73a8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f5dd73a96d4 RCX: 000000000045c6c9 RDX: 0000000000000018 RSI: 0000000020001380 RDI: 0000000000000003 RBP: 000000000076bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000c8a R14: 00000000004d7910 R15: 000000000076bfd4 ================================================================== BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:183 [inline] BUG: KASAN: use-after-free in atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline] BUG: KASAN: use-after-free in atomic_long_read include/asm-generic/atomic-long.h:45 [inline] BUG: KASAN: use-after-free in __mutex_unlock_slowpath+0x656/0x800 kernel/locking/mutex.c:1027 Read of size 8 at addr ffff8880a06e0180 by task syz-executor.5/8324 CPU: 0 PID: 8324 Comm: syz-executor.5 Not tainted 4.14.171-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x142/0x197 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430 __read_once_size include/linux/compiler.h:183 [inline] atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline] atomic_long_read include/asm-generic/atomic-long.h:45 [inline] __mutex_unlock_slowpath+0x656/0x800 kernel/locking/mutex.c:1027 mutex_unlock+0xd/0x10 kernel/locking/mutex.c:614 ucma_destroy_id+0x20d/0x420 drivers/infiniband/core/ucma.c:606 ucma_write+0x231/0x310 drivers/infiniband/core/ucma.c:1672 __vfs_write+0x105/0x6b0 fs/read_write.c:480 vfs_write+0x198/0x500 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xfd/0x230 fs/read_write.c:582 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292 ? trace_hardirqs_off_th