IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready ===================================== WARNING: bad unlock balance detected! 4.20.0-rc2+ #338 Not tainted ------------------------------------- kworker/u4:4/2482 is trying to release lock (&file->mut) at: [] ucma_event_handler+0x788/0x1000 drivers/infiniband/core/ucma.c:394 but there are no more locks to release! other info that might help us debug this: 4 locks held by kworker/u4:4/2482: #0: 00000000b05964d1 ((wq_completion)"ib_addr"){+.+.}, at: __write_once_size include/linux/compiler.h:209 [inline] #0: 00000000b05964d1 ((wq_completion)"ib_addr"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: 00000000b05964d1 ((wq_completion)"ib_addr"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline] #0: 00000000b05964d1 ((wq_completion)"ib_addr"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline] #0: 00000000b05964d1 ((wq_completion)"ib_addr"){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline] #0: 00000000b05964d1 ((wq_completion)"ib_addr"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline] #0: 00000000b05964d1 ((wq_completion)"ib_addr"){+.+.}, at: process_one_work+0xb43/0x1c40 kernel/workqueue.c:2124 #1: 0000000071a3d1a2 ((work_completion)(&(&req->work)->work)){+.+.}, at: process_one_work+0xb9a/0x1c40 kernel/workqueue.c:2128 #2: 00000000fe4db82e (&id_priv->handler_mutex){+.+.}, at: addr_handler+0xed/0x420 drivers/infiniband/core/cma.c:2967 #3: 00000000d62db382 (&file->mut){+.+.}, at: ucma_event_handler+0x116/0x1000 drivers/infiniband/core/ucma.c:354 stack backtrace: CPU: 0 PID: 2482 Comm: kworker/u4:4 Not tainted 4.20.0-rc2+ #338 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: ib_addr process_one_req Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_unlock_imbalance_bug.cold.48+0xcc/0xd8 kernel/locking/lockdep.c:3394 __lock_release kernel/locking/lockdep.c:3604 [inline] lock_release+0x720/0xa00 kernel/locking/lockdep.c:3863 __mutex_unlock_slowpath+0x102/0x8c0 kernel/locking/mutex.c:1197 mutex_unlock+0xd/0x10 kernel/locking/mutex.c:713 ucma_event_handler+0x788/0x1000 drivers/infiniband/core/ucma.c:394 addr_handler+0x305/0x420 drivers/infiniband/core/cma.c:2991 process_one_req+0x1a9/0x920 drivers/infiniband/core/addr.c:643 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 kobject: 'ppp0' (000000006c4596f7): kobject_add_internal: parent: 'net', set: 'devices' kobject: 'loop3' (000000003ffe335f): kobject_uevent_env kobject: 'loop3' (000000003ffe335f): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'kvm' (00000000b2d2acb4): kobject_uevent_env kobject: 'kvm' (00000000b2d2acb4): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'kvm' (00000000b2d2acb4): kobject_uevent_env kobject: 'ppp0' (000000006c4596f7): kobject_uevent_env kobject: 'kvm' (00000000b2d2acb4): fill_kobj_path: path = '/devices/virtual/misc/kvm' kobject: 'ppp0' (000000006c4596f7): fill_kobj_path: path = '/devices/virtual/net/ppp0' kobject: 'loop4' (00000000e41ea6d3): kobject_uevent_env kobject: 'queues' (0000000084649b73): kobject_add_internal: parent: 'ppp0', set: '' kobject: 'loop4' (00000000e41ea6d3): fill_kobj_path: path = '/devices/virtual/block/loop4' kvm: emulating exchange as write kobject: 'queues' (0000000084649b73): kobject_uevent_env kobject: 'queues' (0000000084649b73): kobject_uevent_env: filter function caused the event to drop! kobject: 'rx-0' (0000000097542715): kobject_add_internal: parent: 'queues', set: 'queues' kobject: 'rx-0' (0000000097542715): kobject_uevent_env kobject: 'rx-0' (0000000097542715): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/rx-0' kobject: 'tx-0' (00000000199e9b4a): kobject_add_internal: parent: 'queues', set: 'queues' kobject: 'tx-0' (00000000199e9b4a): kobject_uevent_env kobject: 'tx-0' (00000000199e9b4a): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/tx-0' kobject: 'kvm' (00000000b2d2acb4): kobject_uevent_env kobject: 'kvm' (00000000b2d2acb4): fill_kobj_path: path = '/devices/virtual/misc/kvm' netlink: 'syz-executor3': attribute type 17 has an invalid length. kobject: 'kvm' (00000000b2d2acb4): kobject_uevent_env kobject: 'kvm' (00000000b2d2acb4): fill_kobj_path: path = '/devices/virtual/misc/kvm' IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready kobject: 'ppp0' (000000007954c3eb): kobject_add_internal: parent: 'net', set: 'devices' kobject: 'loop1' (000000000cc0323d): kobject_uevent_env kobject: 'ppp0' (000000007954c3eb): kobject_uevent_env kobject: 'loop1' (000000000cc0323d): fill_kobj_path: path = '/devices/virtual/block/loop1' kobject: 'ppp0' (000000007954c3eb): fill_kobj_path: path = '/devices/virtual/net/ppp0' kobject: 'queues' (00000000a61aeb1d): kobject_add_internal: parent: 'ppp0', set: '' kobject: 'loop3' (000000003ffe335f): kobject_uevent_env kobject: 'queues' (00000000a61aeb1d): kobject_uevent_env kobject: 'loop3' (000000003ffe335f): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'queues' (00000000a61aeb1d): kobject_uevent_env: filter function caused the event to drop! kobject: 'rx-0' (0000000096426698): kobject_add_internal: parent: 'queues', set: 'queues' kobject: 'rx-0' (0000000096426698): kobject_uevent_env kobject: 'rx-0' (0000000096426698): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/rx-0' kobject: 'tx-0' (000000002d4573c5): kobject_add_internal: parent: 'queues', set: 'queues' kobject: 'tx-0' (000000002d4573c5): kobject_uevent_env kobject: 'tx-0' (000000002d4573c5): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/tx-0' kobject: 'rx-0' (0000000096426698): kobject_cleanup, parent 00000000a61aeb1d kobject: 'rx-0' (0000000096426698): auto cleanup 'remove' event kobject: 'rx-0' (0000000096426698): kobject_uevent_env kobject: 'rx-0' (0000000096426698): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/rx-0' kobject: 'rx-0' (0000000096426698): auto cleanup kobject_del kobject: 'rx-0' (0000000096426698): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (000000002d4573c5): kobject_cleanup, parent 00000000a61aeb1d kobject: 'tx-0' (000000002d4573c5): auto cleanup 'remove' event kobject: 'tx-0' (000000002d4573c5): kobject_uevent_env kobject: 'tx-0' (000000002d4573c5): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/tx-0' kobject: 'tx-0' (000000002d4573c5): auto cleanup kobject_del kobject: 'tx-0' (000000002d4573c5): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (00000000a61aeb1d): kobject_cleanup, parent (null) kobject: 'queues' (00000000a61aeb1d): calling ktype release kobject: 'queues' (00000000a61aeb1d): kset_release kobject: 'queues': free name kobject: 'ppp0' (000000007954c3eb): kobject_uevent_env kobject: 'ppp0' (000000007954c3eb): fill_kobj_path: path = '/devices/virtual/net/ppp0' kobject: 'rx-0' (0000000097542715): kobject_cleanup, parent 0000000084649b73 kobject: 'rx-0' (0000000097542715): auto cleanup 'remove' event kobject: 'rx-0' (0000000097542715): kobject_uevent_env kobject: 'rx-0' (0000000097542715): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/rx-0' kobject: 'rx-0' (0000000097542715): auto cleanup kobject_del kobject: 'rx-0' (0000000097542715): calling ktype release kobject: 'rx-0': free name kobject: 'tx-0' (00000000199e9b4a): kobject_cleanup, parent 0000000084649b73 kobject: 'tx-0' (00000000199e9b4a): auto cleanup 'remove' event kobject: 'tx-0' (00000000199e9b4a): kobject_uevent_env kobject: 'tx-0' (00000000199e9b4a): fill_kobj_path: path = '/devices/virtual/net/ppp0/queues/tx-0' kobject: 'tx-0' (00000000199e9b4a): auto cleanup kobject_del kobject: 'tx-0' (00000000199e9b4a): calling ktype release kobject: 'tx-0': free name kobject: 'queues' (0000000084649b73): kobject_cleanup, parent (null) kobject: 'queues' (0000000084649b73): calling ktype release kobject: 'queues' (0000000084649b73): kset_release kobject: 'queues': free name kobject: 'ppp0' (000000006c4596f7): kobject_uevent_env kobject: 'ppp0' (000000006c4596f7): fill_kobj_path: path = '/devices/virtual/net/ppp0' kobject: 'ppp0' (000000007954c3eb): kobject_cleanup, parent (null) kobject: 'ppp0' (000000007954c3eb): calling ktype release kobject: 'ppp0': free name kobject: 'ppp0' (000000006c4596f7): kobject_cleanup, parent (null) kobject: 'ppp0' (000000006c4596f7): calling ktype release kobject: 'ppp0': free name kobject: 'loop2' (0000000029a5f401): kobject_uevent_env kobject: 'loop2' (0000000029a5f401): fill_kobj_path: path = '/devices/virtual/block/loop2'