=====================================
[ BUG: bad unlock balance detected! ]
4.4.107-g610c835 #4 Not tainted
-------------------------------------
syzkaller711920/3642 is trying to release lock (mrt_lock) at:
[<ffffffff833c77d4>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
but there are no more locks to release!

other info that might help us debug this:
1 lock held by syzkaller711920/3642:
 #0:  (&p->lock){+.+.+.}, at: [<ffffffff8158c38d>] seq_read+0xdd/0x1270 fs/seq_file.c:178

stack backtrace:
CPU: 1 PID: 3642 Comm: syzkaller711920 Not tainted 4.4.107-g610c835 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 87ce8978ebf6b07c ffff8801cf807860 ffffffff81d0457d
 ffffffff8476ab98 ffff8801d0768000 ffffffff833c77d4 ffffffff8476ab98
 ffff8801d0768848 ffff8801cf807890 ffffffff812301a4 dffffc0000000000
Call Trace:
 [<ffffffff81d0457d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0457d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff812301a4>] print_unlock_imbalance_bug+0x174/0x1a0 kernel/locking/lockdep.c:3266
 [<ffffffff8123b04a>] __lock_release kernel/locking/lockdep.c:3408 [inline]
 [<ffffffff8123b04a>] lock_release+0x72a/0xc10 kernel/locking/lockdep.c:3611
 [<ffffffff8377366a>] __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline]
 [<ffffffff8377366a>] _raw_read_unlock+0x1a/0x50 kernel/locking/spinlock.c:255
 [<ffffffff833c77d4>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
 [<ffffffff8158b997>] traverse+0x3a7/0x900 fs/seq_file.c:148
 [<ffffffff8158ca9a>] seq_read+0x7ea/0x1270 fs/seq_file.c:195
 [<ffffffff816651ff>] proc_reg_read+0xef/0x170 fs/proc/inode.c:202
 [<ffffffff8151aa73>] __vfs_read+0x103/0x440 fs/read_write.c:432
 [<ffffffff8151c913>] vfs_read+0x123/0x3a0 fs/read_write.c:454
 [<ffffffff8151f61f>] SYSC_pread64 fs/read_write.c:607 [inline]
 [<ffffffff8151f61f>] SyS_pread64+0x13f/0x170 fs/read_write.c:594
 [<ffffffff811170a9>] sys32_pread+0x39/0x50 arch/x86/ia32/sys_ia32.c:179
 [<ffffffff81006d84>] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline]
 [<ffffffff81006d84>] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457
 [<ffffffff837754d7>] sysenter_flags_fixed+0xd/0x17