=====================================
[ BUG: bad unlock balance detected! ]
4.9.75-g5f5e5d4 #7 Not tainted
-------------------------------------
syz-executor7/30063 is trying to release lock (mrt_lock) at:
[<ffffffff834e6574>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
but there are no more locks to release!

other info that might help us debug this:
2 locks held by syz-executor7/30063:
 #0:  (&f->f_pos_lock[  148.646134] FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 30078 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cf17f8f0
 ffffffff81d93049 ffff8801cf17fbd0 0000000000000000 ffff8801c04ed910
 ffff8801cf17fac0 ffff8801c04ed800 ffff8801cf17fae8 ffffffff81660b1a
 0000000000000000 ffff8801cf17fa40 00000001d518f067Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 30067 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801bffe7930
 ffffffff81d93049 ffff8801bffe7c10 0000000000000000 ffff8801c04ed910
 ffff8801bffe7b00 ffff8801c04ed800 ffff8801bffe7b28 ffffffff81660b1a
 0000000000000001 ffff8801bffe7a80 00000001d518f067Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
){+.+.+.}, at: [<ffffffff815d20bf>] __fdget_pos+0x9f/0xc0 fs/file.c:781
 #1:  (&p->lock){+.+.+.}, at: [<ffffffff815e74bd>] seq_read+0xdd/0x1290 fs/seq_file.c:178

stack backtrace:
CPU: 1 PID: 30063 Comm: syz-executor7 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c8cf79f0 ffffffff81d93049 ffffffff849b67b8 ffff8801d1803000
 ffffffff834e6574 ffffffff849b67b8 ffff8801d1803888 ffff8801c8cf7a20
 ffffffff81236bf4 dffffc0000000000 ffffffff849b67b8 00000000ffffffff
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81236bf4>] print_unlock_imbalance_bug+0x174/0x1a0 kernel/locking/lockdep.c:3398
 [<ffffffff8123f6c8>] __lock_release kernel/locking/lockdep.c:3540 [inline]
 [<ffffffff8123f6c8>] lock_release+0x6f8/0xb80 kernel/locking/lockdep.c:3775
 [<ffffffff838b05fa>] __raw_read_unlock include/linux/rwlock_api_smp.h:225 [inline]
 [<ffffffff838b05fa>] _raw_read_unlock+0x1a/0x50 kernel/locking/spinlock.c:255
 [<ffffffff834e6574>] ipmr_mfc_seq_stop+0xe4/0x140 net/ipv6/ip6mr.c:553
 [<ffffffff815e7e63>] seq_read+0xa83/0x1290 fs/seq_file.c:283
 [<ffffffff816c0b5f>] proc_reg_read+0xef/0x170 fs/proc/inode.c:202
 [<ffffffff8156a8a3>] __vfs_read+0x103/0x670 fs/read_write.c:452
 [<ffffffff8156e63e>] vfs_read+0x11e/0x380 fs/read_write.c:475
 [<ffffffff81572369>] SYSC_read fs/read_write.c:591 [inline]
 [<ffffffff81572369>] SyS_read+0xd9/0x1b0 fs/read_write.c:584
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
FAULT_FLAG_ALLOW_RETRY missing 30
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 30120 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d5bff8f0 ffffffff81d93049 ffff8801d5bffbd0 0000000000000000
 ffff8801c0d25010 ffff8801d5bffac0 ffff8801c0d24f00 ffff8801d5bffae8
 ffffffff81660b1a 0000000000000000 ffff8801d5bffa40 00000001d19ca067
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
CPU: 1 PID: 30092 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ccbff930 ffffffff81d93049 ffff8801ccbffc10 0000000000000000
 ffff8801c0d25010 ffff8801ccbffb00 ffff8801c0d24f00 ffff8801ccbffb28
 ffffffff81660b1a 0000000000000001 ffff8801ccbffa80 00000001d19ca067
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 30169 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801bf6a78f0 ffffffff81d93049 ffff8801bf6a7bd0 0000000000000000
 ffff8801c0d25310 ffff8801bf6a7ac0 ffff8801c0d25200 ffff8801bf6a7ae8
 ffffffff81660b1a 0000000000000000 ffff8801bf6a7a40 00000001cf6d0067
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 30151 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ccb27930 ffffffff81d93049 ffff8801ccb27c10 0000000000000000
 ffff8801c0d25310 ffff8801ccb27b00 ffff8801c0d25200 ffff8801ccb27b28
 ffffffff81660b1a ffff8801c8d21800 0000000000000000 0000000000000000
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
FAULT_FLAG_ALLOW_RETRY missing 30
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 30226 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d5bff8f0 ffffffff81d93049 ffff8801d5bffbd0 0000000000000000
 ffff8801c04eda90 ffff8801d5bffac0 ffff8801c04ed980 ffff8801d5bffae8
 ffffffff81660b1a 0000000000000000 ffff8801d5bffa40 00000001cd56f067
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
CPU: 0 PID: 30204 Comm: syz-executor6 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cb757930 ffffffff81d93049 ffff8801cb757c10 0000000000000000
 ffff8801c04eda90 ffff8801cb757b00 ffff8801c04ed980 ffff8801cb757b28
 ffffffff81660b1a 0000000000000001 ffff8801cb757a80 00000001cd56f067
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 1 PID: 31697 Comm: syz-executor1 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c24ef8b0 ffffffff81d93049 ffff8801c24efb90 0000000000000000
 ffff8801c0d24290 ffff8801c24efa80 ffff8801c0d24180 ffff8801c24efaa8
 ffffffff81660b1a ffff8801cb711800 ffff8801c24efa00 00000001cacfd067
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff81bae6c4>] SyS_mq_getsetattr+0x24/0x30 ipc/mqueue.c:1321
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
FAULT_FLAG_ALLOW_RETRY missing 30
CPU: 0 PID: 31697 Comm: syz-executor1 Not tainted 4.9.75-g5f5e5d4 #7
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801c24ef8b0 ffffffff81d93049 ffff8801c24efb90 0000000000000000
 ffff8801c0d25610 ffff8801c24efa80 ffff8801c0d25500 ffff8801c24efaa8
 ffffffff81660b1a ffffffff8389fa03 ffff8801c24efa00 00000001b40cc067
Call Trace:
 [<ffffffff81d93049>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d93049>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81660b1a>] handle_userfault+0xa3a/0x1310 fs/userfaultfd.c:323
 [<ffffffff814cf771>] do_anonymous_page mm/memory.c:2747 [inline]
 [<ffffffff814cf771>] handle_pte_fault mm/memory.c:3488 [inline]
 [<ffffffff814cf771>] __handle_mm_fault mm/memory.c:3577 [inline]
 [<ffffffff814cf771>] handle_mm_fault+0x1fd1/0x2530 mm/memory.c:3614
 [<ffffffff810dd632>] __do_page_fault+0x5c2/0xd40 arch/x86/mm/fault.c:1406
 [<ffffffff810dddd7>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1469
 [<ffffffff838b1dc8>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1038
 [<ffffffff81bae6c4>] SyS_mq_getsetattr+0x24/0x30 ipc/mqueue.c:1321
 [<ffffffff838b0aa8>] entry_SYSCALL_64_fastpath+0x23/0xe2
device lo entered promiscuous mode
IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
IPVS: Creating netns size=2536 id=27
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
IPVS: Creating netns size=2536 id=28
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
IPVS: Creating netns size=2536 id=29
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
IPVS: Creating netns size=2536 id=30
pktgen: kernel_thread() failed for cpu 0
pktgen: Cannot create thread for cpu 0 (-4)
pktgen: kernel_thread() failed for cpu 1
pktgen: Cannot create thread for cpu 1 (-4)
pktgen: Initialization failed for all threads
IPVS: Creating netns size=2536 id=31