IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready ===================================== [ BUG: bad unlock balance detected! ] 4.2.0-rc8+ #1 Not tainted ------------------------------------- syz-executor4/6152 is trying to release lock (&file->mut) at: [] mutex_unlock+0x9/0x10 kernel/locking/mutex.c:437 but there are no more locks to release! other info that might help us debug this: 1 lock held by syz-executor4/6152: #0: (&file->mut){+.+.+.}, at: [] ucma_destroy_id+0xf9/0x1d0 drivers/infiniband/core/ucma.c:589 stack backtrace: CPU: 0 PID: 6152 Comm: syz-executor4 Not tainted 4.2.0-rc8+ #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffffffff8224e0c9 ffff8800b7857c88 ffffffff82244b96 0000000000000011 ffff880213efe7c0 ffff8800b7857cb8 ffffffff811b2c60 0000000000000006 ffff88020f847c60 ffffffff8224e0c9 ffff880213efef38 ffff8800b7857d58 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0x4c/0x65 lib/dump_stack.c:50 [] print_unlock_imbalance_bug+0xe0/0xf0 kernel/locking/lockdep.c:3259 [] __lock_release kernel/locking/lockdep.c:3383 [inline] [] lock_release+0x36c/0x550 kernel/locking/lockdep.c:3604 [] __mutex_unlock_common_slowpath kernel/locking/mutex.c:735 [inline] [] __mutex_unlock_slowpath+0x94/0x1e0 kernel/locking/mutex.c:760 [] mutex_unlock+0x9/0x10 kernel/locking/mutex.c:437 [] ucma_destroy_id+0x10c/0x1d0 drivers/infiniband/core/ucma.c:591 [] ucma_write+0x79/0xb0 drivers/infiniband/core/ucma.c:1591 [] __vfs_write+0x23/0xe0 fs/read_write.c:489 [] vfs_write+0xa1/0x1a0 fs/read_write.c:538 [] SYSC_write fs/read_write.c:585 [inline] [] SyS_write+0x44/0xa0 fs/read_write.c:577 [] entry_SYSCALL_64_fastpath+0x16/0x7a ------------[ cut here ]------------ WARNING: CPU: 0 PID: 6130 at lib/idr.c:505 idr_remove_warning lib/idr.c:505 [inline]() WARNING: CPU: 0 PID: 6130 at lib/idr.c:505 idr_remove+0x154/0x240 lib/idr.c:559() idr_remove called for id=5 which is not allocated.