| TITLE: WARNING: bad unlock balance in ipmr_mfc_seq_stop |
| |
| [ 123.238569] ===================================== |
| [ 123.243391] WARNING: bad unlock balance detected! |
| [ 123.248225] 4.15.0-rc6+ #160 Not tainted |
| [ 123.252273] ------------------------------------- |
| [ 123.253273] binder: BINDER_SET_CONTEXT_MGR already set |
| [ 123.253280] binder: 19039:19065 ioctl 40046207 0 returned -16 |
| [ 123.254503] binder: 19049 RLIMIT_NICE not set |
| [ 123.254548] binder_alloc: 19039: binder_alloc_buf, no vma |
| [ 123.254567] binder: 19039:19065 transaction failed 29189/-3, size 0-0 line 2903 |
| [ 123.277377] binder: undelivered TRANSACTION_ERROR: 29189 |
| [ 123.277534] binder: release 19039:19049 transaction 74 in, still active |
| [ 123.277539] binder: send failed reply for transaction 74 to 19039:19065 |
| [ 123.277551] binder: undelivered TRANSACTION_COMPLETE |
| [ 123.277557] binder: undelivered TRANSACTION_ERROR: 29189 |
| [ 123.315003] syz-executor4/19072 is trying to release lock (mrt_lock) at: |
| [ 123.321838] [<00000000c4ef30ff>] ipmr_mfc_seq_stop+0xe1/0x130 |
| [ 123.327688] but there are no more locks to release! |
| [ 123.332667] |
| [ 123.332667] other info that might help us debug this: |
| [ 123.339299] 2 locks held by syz-executor4/19072: |
| [ 123.344020] #0: (sb_writers#7){.+.+}, at: [<0000000015352bfd>] do_sendfile+0xada/0xe80 |
| [ 123.352230] #1: (&p->lock){+.+.}, at: [<0000000070ba5816>] seq_read+0xd5/0x13d0 |
| [ 123.359836] |
| [ 123.359836] stack backtrace: |
| [ 123.364303] CPU: 1 PID: 19072 Comm: syz-executor4 Not tainted 4.15.0-rc6+ #160 |
| [ 123.371627] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 123.380959] Call Trace: |
| [ 123.383521] dump_stack+0x194/0x257 |
| [ 123.387118] ? arch_local_irq_restore+0x53/0x53 |
| [ 123.391765] ? ipmr_mfc_seq_stop+0xe1/0x130 |
| [ 123.396068] print_unlock_imbalance_bug+0x12f/0x140 |
| [ 123.401052] lock_release+0x6fe/0xa40 |
| [ 123.404821] ? ipmr_mfc_seq_stop+0xe1/0x130 |
| [ 123.409112] ? lock_downgrade+0x980/0x980 |
| [ 123.413232] ? ipmr_mfc_seq_start+0x22f/0x3d0 |
| [ 123.417697] ? memcpy+0x45/0x50 |
| [ 123.420945] ? seq_puts+0xb5/0x130 |
| [ 123.424455] _raw_read_unlock+0x1a/0x30 |
| [ 123.428399] ipmr_mfc_seq_stop+0xe1/0x130 |
| [ 123.432516] seq_read+0xc42/0x13d0 |
| [ 123.436031] ? seq_lseek+0x3c0/0x3c0 |
| [ 123.439716] ? fsnotify_first_mark+0x2b0/0x2b0 |
| [ 123.444269] ? avc_policy_seqno+0x9/0x20 |
| [ 123.448302] ? selinux_file_permission+0x82/0x460 |
| [ 123.453113] ? seq_lseek+0x3c0/0x3c0 |
| [ 123.456810] proc_reg_read+0xef/0x170 |
| [ 123.460580] do_iter_read+0x3d2/0x5a0 |
| [ 123.464351] ? dup_iter+0x260/0x260 |
| [ 123.467951] vfs_readv+0x121/0x1c0 |
| [ 123.471463] ? compat_rw_copy_check_uvector+0x2e0/0x2e0 |
| [ 123.476795] ? is_bpf_text_address+0x7b/0x120 |
| [ 123.481261] ? lock_downgrade+0x980/0x980 |
| [ 123.485379] ? __free_insn_slot+0x5c0/0x5c0 |
| [ 123.489672] ? rcutorture_record_progress+0x10/0x10 |
| [ 123.494660] ? is_bpf_text_address+0xa4/0x120 |
| [ 123.499125] ? kernel_text_address+0x102/0x140 |
| [ 123.503677] default_file_splice_read+0x508/0xae0 |
| [ 123.508507] ? default_file_splice_read+0x508/0xae0 |
| [ 123.513494] ? __save_stack_trace+0x7e/0xd0 |
| [ 123.517787] ? do_splice_direct+0x3c0/0x3c0 |
| [ 123.522079] ? print_irqtrace_events+0x270/0x270 |
| [ 123.526802] ? save_stack+0xa3/0xd0 |
| [ 123.530398] ? save_stack+0x43/0xd0 |
| [ 123.533995] ? kasan_kmalloc+0xad/0xe0 |
| [ 123.537852] ? __kmalloc+0x162/0x760 |
| [ 123.541539] ? splice_direct_to_actor+0x64a/0x820 |
| [ 123.546349] ? do_splice_direct+0x29b/0x3c0 |
| [ 123.550640] ? do_sendfile+0x5c9/0xe80 |
| [ 123.554498] ? compat_SyS_sendfile+0xea/0x1a0 |
| [ 123.558962] ? do_fast_syscall_32+0x3ee/0xf9d |
| [ 123.563437] ? print_irqtrace_events+0x270/0x270 |
| [ 123.568161] ? __lock_is_held+0xb6/0x140 |
| [ 123.572194] ? __lockdep_init_map+0xe4/0x650 |
| [ 123.576570] ? fsnotify+0x7b3/0x1140 |
| [ 123.580255] ? fsnotify_first_mark+0x2b0/0x2b0 |
| [ 123.584808] ? avc_policy_seqno+0x9/0x20 |
| [ 123.588837] ? selinux_file_permission+0x82/0x460 |
| [ 123.593648] ? security_file_permission+0x89/0x1e0 |
| [ 123.598548] ? do_splice_direct+0x3c0/0x3c0 |
| [ 123.602838] do_splice_to+0x10a/0x160 |
| [ 123.606605] ? do_splice_to+0x10a/0x160 |
| [ 123.610550] splice_direct_to_actor+0x242/0x820 |
| [ 123.615199] ? _cond_resched+0x14/0x30 |
| [ 123.619067] ? generic_pipe_buf_nosteal+0x10/0x10 |
| [ 123.623881] ? do_splice_to+0x160/0x160 |
| [ 123.627826] ? security_file_permission+0x89/0x1e0 |
| [ 123.632743] ? rw_verify_area+0xe5/0x2b0 |
| [ 123.636796] do_splice_direct+0x29b/0x3c0 |
| [ 123.640914] ? splice_direct_to_actor+0x820/0x820 |
| [ 123.645727] ? rcu_sync_lockdep_assert+0x6d/0xb0 |
| [ 123.650451] ? __sb_start_write+0x209/0x2a0 |
| [ 123.654744] do_sendfile+0x5c9/0xe80 |
| [ 123.658431] ? do_compat_pwritev64+0x100/0x100 |
| [ 123.662992] ? __fdget_raw+0x20/0x20 |
| [ 123.666680] ? __might_sleep+0x95/0x190 |
| [ 123.670632] compat_SyS_sendfile+0xea/0x1a0 |
| [ 123.674924] ? SyS_sendfile64+0x160/0x160 |
| [ 123.679044] ? do_fast_syscall_32+0x156/0xf9d |
| [ 123.683509] ? SyS_sendfile64+0x160/0x160 |
| [ 123.687625] do_fast_syscall_32+0x3ee/0xf9d |
| [ 123.691917] ? do_int80_syscall_32+0x9d0/0x9d0 |
| [ 123.696488] ? syscall_return_slowpath+0x2ad/0x550 |
| [ 123.701386] ? prepare_exit_to_usermode+0x340/0x340 |
| [ 123.706373] ? sysret32_from_system_call+0x5/0x3b |
| [ 123.711188] ? trace_hardirqs_off_thunk+0x1a/0x1c |
| [ 123.716008] entry_SYSENTER_compat+0x54/0x63 |
| [ 123.720385] RIP: 0023:0xf7facc79 |
| [ 123.723728] RSP: 002b:00000000f77a808c EFLAGS: 00000296 ORIG_RAX: 00000000000000bb |
| [ 123.731405] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 0000000000000013 |
| [ 123.738646] RDX: 0000000020292000 RSI: 0000000000000008 RDI: 0000000000000000 |
| [ 123.745884] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 |
| [ 123.753123] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 |
| [ 123.760361] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 |
