syzbot

------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 25 at fs/buffer.c:1229 __brelse fs/buffer.c:1229 [inline]
WARNING: CPU: 1 PID: 25 at fs/buffer.c:1229 brelse include/linux/buffer_head.h:324 [inline]
WARNING: CPU: 1 PID: 25 at fs/buffer.c:1229 __invalidate_bh_lrus fs/buffer.c:1498 [inline]
WARNING: CPU: 1 PID: 25 at fs/buffer.c:1229 invalidate_bh_lru+0x102/0x1b0 fs/buffer.c:1511
Modules linked in:
CPU: 1 UID: 0 PID: 25 Comm: kworker/1:0 Not tainted 6.12.0-next-20241122-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events free_ipc
RIP: 0010:__brelse fs/buffer.c:1229 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:324 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1498 [inline]
RIP: 0010:invalidate_bh_lru+0x102/0x1b0 fs/buffer.c:1511
Code: 44 ee da ff f0 ff 0b eb 25 e8 ba fa 6f ff 41 80 3c 2e 00 75 2a eb 30 e8 ac fa 6f ff 90 48 c7 c7 20 e1 18 8c e8 2f 99 30 ff 90 <0f> 0b 90 90 48 bd 00 00 00 00 00 fc ff df 41 80 3c 2e 00 74 08 4c
RSP: 0018:ffffc90000a18f30 EFLAGS: 00010046
RAX: a0c03b8175f45000 RBX: ffff8880798ab4e8 RCX: ffff88801d2f9e00
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff81601b32 R09: 1ffff110170e519a
R10: dffffc0000000000 R11: ffffed10170e519b R12: ffff8880b8739838
R13: 0000000000000010 R14: 1ffff110170e7309 R15: ffff8880b8739848
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffff686ccb8 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 csd_do_func kernel/smp.c:134 [inline]
 __flush_smp_call_function_queue+0x3fc/0x1690 kernel/smp.c:540
 __sysvec_call_function_single+0xb8/0x430 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:get_reg arch/x86/kernel/unwind_orc.c:452 [inline]
RIP: 0010:unwind_next_frame+0x1642/0x22d0 arch/x86/kernel/unwind_orc.c:643
Code: 0f 84 d0 00 00 00 83 fe 01 0f 84 28 01 00 00 85 f6 0f 85 cb 02 00 00 48 8b 44 24 38 80 3c 28 00 74 08 4c 89 ff e8 2e ac be 00 <49> 8b 1f 48 85 db 0f 84 53 01 00 00 48 8b 44 24 08 48 8d 68 36 48
RSP: 0018:ffffc900001f7670 EFLAGS: 00000246
RAX: 1ffff9200003eef2 RBX: 1ffffffff215c16a RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc900001f77a0
RBP: dffffc0000000000 R08: ffffc900001f779f R09: 0000000000000000
R10: ffffc900001f7790 R11: fffff5200003eef4 R12: ffffc900001f8000
R13: ffffc900001f7740 R14: ffffffff820a34f9 R15: ffffc900001f7790
 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2338 [inline]
 slab_free mm/slub.c:4598 [inline]
 kfree+0x196/0x420 mm/slub.c:4746
 free_ipc_ns ipc/namespace.c:159 [inline]
 free_ipc+0x135/0x290 ipc/namespace.c:181
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
 worker_thread+0x870/0xd30 kernel/workqueue.c:3391
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	0f 84 d0 00 00 00    	je     0xd6
   6:	83 fe 01             	cmp    $0x1,%esi
   9:	0f 84 28 01 00 00    	je     0x137
   f:	85 f6                	test   %esi,%esi
  11:	0f 85 cb 02 00 00    	jne    0x2e2
  17:	48 8b 44 24 38       	mov    0x38(%rsp),%rax
  1c:	80 3c 28 00          	cmpb   $0x0,(%rax,%rbp,1)
  20:	74 08                	je     0x2a
  22:	4c 89 ff             	mov    %r15,%rdi
  25:	e8 2e ac be 00       	call   0xbeac58
* 2a:	49 8b 1f             	mov    (%r15),%rbx <-- trapping instruction
  2d:	48 85 db             	test   %rbx,%rbx
  30:	0f 84 53 01 00 00    	je     0x189
  36:	48 8b 44 24 08       	mov    0x8(%rsp),%rax
  3b:	48 8d 68 36          	lea    0x36(%rax),%rbp
  3f:	48                   	rex.W