------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 7258 at fs/buffer.c:1229 __brelse fs/buffer.c:1229 [inline]
WARNING: CPU: 0 PID: 7258 at fs/buffer.c:1229 __brelse+0x6d/0xb0 fs/buffer.c:1223
Modules linked in:
CPU: 0 UID: 0 PID: 7258 Comm: syz.4.443 Not tainted 6.13.0-rc5-syzkaller-00006-g56e6a3499e14 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__brelse fs/buffer.c:1229 [inline]
RIP: 0010:__brelse+0x6d/0xb0 fs/buffer.c:1223
Code: 84 d2 75 52 44 8b 63 60 31 ff 44 89 e6 e8 fb d5 79 ff 45 85 e4 75 20 e8 b1 d3 79 ff 90 48 c7 c7 e0 24 7f 8b e8 b4 0d 3a ff 90 <0f> 0b 90 90 5b 5d 41 5c e9 96 d3 79 ff e8 91 d3 79 ff be 04 00 00
RSP: 0018:ffffc90000007f40 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff888077bde2b8 RCX: ffffffff815a5139
RDX: ffff88802ce90000 RSI: ffffffff815a5146 RDI: 0000000000000001
RBP: ffff888077bde318 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000004 R12: 0000000000000000
R13: ffff888077bde2b8 R14: dffffc0000000000 R15: ffffffff82204240
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c38eab6 CR3: 000000005775c000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 brelse include/linux/buffer_head.h:324 [inline]
 __invalidate_bh_lrus fs/buffer.c:1498 [inline]
 invalidate_bh_lru+0xa2/0x190 fs/buffer.c:1511
 csd_do_func kernel/smp.c:134 [inline]
 __flush_smp_call_function_queue+0x27d/0x8c0 kernel/smp.c:540
 __sysvec_call_function_single+0x8c/0x410 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9f/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:rcu_read_unlock include/linux/rcupdate.h:878 [inline]
RIP: 0010:page_ext_put+0x1e/0xd0 mm/page_ext.c:550
Code: 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 53 48 89 fb e8 f3 93 92 ff 48 85 db 74 36 e8 e9 93 92 ff e8 44 28 20 09 31 ff <89> c3 89 c6 e8 19 96 92 ff 85 db 75 23 e8 d0 93 92 ff 48 c7 c7 00
RSP: 0018:ffffc90003207580 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88801eda20c0 RCX: ffffffff82078e68
RDX: ffff88802ce90000 RSI: ffffffff820781a7 RDI: 0000000000000000
RBP: ffff88801eda20c0 R08: 0000000000000006 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000003 R12: 0000000000000001
R13: 0000000000000001 R14: 0000000000000000 R15: dffffc0000000000
 page_table_check_clear.part.0+0x398/0x540 mm/page_table_check.c:94
 page_table_check_clear mm/page_table_check.c:70 [inline]
 __page_table_check_pte_clear+0x328/0x580 mm/page_table_check.c:169
 page_table_check_pte_clear include/linux/page_table_check.h:49 [inline]
 ptep_get_and_clear_full arch/x86/include/asm/pgtable.h:1337 [inline]
 get_and_clear_full_ptes include/linux/pgtable.h:705 [inline]
 zap_present_folio_ptes mm/memory.c:1502 [inline]
 zap_present_ptes mm/memory.c:1585 [inline]
 zap_pte_range mm/memory.c:1627 [inline]
 zap_pmd_range mm/memory.c:1753 [inline]
 zap_pud_range mm/memory.c:1782 [inline]
 zap_p4d_range mm/memory.c:1803 [inline]
 unmap_page_range+0x22f6/0x3d10 mm/memory.c:1824
 unmap_single_vma+0x194/0x2b0 mm/memory.c:1870
 unmap_vmas+0x22f/0x490 mm/memory.c:1914
 exit_mmap+0x1c6/0xb20 mm/mmap.c:1668
 __mmput+0x12a/0x4c0 kernel/fork.c:1348
 mmput+0x62/0x70 kernel/fork.c:1370
 exit_mm kernel/exit.c:570 [inline]
 do_exit+0x9ba/0x2d70 kernel/exit.c:925
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
 get_signal+0x24ed/0x26c0 kernel/signal.c:3017
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3a1fd85d29
Code: Unable to access opcode bytes at 0x7f3a1fd85cff.
RSP: 002b:00007f3a20af60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f3a1ff75fa8 RCX: 00007f3a1fd85d29
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3a1ff75fa8
RBP: 00007f3a1ff75fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a1ff75fac
R13: 0000000000000000 R14: 00007ffce5bf6a60 R15: 00007ffce5bf6b48
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	66 0f 1f 00          	nopw   (%rax)
  10:	53                   	push   %rbx
  11:	48 89 fb             	mov    %rdi,%rbx
  14:	e8 f3 93 92 ff       	call   0xff92940c
  19:	48 85 db             	test   %rbx,%rbx
  1c:	74 36                	je     0x54
  1e:	e8 e9 93 92 ff       	call   0xff92940c
  23:	e8 44 28 20 09       	call   0x920286c
  28:	31 ff                	xor    %edi,%edi
* 2a:	89 c3                	mov    %eax,%ebx <-- trapping instruction
  2c:	89 c6                	mov    %eax,%esi
  2e:	e8 19 96 92 ff       	call   0xff92964c
  33:	85 db                	test   %ebx,%ebx
  35:	75 23                	jne    0x5a
  37:	e8 d0 93 92 ff       	call   0xff92940c
  3c:	48                   	rex.W
  3d:	c7                   	.byte 0xc7
  3e:	c7                   	.byte 0xc7