------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 3646 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline]
WARNING: CPU: 1 PID: 3646 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline]
WARNING: CPU: 1 PID: 3646 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline]
WARNING: CPU: 1 PID: 3646 at fs/buffer.c:1148 invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Modules linked in:
CPU: 1 PID: 3646 Comm: kworker/u4:7 Not tainted 5.15.161-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__brelse fs/buffer.c:1148 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:325 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1394 [inline]
RIP: 0010:invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Code: 00 e8 9c 69 e4 ff f0 ff 0b eb 21 e8 92 99 9a ff 41 80 3c 2e 00 75 26 eb 2c e8 84 99 9a ff 48 c7 c7 20 6c 97 8a e8 d8 41 66 ff <0f> 0b 48 bd 00 00 00 00 00 fc ff df 41 80 3c 2e 00 74 08 4c 89 ff
RSP: 0018:ffffc90000dd0f60 EFLAGS: 00010046
RAX: 4a7e76acced84800 RBX: ffff888059f7adf8 RCX: ffff888022eabb80
RDX: 0000000080010001 RSI: 0000000080010001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8166835c R09: ffffed1017364f24
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880b9b36578
R13: 0000000000000020 R14: 1ffff11017366cb3 R15: ffff8880b9b36598
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc0d4e6c000 CR3: 000000001b33f000 CR4: 00000000003506e0
DR0: 0000000000002800 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
flush_smp_call_function_queue+0x2b5/0x760 kernel/smp.c:628
__sysvec_call_function_single+0x9a/0x250 arch/x86/kernel/smp.c:248
sysvec_call_function_single+0x89/0xb0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:646
RIP: 0010:lock_release+0x62d/0x9a0 kernel/locking/lockdep.c:5647
Code: 3c 3b 00 74 08 4c 89 f7 e8 10 54 67 00 f6 84 24 91 00 00 00 02 75 6f 41 f7 c5 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 27 00 00 00 00 4b c7 44 27 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc900047f7ac0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 1ffff920008fef6a RCX: ffffc900047f7b03
RDX: 0000000000000002 RSI: ffffffff8a8b3ca0 RDI: ffffffff8ad8f740
RBP: ffffc900047f7be8 R08: dffffc0000000000 R09: fffffbfff1bc8d86
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920008fef64
R13: 0000000000000246 R14: ffffc900047f7b50 R15: dffffc0000000000
rcu_read_unlock include/linux/rcupdate.h:772 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:416 [inline]
batadv_nc_worker+0x239/0x5b0 net/batman-adv/network-coding.c:723
process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
kthread+0x3f6/0x4f0 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:300
----------------
Code disassembly (best guess):
0: 3c 3b cmp $0x3b,%al
2: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
6: 89 f7 mov %esi,%edi
8: e8 10 54 67 00 call 0x67541d
d: f6 84 24 91 00 00 00 testb $0x2,0x91(%rsp)
14: 02
15: 75 6f jne 0x86
17: 41 f7 c5 00 02 00 00 test $0x200,%r13d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 60 0e 36 movq $0x45e0360e,0x60(%rsp)
28: e0 45
* 2a: 4b c7 04 27 00 00 00 movq $0x0,(%r15,%r12,1) <-- trapping instruction
31: 00
32: 4b c7 44 27 08 00 00 movq $0x0,0x8(%r15,%r12,1)
39: 00 00
3b: 65 gs
3c: 48 rex.W
3d: 8b .byte 0x8b
3e: 04 25 add $0x25,%al