------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 3 PID: 10138 at fs/buffer.c:1145 __brelse fs/buffer.c:1145 [inline]
WARNING: CPU: 3 PID: 10138 at fs/buffer.c:1145 __brelse+0x6b/0xa0 fs/buffer.c:1139
Modules linked in:
CPU: 3 PID: 10138 Comm: dhcpcd Not tainted 6.1.0-syzkaller-14565-ga27405b2ed9c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:__brelse fs/buffer.c:1145 [inline]
RIP: 0010:__brelse+0x6b/0xa0 fs/buffer.c:1139
Code: 7c 04 84 d2 75 4e 44 8b 63 60 31 ff 44 89 e6 e8 db ed 92 ff 45 85 e4 75 1c e8 21 f1 92 ff 48 c7 c7 e0 2c 5c 8a e8 35 d1 d0 07 <0f> 0b 5b 5d 41 5c e9 0a f1 92 ff e8 05 f1 92 ff be 04 00 00 00 48
RSP: 0018:ffffc900005d8f40 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff888040692ae0 RCX: 0000000000000000
RDX: ffff88801c0457c0 RSI: ffffffff8166721c RDI: fffff520000bb1da
RBP: ffff888040692b40 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080010003 R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88802c937380 R15: 0000000000000000
FS: 00007ff2ba0cd740(0000) GS:ffff88802c900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff2ba077df9 CR3: 000000007422e000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
brelse include/linux/buffer_head.h:326 [inline]
__invalidate_bh_lrus fs/buffer.c:1380 [inline]
invalidate_bh_lru+0x9d/0x160 fs/buffer.c:1393
__flush_smp_call_function_queue+0x205/0x9a0 kernel/smp.c:630
__sysvec_call_function+0xce/0x4e0 arch/x86/kernel/smp.c:239
sysvec_call_function+0x92/0xc0 arch/x86/kernel/smp.c:234
asm_sysvec_call_function+0x1a/0x20 arch/x86/include/asm/idtentry.h:658
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x3c/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 a6 b9 5a f7 48 89 ef e8 4e 26 5b f7 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 8f 89 4d f7 65 8b 05 40 76 fa 75 85 c0 74 0a 5b 5d c3 e8 4c 9e
RSP: 0018:ffffc9000608fa38 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000200 RCX: 1ffffffff22672ae
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff88802c92c240 R08: 0000000000000001 R09: ffffffff91336ac7
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8c7d5a10
R13: dffffc0000000000 R14: ffff88802c900000 R15: ffffffff8c7d5a10
cgroup_rstat_updated+0x288/0x390 kernel/cgroup/rstat.c:73
memcg_rstat_updated mm/memcontrol.c:612 [inline]
__mod_memcg_lruvec_state+0x175/0x320 mm/memcontrol.c:802
__mod_lruvec_page_state+0x1e9/0x3e0 mm/memcontrol.c:845
page_add_file_rmap+0x159/0x970 mm/rmap.c:1367
do_set_pte+0x431/0x7b0 mm/memory.c:4307
filemap_map_pages+0xcd3/0x1a80 mm/filemap.c:3407
do_fault_around mm/memory.c:4483 [inline]
do_read_fault mm/memory.c:4509 [inline]
do_fault mm/memory.c:4643 [inline]
handle_pte_fault mm/memory.c:4931 [inline]
__handle_mm_fault+0x22d0/0x3c90 mm/memory.c:5073
handle_mm_fault+0x1b6/0x850 mm/memory.c:5219
do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1428
handle_page_fault arch/x86/mm/fault.c:1519 [inline]
exc_page_fault+0x98/0x170 arch/x86/mm/fault.c:1575
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7ff2ba077df9
Code: e8 2c 95 ff ff 48 8b 44 24 18 64 48 2b 04 25 28 00 00 00 74 05 e8 d7 95 ff ff 48 83 c4 20 44 89 e0 5b 5d 41 5c 41 5d 41 5e c3 <53> 48 8b 1d 5f 61 01 00 48 8b 3b e8 97 92 ff ff 48 c7 03 00 00 00
RSP: 002b:00007ffd67360b18 EFLAGS: 00010283
RAX: 00007ff2ba08d500 RBX: 00007ff2ba08d4f8 RCX: 00007ffd67360cd0
RDX: 0000000000000004 RSI: 00007ff2ba2aba60 RDI: 0000000000000000
RBP: 00007ff2ba08d4f8 R08: 000055d31d84f1c0 R09: 0000000000000000
R10: 0000000000000003 R11: 00007ffd67360c60 R12: 000055d31d858790
R13: 0000000000000008 R14: 0000000000000008 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 74 24 je 0x26
2: 10 e8 adc %ch,%al
4: a6 cmpsb %es:(%rdi),%ds:(%rsi)
5: b9 5a f7 48 89 mov $0x8948f75a,%ecx
a: ef out %eax,(%dx)
b: e8 4e 26 5b f7 callq 0xf75b265e
10: 81 e3 00 02 00 00 and $0x200,%ebx
16: 75 25 jne 0x3d
18: 9c pushfq
19: 58 pop %rax
1a: f6 c4 02 test $0x2,%ah
1d: 75 2d jne 0x4c
1f: 48 85 db test %rbx,%rbx
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 8f 89 4d f7 callq 0xf74d89be <-- trapping instruction
2f: 65 8b 05 40 76 fa 75 mov %gs:0x75fa7640(%rip),%eax # 0x75fa7676
36: 85 c0 test %eax,%eax
38: 74 0a je 0x44
3a: 5b pop %rbx
3b: 5d pop %rbp
3c: c3 retq
3d: e8 .byte 0xe8
3e: 4c 9e rex.WR sahf