device bond3 entered promiscuous mode ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 1501 at fs/buffer.c:1144 __brelse fs/buffer.c:1144 [inline] WARNING: CPU: 1 PID: 1501 at fs/buffer.c:1144 __brelse+0x67/0xa0 fs/buffer.c:1138 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 1501 Comm: kworker/u4:3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: bat_events batadv_nc_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 panic+0x26a/0x50e kernel/panic.c:186 __warn.cold+0x20/0x5a kernel/panic.c:541 report_bug+0x262/0x2b0 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:__brelse fs/buffer.c:1144 [inline] RIP: 0010:__brelse+0x67/0xa0 fs/buffer.c:1138 Code: 7c 04 84 d2 75 4e 44 8b 63 60 31 ff 44 89 e6 e8 bf 16 b2 ff 45 85 e4 75 1c e8 45 15 b2 ff 48 c7 c7 e0 1c 75 88 e8 1e 4d 42 06 <0f> 0b 5b 5d 41 5c e9 2e 15 b2 ff e8 29 15 b2 ff be 04 00 00 00 48 RSP: 0018:ffff8880ba107f40 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffff888038ac4690 RCX: 0000000000000000 RDX: 0000000000010000 RSI: ffffffff814dff01 RDI: ffffed1017420fda RBP: ffff888038ac46f0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000005 R11: ffffffff8c66505b R12: 0000000000000000 R13: dffffc0000000000 R14: ffff8880ba1287e0 R15: 0000000000000000 brelse include/linux/buffer_head.h:297 [inline] invalidate_bh_lru+0x90/0x140 fs/buffer.c:1385 flush_smp_call_function_queue+0x144/0x4d0 kernel/smp.c:243 smp_call_function_single_interrupt+0x98/0x440 arch/x86/kernel/smp.c:304 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:916 RIP: 0010:kasan_mem_to_shadow include/linux/kasan.h:28 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/kasan.c:210 [inline] RIP: 0010:memory_is_poisoned mm/kasan/kasan.c:241 [inline] RIP: 0010:check_memory_region_inline mm/kasan/kasan.c:257 [inline] RIP: 0010:check_memory_region+0x35/0x170 mm/kasan/kasan.c:267 Code: ff ff ff ff ff 7f ff ff 44 0f b6 c2 48 39 c7 0f 86 20 01 00 00 4c 8d 54 37 ff 41 54 48 b8 00 00 00 00 00 fc ff df 4d 89 d1 55 <48> 89 fd 49 c1 e9 03 48 c1 ed 03 53 49 01 c1 48 01 c5 49 8d 59 01 RSP: 0018:ffff8880b2defc78 EFLAGS: 00000216 ORIG_RAX: ffffffffffffff04 RAX: dffffc0000000000 RBX: ffff8880ba122ac0 RCX: ffffffff81518c83 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8880ba122ad0 RBP: ffff8880ba122ad0 R08: 0000000000000000 R09: ffff8880ba122ad3 R10: ffff8880ba122ad3 R11: 0000000000000000 R12: 0000000000000000 R13: dffffc0000000000 R14: 000000000000029d R15: ffff8880a45d2000 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline] rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:350 [inline] rcu_is_watching+0x53/0xc0 kernel/rcu/tree.c:1025 rcu_read_unlock include/linux/rcupdate.h:677 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:423 [inline] batadv_nc_worker+0x936/0xd50 net/batman-adv/network-coding.c:730 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess): 0: ff (bad) 1: ff (bad) 2: ff (bad) 3: ff (bad) 4: ff (bad) 5: 7f ff jg 0x6 7: ff 44 0f b6 incl -0x4a(%rdi,%rcx,1) b: c2 48 39 retq $0x3948 e: c7 (bad) f: 0f 86 20 01 00 00 jbe 0x135 15: 4c 8d 54 37 ff lea -0x1(%rdi,%rsi,1),%r10 1a: 41 54 push %r12 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 23: fc ff df 26: 4d 89 d1 mov %r10,%r9 29: 55 push %rbp * 2a: 48 89 fd mov %rdi,%rbp <-- trapping instruction 2d: 49 c1 e9 03 shr $0x3,%r9 31: 48 c1 ed 03 shr $0x3,%rbp 35: 53 push %rbx 36: 49 01 c1 add %rax,%r9 39: 48 01 c5 add %rax,%rbp 3c: 49 8d 59 01 lea 0x1(%r9),%rbx