------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 4161 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline]
WARNING: CPU: 1 PID: 4161 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline]
WARNING: CPU: 1 PID: 4161 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline]
WARNING: CPU: 1 PID: 4161 at fs/buffer.c:1148 invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Modules linked in:
CPU: 1 PID: 4161 Comm: udevd Not tainted 5.15.175-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__brelse fs/buffer.c:1148 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:325 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1394 [inline]
RIP: 0010:invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Code: 00 e8 5c 61 e4 ff f0 ff 0b eb 21 e8 92 83 9a ff 41 80 3c 2e 00 75 26 eb 2c e8 84 83 9a ff 48 c7 c7 20 6e b7 8a e8 c8 1d 66 ff <0f> 0b 48 bd 00 00 00 00 00 fc ff df 41 80 3c 2e 00 74 08 4c 89 ff
RSP: 0018:ffffc90000dd0f60 EFLAGS: 00010046
RAX: 73e048108f15f100 RBX: ffff888074f3c148 RCX: ffff8880753c1dc0
RDX: 0000000000010000 RSI: 0000000080010001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8166aa6c R09: fffff520001ba12d
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880b8f36538
R13: 0000000000000000 R14: 1ffff110171e6ca7 R15: ffff8880b8f36538
FS: 00007fc0ce5e9c80(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555568822608 CR3: 000000001b7ef000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
flush_smp_call_function_queue+0x2b5/0x760 kernel/smp.c:628
__sysvec_call_function_single+0x9a/0x250 arch/x86/kernel/smp.c:248
instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:22 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:106 [inline]
RIP: 0010:lock_release+0x13a/0x9a0 kernel/locking/lockdep.c:5639
Code: 42 0f b6 04 38 84 c0 0f 85 c2 05 00 00 83 3b 00 0f 85 fe 04 00 00 4c 8d b4 24 b0 00 00 00 4c 89 f3 48 c1 eb 03 42 80 3c 3b 00 <74> 08 4c 89 f7 e8 1c 6d 67 00 4c 89 6c 24 50 48 c7 84 24 b0 00 00
RSP: 0018:ffffc90002f5f920 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 1ffff920005ebf3a RCX: ffffffff8162f3c8
RDX: 0000000000000000 RSI: ffffffff8af9efe0 RDI: ffffffff8af9efa0
RBP: ffffc90002f5fa50 R08: dffffc0000000000 R09: fffffbfff1c14c0e
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920005ebf30
R13: ffffffff81b9ea08 R14: ffffc90002f5f9d0 R15: dffffc0000000000
_copy_to_iter+0xe2/0xea0 lib/iov_iter.c:668
copy_to_iter include/linux/uio.h:155 [inline]
seq_read_iter+0xb28/0xd10 fs/seq_file.c:281
call_read_iter include/linux/fs.h:2168 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0xa93/0xe10 fs/read_write.c:485
ksys_read+0x1a2/0x2c0 fs/read_write.c:623
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fc0ce714b6a
Code: 00 3d 00 00 41 00 75 0d 50 48 8d 3d 2d 08 0a 00 e8 ea 7d 01 00 31 c0 e9 07 ff ff ff 64 8b 04 25 18 00 00 00 85 c0 75 1b 0f 05 <48> 3d 00 f0 ff ff 76 6c 48 8b 15 8f a2 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffe84f388e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000055e2a6b1fbd0 RCX: 00007fc0ce714b6a
RDX: 0000000000001000 RSI: 000055e2a6b19340 RDI: 0000000000000009
RBP: 000055e2a6b1fbd0 R08: 0000000000000009 R09: 0000000000000008
R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000003fff R14: 00007ffe84f38dc8 R15: 000000000000000a
----------------
Code disassembly (best guess):
0: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
5: 84 c0 test %al,%al
7: 0f 85 c2 05 00 00 jne 0x5cf
d: 83 3b 00 cmpl $0x0,(%rbx)
10: 0f 85 fe 04 00 00 jne 0x514
16: 4c 8d b4 24 b0 00 00 lea 0xb0(%rsp),%r14
1d: 00
1e: 4c 89 f3 mov %r14,%rbx
21: 48 c1 eb 03 shr $0x3,%rbx
25: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1)
* 2a: 74 08 je 0x34 <-- trapping instruction
2c: 4c 89 f7 mov %r14,%rdi
2f: e8 1c 6d 67 00 call 0x676d50
34: 4c 89 6c 24 50 mov %r13,0x50(%rsp)
39: 48 rex.W
3a: c7 .byte 0xc7
3b: 84 24 b0 test %ah,(%rax,%rsi,4)