------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 5896 at fs/buffer.c:1229 __brelse fs/buffer.c:1229 [inline]
WARNING: CPU: 0 PID: 5896 at fs/buffer.c:1229 __brelse+0x6d/0xb0 fs/buffer.c:1223
Modules linked in:
CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:5 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: usb_hub_wq hub_event
RIP: 0010:__brelse fs/buffer.c:1229 [inline]
RIP: 0010:__brelse+0x6d/0xb0 fs/buffer.c:1223
Code: 84 d2 75 52 44 8b 63 60 31 ff 44 89 e6 e8 fb d5 79 ff 45 85 e4 75 20 e8 b1 d3 79 ff 90 48 c7 c7 e0 24 7f 8b e8 c4 0d 3a ff 90 <0f> 0b 90 90 5b 5d 41 5c e9 96 d3 79 ff e8 91 d3 79 ff be 04 00 00
RSP: 0018:ffffc90000007f40 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff88807a46c740 RCX: ffffffff815a5139
RDX: ffff8880319b1e00 RSI: ffffffff815a5146 RDI: 0000000000000001
RBP: ffff88807a46c7a0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000
R13: ffff88807a46c740 R14: dffffc0000000000 R15: ffffffff82204230
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe7f756a6c0 CR3: 000000000df7e000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 brelse include/linux/buffer_head.h:324 [inline]
 __invalidate_bh_lrus fs/buffer.c:1498 [inline]
 invalidate_bh_lru+0xa2/0x190 fs/buffer.c:1511
 csd_do_func kernel/smp.c:134 [inline]
 __flush_smp_call_function_queue+0x27d/0x8c0 kernel/smp.c:540
 __sysvec_call_function_single+0x8c/0x410 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9f/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:__might_sleep+0x9a/0x170 kernel/sched/core.c:8687
Code: ea 03 80 3c 02 00 0f 85 ae 00 00 00 49 83 bc 24 68 17 00 00 00 74 09 80 3d 23 d8 df 0e 00 74 14 48 83 c4 10 89 ee 48 89 df 5b <31> d2 5d 41 5c e9 6c f9 ff ff c6 05 06 d8 df 0e 01 90 65 4c 8b 25
RSP: 0018:ffffc90003467718 EFLAGS: 00000282
RAX: 0000000000000003 RBX: 0000000000000dc0 RCX: ffffc900034676b8
RDX: 0000000000000000 RSI: 0000000000000141 RDI: ffffffff8d956ab8
RBP: 0000000000000141 R08: 0000000000000000 R09: fffffbfff20bebea
R10: ffffffff905f5f57 R11: 0000000000000004 R12: ffff8880319b1e00
R13: 0000000000000dc0 R14: 0000000000000027 R15: ffffffff8b1d8129
 might_alloc include/linux/sched/mm.h:321 [inline]
 might_alloc include/linux/sched/mm.h:316 [inline]
 slab_pre_alloc_hook mm/slub.c:4070 [inline]
 slab_alloc_node mm/slub.c:4148 [inline]
 __do_kmalloc_node mm/slub.c:4297 [inline]
 __kmalloc_noprof+0x380/0x510 mm/slub.c:4310
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1037 [inline]
 kobject_get_path+0xd9/0x2b0 lib/kobject.c:161
 kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545
 device_add+0x10e0/0x1a70 drivers/base/core.c:3646
 usb_new_device+0xd90/0x1a10 drivers/usb/core/hub.c:2651
 hub_port_connect drivers/usb/core/hub.c:5521 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
 port_event drivers/usb/core/hub.c:5821 [inline]
 hub_event+0x2d9a/0x4e10 drivers/usb/core/hub.c:5903
 process_one_work+0x9c8/0x1ba0 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c4/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   6:	85 ae 00 00 00 49    	test   %ebp,0x49000000(%rsi)
   c:	83 bc 24 68 17 00 00 	cmpl   $0x0,0x1768(%rsp)
  13:	00
  14:	74 09                	je     0x1f
  16:	80 3d 23 d8 df 0e 00 	cmpb   $0x0,0xedfd823(%rip)        # 0xedfd840
  1d:	74 14                	je     0x33
  1f:	48 83 c4 10          	add    $0x10,%rsp
  23:	89 ee                	mov    %ebp,%esi
  25:	48 89 df             	mov    %rbx,%rdi
  28:	5b                   	pop    %rbx
* 29:	31 d2                	xor    %edx,%edx <-- trapping instruction
  2b:	5d                   	pop    %rbp
  2c:	41 5c                	pop    %r12
  2e:	e9 6c f9 ff ff       	jmp    0xfffff99f
  33:	c6 05 06 d8 df 0e 01 	movb   $0x1,0xedfd806(%rip)        # 0xedfd840
  3a:	90                   	nop
  3b:	65                   	gs
  3c:	4c                   	rex.WR
  3d:	8b                   	.byte 0x8b
  3e:	25                   	.byte 0x25