------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 0 at fs/buffer.c:1145 __brelse fs/buffer.c:1145 [inline]
WARNING: CPU: 1 PID: 0 at fs/buffer.c:1145 __brelse+0x67/0xa0 fs/buffer.c:1139
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-syzkaller-03015-g2bca25eaeba6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
RIP: 0010:__brelse fs/buffer.c:1145 [inline]
RIP: 0010:__brelse+0x67/0xa0 fs/buffer.c:1139
Code: 7c 04 84 d2 75 4e 44 8b 63 60 31 ff 44 89 e6 e8 bf ab 94 ff 45 85 e4 75 1c e8 f5 ae 94 ff 48 c7 c7 80 9c fc 89 e8 c5 d7 57 07 <0f> 0b 5b 5d 41 5c e9 de ae 94 ff e8 d9 ae 94 ff be 04 00 00 00 48
RSP: 0018:ffffc900001f0f48 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff8880749cae80 RCX: 0000000000000000
RDX: ffff888011a83b00 RSI: ffffffff8160f6f8 RDI: fffff5200003e1db
RBP: ffff8880749caee0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080010002 R11: 0000000000000000 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8880b9b35f80 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055888af859e0 CR3: 000000001bc8e000 CR4: 0000000000350ee0
Call Trace:
brelse include/linux/buffer_head.h:327 [inline]
__invalidate_bh_lrus fs/buffer.c:1391 [inline]
invalidate_bh_lru+0x99/0x150 fs/buffer.c:1404
__flush_smp_call_function_queue+0x205/0x9a0 kernel/smp.c:630
__sysvec_call_function_single+0x95/0x3d0 arch/x86/kernel/smp.c:248
sysvec_call_function_single+0x8e/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:657
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry+0x1fd/0x2a0 drivers/acpi/processor_idle.c:572
Code: 89 de e8 c6 8e f4 f7 84 db 75 ac e8 3d 92 f4 f7 e8 78 09 fb f7 eb 0c e8 31 92 f4 f7 0f 00 2d 5a a8 ce 00 e8 25 92 f4 f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 f0 8e f4 f7 48 85 db
RSP: 0018:ffffc90000187d18 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888011a83b00 RSI: ffffffff8986834b RDI: 0000000000000000
RBP: ffff88814525f064 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff88814525f000 R14: ffff88814525f064 R15: ffff888017eaf804
acpi_idle_enter+0x364/0x500 drivers/acpi/processor_idle.c:709
cpuidle_enter_state+0x1ab/0xd30 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3e8/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:262
secondary_startup_64_no_verify+0xce/0xdb
----------------
Code disassembly (best guess):
0: 89 de mov %ebx,%esi
2: e8 c6 8e f4 f7 callq 0xf7f48ecd
7: 84 db test %bl,%bl
9: 75 ac jne 0xffffffb7
b: e8 3d 92 f4 f7 callq 0xf7f4924d
10: e8 78 09 fb f7 callq 0xf7fb098d
15: eb 0c jmp 0x23
17: e8 31 92 f4 f7 callq 0xf7f4924d
1c: 0f 00 2d 5a a8 ce 00 verw 0xcea85a(%rip) # 0xcea87d
23: e8 25 92 f4 f7 callq 0xf7f4924d
28: fb sti
29: f4 hlt
* 2a: 9c pushfq <-- trapping instruction
2b: 5b pop %rbx
2c: 81 e3 00 02 00 00 and $0x200,%ebx
32: fa cli
33: 31 ff xor %edi,%edi
35: 48 89 de mov %rbx,%rsi
38: e8 f0 8e f4 f7 callq 0xf7f48f2d
3d: 48 85 db test %rbx,%rbx