------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 13804 at fs/buffer.c:1145 __brelse fs/buffer.c:1145 [inline]
WARNING: CPU: 0 PID: 13804 at fs/buffer.c:1145 brelse include/linux/buffer_head.h:326 [inline]
WARNING: CPU: 0 PID: 13804 at fs/buffer.c:1145 __invalidate_bh_lrus fs/buffer.c:1380 [inline]
WARNING: CPU: 0 PID: 13804 at fs/buffer.c:1145 invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1393
Modules linked in:
CPU: 0 PID: 13804 Comm: dhcpcd-run-hook Not tainted 6.1.119-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__brelse fs/buffer.c:1145 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:326 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1380 [inline]
RIP: 0010:invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1393
Code: 00 e8 bc 8e e0 ff f0 ff 0b eb 21 e8 f2 03 89 ff 41 80 3c 2e 00 75 26 eb 2c e8 e4 03 89 ff 48 c7 c7 20 0f 1a 8b e8 e8 1d 51 ff <0f> 0b 48 bd 00 00 00 00 00 fc ff df 41 80 3c 2e 00 74 08 4c 89 ff
RSP: 0000:ffffc90000007f38 EFLAGS: 00010046
RAX: 0024a315fbe2cc00 RBX: ffff888073d4f888 RCX: ffff88807cc68000
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8152b88e R09: ffffed10171c4f1c
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880b8e368f8
R13: 0000000000000000 R14: 1ffff110171c6d1f R15: ffff8880b8e368f8
FS:  00007f586d97f380(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f586dad793a CR3: 000000002495c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 00000000e08e000e DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __flush_smp_call_function_queue+0x2d9/0xd00 kernel/smp.c:641
 __sysvec_call_function_single+0xbb/0x360 arch/x86/kernel/smp.c:267
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:262 [inline]
 sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:262
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:699
RIP: 0010:kasan_mem_to_shadow include/linux/kasan.h:59 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x33/0x290 mm/kasan/generic.c:189
Code: 85 f6 0f 84 9a 01 00 00 48 89 fd 48 01 f5 0f 82 5a 02 00 00 48 89 fd 48 c1 ed 2f 81 fd ff ff 01 00 0f 82 47 02 00 00 48 89 fb <48> c1 eb 03 49 b8 00 00 00 00 00 fc ff df 4e 8d 0c 03 4c 8d 54 37
RSP: 0000:ffffc90003cdf7b8 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffffffff8e9af7a8 RCX: ffffffff816aa1fb
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e9af7a8
RBP: 000000000001ffff R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff9200079bf04
R13: dffffc0000000000 R14: 0000000000000000 R15: ffffea0002e3a0c0
 instrument_atomic_read include/linux/instrumented.h:72 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 cpumask_test_cpu include/linux/cpumask.h:444 [inline]
 cpu_online include/linux/cpumask.h:1030 [inline]
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0xeb/0x5a0 kernel/locking/lockdep.c:5633
 rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 rcu_read_lock include/linux/rcupdate.h:791 [inline]
 page_ext_get+0x39/0x2a0 mm/page_ext.c:157
 page_table_check_set+0x52/0x6d0 mm/page_table_check.c:112
 page_table_check_pte_set include/linux/page_table_check.h:83 [inline]
 set_pte_at arch/x86/include/asm/pgtable.h:1009 [inline]
 do_set_pte+0x584/0x590 mm/memory.c:4424
 filemap_map_pages+0xc7c/0x12c0 mm/filemap.c:3480
 do_fault_around mm/memory.c:4598 [inline]
 do_read_fault mm/memory.c:4624 [inline]
 do_fault mm/memory.c:4758 [inline]
 handle_pte_fault mm/memory.c:5029 [inline]
 __handle_mm_fault mm/memory.c:5171 [inline]
 handle_mm_fault+0x33e0/0x5340 mm/memory.c:5292
 do_user_addr_fault arch/x86/mm/fault.c:1340 [inline]
 handle_page_fault arch/x86/mm/fault.c:1431 [inline]
 exc_page_fault+0x26f/0x620 arch/x86/mm/fault.c:1487
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f586dad793a
Code: Unable to access opcode bytes at 0x7f586dad7910.
RSP: 002b:00007ffeb7dab608 EFLAGS: 00010206
RAX: 00007f586dbb6458 RBX: 0000000000000001 RCX: ffffffffffffff90
RDX: ffffffffffffff88 RSI: 00007ffeb7dab610 RDI: 0000000000000003
RBP: 00007ffeb7dab8d0 R08: 000000000000ffff R09: 000000000000000d
R10: 00007f586da0db74 R11: 0000000000000206 R12: 0000000000000000
R13: 000001a4f2dfda81 R14: 0000000000000000 R15: 00007f586dcb22a0
 </TASK>
----------------
Code disassembly (best guess):
   0:	85 f6                	test   %esi,%esi
   2:	0f 84 9a 01 00 00    	je     0x1a2
   8:	48 89 fd             	mov    %rdi,%rbp
   b:	48 01 f5             	add    %rsi,%rbp
   e:	0f 82 5a 02 00 00    	jb     0x26e
  14:	48 89 fd             	mov    %rdi,%rbp
  17:	48 c1 ed 2f          	shr    $0x2f,%rbp
  1b:	81 fd ff ff 01 00    	cmp    $0x1ffff,%ebp
  21:	0f 82 47 02 00 00    	jb     0x26e
  27:	48 89 fb             	mov    %rdi,%rbx
* 2a:	48 c1 eb 03          	shr    $0x3,%rbx <-- trapping instruction
  2e:	49 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%r8
  35:	fc ff df
  38:	4e 8d 0c 03          	lea    (%rbx,%r8,1),%r9
  3c:	4c                   	rex.WR
  3d:	8d                   	.byte 0x8d
  3e:	54                   	push   %rsp
  3f:	37                   	(bad)