------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 2970 at fs/buffer.c:1145 __brelse fs/buffer.c:1145 [inline]
WARNING: CPU: 1 PID: 2970 at fs/buffer.c:1145 brelse+0x78/0xa0 include/linux/buffer_head.h:326
Modules linked in:
CPU: 1 PID: 2970 Comm: udevd Not tainted 6.1.0-rc2-syzkaller-00070-g4dc12f37a8e9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
RIP: 0010:__brelse fs/buffer.c:1145 [inline]
RIP: 0010:brelse+0x78/0xa0 include/linux/buffer_head.h:326
Code: df be 04 00 00 00 e8 c7 89 e0 ff f0 ff 0b eb 1c e8 6d 8f 8c ff eb 15 e8 66 8f 8c ff 48 c7 c7 c0 cc 9d 8a 31 c0 e8 b8 2d 54 ff <0f> 0b 5b 5d c3 89 d9 80 e1 07 80 c1 03 38 c1 7c af 48 89 df e8 cf
RSP: 0018:ffffc900001e0f18 EFLAGS: 00010046
RAX: aca9eac2f6117600 RBX: ffff88803ade57a0 RCX: ffff88807bcc0000
RDX: 0000000080010003 RSI: 0000000080010003 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff816b8dfd R09: ffffed1017364f13
R10: ffffed1017364f13 R11: 1ffff11017364f12 R12: 0000000000000000
R13: 1ffff1101736801a R14: ffff8880b9b35cf8 R15: dffffc0000000000
FS: 00007fb11b5a2840(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fea4f9ae000 CR3: 0000000027d0c000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__invalidate_bh_lrus+0x37/0x3c0 fs/buffer.c:1380
invalidate_bh_lru+0x66/0xb0 fs/buffer.c:1393
__flush_smp_call_function_queue+0x2cc/0xcd0 kernel/smp.c:630
__sysvec_call_function_single+0x62/0x70 arch/x86/kernel/smp.c:248
sysvec_call_function_single+0x8c/0xb0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:657
RIP: 0010:rcu_read_lock_held_common kernel/rcu/update.c:104 [inline]
RIP: 0010:rcu_read_lock_sched_held+0x58/0x110 kernel/rcu/update.c:123
Code: 8a b5 41 48 c7 44 24 08 d8 fb 39 8c 48 c7 44 24 10 40 7e 6f 81 48 89 e3 48 c1 eb 03 48 b8 f1 f1 f1 f1 00 f3 f3 f3 4a 89 04 33 63 39 c4 08 85 c0 74 2a 45 31 ff e8 87 35 01 00 84 c0 74 24 e8
RSP: 0018:ffffc9000316f740 EFLAGS: 00000a06
RAX: f3f3f300f1f1f1f1 RBX: 1ffff9200062dee8 RCX: ffffffff8167b27b
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e0dafa8
RBP: ffffc9000316f7c0 R08: dffffc0000000000 R09: fffffbfff1c1b5f6
R10: fffffbfff1c1b5f6 R11: 1ffffffff1c1b5f5 R12: dffffc0000000000
R13: ffff888078949440 R14: dffffc0000000000 R15: ffffffff8212d6d0
trace_lock_release+0x95/0x220 include/trace/events/lock.h:69
lock_release+0x81/0x820 kernel/locking/lockdep.c:5679
__raw_spin_unlock include/linux/spinlock_api_smp.h:141 [inline]
_raw_spin_unlock+0x12/0x40 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:390 [inline]
kernfs_iop_permission+0x270/0x360 fs/kernfs/inode.c:294
do_inode_permission fs/namei.c:458 [inline]
inode_permission+0x22c/0x450 fs/namei.c:525
may_lookup fs/namei.c:1715 [inline]
link_path_walk+0x2ef/0xf00 fs/namei.c:2262
path_lookupat+0xab/0x450 fs/namei.c:2473
filename_lookup+0x274/0x650 fs/namei.c:2503
user_path_at_empty+0x40/0x1a0 fs/namei.c:2876
do_readlinkat+0x10c/0x3d0 fs/stat.c:468
__do_sys_readlink fs/stat.c:501 [inline]
__se_sys_readlink fs/stat.c:498 [inline]
__x64_sys_readlink+0x7b/0x90 fs/stat.c:498
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb11b127277
Code: 73 01 c3 48 8b 0d 01 dc 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 59 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d1 db 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fff1ebbaf88 EFLAGS: 00000246 ORIG_RAX: 0000000000000059
RAX: ffffffffffffffda RBX: 00007fff1ebbaf98 RCX: 00007fb11b127277
RDX: 0000000000000400 RSI: 00007fff1ebbaf98 RDI: 00007fff1ebbb478
RBP: 0000000000000400 R08: 00000000007fffff R09: 000055eb3e7da5b0
R10: 00007fb11b1b4fc0 R11: 0000000000000246 R12: 00007fff1ebbb478
R13: 00007fff1ebbb3e8 R14: 000055eb3e7c4910 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 8a b5 41 48 c7 44 mov 0x44c74841(%rbp),%dh
6: 24 08 and $0x8,%al
8: d8 fb fdivr %st(3),%st
a: 39 8c 48 c7 44 24 10 cmp %ecx,0x102444c7(%rax,%rcx,2)
11: 40 7e 6f rex jle 0x83
14: 81 48 89 e3 48 c1 eb orl $0xebc148e3,-0x77(%rax)
1b: 03 48 b8 add -0x48(%rax),%ecx
1e: f1 icebp
1f: f1 icebp
20: f1 icebp
21: f1 icebp
22: 00 f3 add %dh,%bl
24: f3 f3 4a 89 04 33 repz xrelease mov %rax,(%rbx,%r14,1)
* 2a: e8 63 39 c4 08 callq 0x8c43992 <-- trapping instruction
2f: 85 c0 test %eax,%eax
31: 74 2a je 0x5d
33: 45 31 ff xor %r15d,%r15d
36: e8 87 35 01 00 callq 0x135c2
3b: 84 c0 test %al,%al
3d: 74 24 je 0x63
3f: e8 .byte 0xe8