UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 19304 at fs/buffer.c:1144 __brelse fs/buffer.c:1144 [inline] WARNING: CPU: 1 PID: 19304 at fs/buffer.c:1144 __brelse+0x67/0xa0 fs/buffer.c:1138 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 19304 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 panic+0x26a/0x50e kernel/panic.c:186 __warn.cold+0x20/0x5a kernel/panic.c:541 report_bug+0x262/0x2b0 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:__brelse fs/buffer.c:1144 [inline] RIP: 0010:__brelse+0x67/0xa0 fs/buffer.c:1138 Code: 7c 04 84 d2 75 4e 44 8b 63 60 31 ff 44 89 e6 e8 bf 16 b2 ff 45 85 e4 75 1c e8 45 15 b2 ff 48 c7 c7 e0 1c 75 88 e8 1e 4d 42 06 <0f> 0b 5b 5d 41 5c e9 2e 15 b2 ff e8 29 15 b2 ff be 04 00 00 00 48 RSP: 0018:ffff8880ba107f40 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffff888050276e70 RCX: 0000000000000000 RDX: 0000000000010000 RSI: ffffffff814dff01 RDI: ffffed1017420fda RBP: ffff888050276ed0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000005 R11: ffffffff8c66505b R12: 0000000000000000 R13: dffffc0000000000 R14: ffff8880ba1287e0 R15: 0000000000000000 brelse include/linux/buffer_head.h:297 [inline] invalidate_bh_lru+0x90/0x140 fs/buffer.c:1385 flush_smp_call_function_queue+0x144/0x4d0 kernel/smp.c:243 smp_call_function_single_interrupt+0x98/0x440 arch/x86/kernel/smp.c:304 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:916 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:184 Code: 48 c7 c0 88 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 2f 48 83 3d 7c 31 d8 01 00 74 15 48 89 df 57 9d <0f> 1f 44 00 00 eb b2 e8 fb eb e6 f8 eb c0 0f 0b 0f 0b 48 c7 c7 88 RSP: 0018:ffff8880519678c8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff04 RAX: 1ffffffff13e3051 RBX: 0000000000000286 RCX: 1ffff110126c55a2 RDX: dffffc0000000000 RSI: ffff88809362acf0 RDI: 0000000000000286 RBP: ffff88813ffffb80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000f R13: ffff8880ba127d20 R14: ffff88813fffb000 R15: dffffc0000000000 spin_unlock_irqrestore include/linux/spinlock.h:384 [inline] pagevec_lru_move_fn+0x1be/0x270 mm/swap.c:213 __pagevec_lru_add mm/swap.c:927 [inline] __lru_cache_add+0x1c4/0x2c0 mm/swap.c:405 shmem_getpage_gfp+0x210e/0x37f0 mm/shmem.c:1847 shmem_getpage mm/shmem.c:132 [inline] shmem_write_begin+0xff/0x1e0 mm/shmem.c:2446 generic_perform_write+0x1f8/0x4d0 mm/filemap.c:3170 __generic_file_write_iter+0x24b/0x610 mm/filemap.c:3295 generic_file_write_iter+0x3f8/0x730 mm/filemap.c:3323 call_write_iter include/linux/fs.h:1821 [inline] new_sync_write fs/read_write.c:474 [inline] __vfs_write+0x51b/0x770 fs/read_write.c:487 vfs_write+0x1f3/0x540 fs/read_write.c:549 ksys_write+0x12b/0x2a0 fs/read_write.c:599 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f349f3eee5f Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 fd ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 cc fd ff ff 48 RSP: 002b:00007f349d9aef10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f349f3eee5f RDX: 0000000001000000 RSI: 00007f349558f000 RDI: 0000000000000003 RBP: 00007f349558f000 R08: 0000000000000000 R09: 00000000000050e9 R10: 0000000001000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f349d9aefdc R14: 00007f349d9aefe0 R15: 000000002000a2c2 Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess): 0: 48 c7 c0 88 82 f1 89 mov $0xffffffff89f18288,%rax 7: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx e: fc ff df 11: 48 c1 e8 03 shr $0x3,%rax 15: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) 19: 75 2f jne 0x4a 1b: 48 83 3d 7c 31 d8 01 cmpq $0x0,0x1d8317c(%rip) # 0x1d8319f 22: 00 23: 74 15 je 0x3a 25: 48 89 df mov %rbx,%rdi 28: 57 push %rdi 29: 9d popfq * 2a: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) <-- trapping instruction 2f: eb b2 jmp 0xffffffe3 31: e8 fb eb e6 f8 callq 0xf8e6ec31 36: eb c0 jmp 0xfffffff8 38: 0f 0b ud2 3a: 0f 0b ud2 3c: 48 rex.W 3d: c7 .byte 0xc7 3e: c7 (bad) 3f: 88 .byte 0x88