------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 11854 at fs/buffer.c:1229 __brelse fs/buffer.c:1229 [inline]
WARNING: CPU: 1 PID: 11854 at fs/buffer.c:1229 __brelse+0x6d/0xb0 fs/buffer.c:1223
Modules linked in:
CPU: 1 UID: 0 PID: 11854 Comm: syz-executor Not tainted 6.13.0-rc5-syzkaller-00012-g0bc21e701a6f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__brelse fs/buffer.c:1229 [inline]
RIP: 0010:__brelse+0x6d/0xb0 fs/buffer.c:1223
Code: 84 d2 75 52 44 8b 63 60 31 ff 44 89 e6 e8 fb d5 79 ff 45 85 e4 75 20 e8 b1 d3 79 ff 90 48 c7 c7 e0 24 7f 8b e8 b4 0d 3a ff 90 <0f> 0b 90 90 5b 5d 41 5c e9 96 d3 79 ff e8 91 d3 79 ff be 04 00 00
RSP: 0018:ffffc90000a18f40 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff8880771b8e80 RCX: ffffffff815a5139
RDX: ffff88802628bc00 RSI: ffffffff815a5146 RDI: 0000000000000001
RBP: ffff8880771b8ee0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000003 R12: 0000000000000000
R13: ffff8880771b8e80 R14: dffffc0000000000 R15: ffffffff82204240
FS: 000055558e966500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcdc068000 CR3: 0000000047d92000 CR4: 0000000000350ef0
Call Trace:
brelse include/linux/buffer_head.h:324 [inline]
__invalidate_bh_lrus fs/buffer.c:1498 [inline]
invalidate_bh_lru+0xa2/0x190 fs/buffer.c:1511
csd_do_func kernel/smp.c:134 [inline]
__flush_smp_call_function_queue+0x27d/0x8c0 kernel/smp.c:540
__sysvec_call_function_single+0x8c/0x410 arch/x86/kernel/smp.c:271
instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
sysvec_call_function_single+0x9f/0xc0 arch/x86/kernel/smp.c:266
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:console_flush_all+0x9a4/0xc60 kernel/printk/printk.c:3211
Code: 00 e8 50 09 28 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 8e 68 20 00 48 85 db 0f 85 55 01 00 00 e8 10 66 20 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 d5 38 82
RSP: 0018:ffffc900000d6f50 EFLAGS: 00000293
RAX: ffffffff8ee958f8 RBX: 0000000000000000 RCX: ffffffff8179af72
RDX: ffff88802628bc00 RSI: ffffffff8179af80 RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000004 R12: ffffffff8ee958f8
R13: ffffffff8ee958a0 R14: ffffc900000d6fe0 R15: dffffc0000000000
__console_flush_and_unlock kernel/printk/printk.c:3269 [inline]
console_unlock+0xd9/0x210 kernel/printk/printk.c:3309
vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432
vprintk+0x7f/0xa0 kernel/printk/printk_safe.c:86
_printk+0xc8/0x100 kernel/printk/printk.c:2457
batadv_hardif_enable_interface+0x761/0xd20 net/batman-adv/hard-interface.c:771
batadv_softif_slave_add+0x109/0x130 net/batman-adv/soft-interface.c:844
do_set_master+0x1bf/0x230 net/core/rtnetlink.c:2917
do_setlink.constprop.0+0xb5b/0x3f80 net/core/rtnetlink.c:3116
rtnl_changelink net/core/rtnetlink.c:3723 [inline]
__rtnl_newlink net/core/rtnetlink.c:3875 [inline]
rtnl_newlink+0x1306/0x1d60 net/core/rtnetlink.c:4012
rtnetlink_rcv_msg+0x95e/0xea0 net/core/rtnetlink.c:6922
netlink_rcv_skb+0x16e/0x440 net/netlink/af_netlink.c:2542
netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
netlink_unicast+0x53f/0x7f0 net/netlink/af_netlink.c:1347
netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1891
sock_sendmsg_nosec net/socket.c:711 [inline]
__sock_sendmsg net/socket.c:726 [inline]
__sys_sendto+0x48b/0x4f0 net/socket.c:2197
__do_sys_sendto net/socket.c:2204 [inline]
__se_sys_sendto net/socket.c:2200 [inline]
__x64_sys_sendto+0xe0/0x1c0 net/socket.c:2200
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5bd3d87bbc
Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b
RSP: 002b:00007ffc427bc4b0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f5bd4aa4620 RCX: 00007f5bd3d87bbc
RDX: 0000000000000028 RSI: 00007f5bd4aa4670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffc427bc504 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f5bd4aa4670 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 00 e8 add %ch,%al
2: 50 push %rax
3: 09 28 or %ebp,(%rax)
5: 00 9c 5b 81 e3 00 02 add %bl,0x200e381(%rbx,%rbx,2)
c: 00 00 add %al,(%rax)
e: 31 ff xor %edi,%edi
10: 48 89 de mov %rbx,%rsi
13: e8 8e 68 20 00 call 0x2068a6
18: 48 85 db test %rbx,%rbx
1b: 0f 85 55 01 00 00 jne 0x176
21: e8 10 66 20 00 call 0x206636
26: fb sti
27: 4c 89 e0 mov %r12,%rax
* 2a: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction
2e: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1)
33: 0f 84 11 ff ff ff je 0xffffff4a
39: 4c 89 e7 mov %r12,%rdi
3c: e8 .byte 0xe8
3d: d5 (bad)
3e: 38 .byte 0x38
3f: 82 .byte 0x82