------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4696 at fs/buffer.c:1144 __brelse fs/buffer.c:1144 [inline] WARNING: CPU: 1 PID: 4696 at fs/buffer.c:1144 __brelse+0x67/0xa0 fs/buffer.c:1138 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 4696 Comm: systemd-udevd Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 panic+0x26a/0x50e kernel/panic.c:186 __warn.cold+0x20/0x5a kernel/panic.c:541 report_bug+0x262/0x2b0 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:__brelse fs/buffer.c:1144 [inline] RIP: 0010:__brelse+0x67/0xa0 fs/buffer.c:1138 Code: 7c 04 84 d2 75 4e 44 8b 63 60 31 ff 44 89 e6 e8 bf 16 b2 ff 45 85 e4 75 1c e8 45 15 b2 ff 48 c7 c7 e0 1c 75 88 e8 1e 4d 42 06 <0f> 0b 5b 5d 41 5c e9 2e 15 b2 ff e8 29 15 b2 ff be 04 00 00 00 48 RSP: 0018:ffff8880ba107f40 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffff88803dee7000 RCX: 0000000000000000 RDX: 0000000000010000 RSI: ffffffff814dff01 RDI: ffffed1017420fda RBP: ffff88803dee7060 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000005 R11: ffffffff8c66505b R12: 0000000000000000 R13: dffffc0000000000 R14: ffff8880ba1287e0 R15: 0000000000000000 brelse include/linux/buffer_head.h:297 [inline] invalidate_bh_lru+0x90/0x140 fs/buffer.c:1385 flush_smp_call_function_queue+0x144/0x4d0 kernel/smp.c:243 smp_call_function_single_interrupt+0x98/0x440 arch/x86/kernel/smp.c:304 call_function_single_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:916 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:789 [inline] RIP: 0010:qlink_free mm/kasan/quarantine.c:150 [inline] RIP: 0010:qlist_free_all+0xfc/0x140 mm/kasan/quarantine.c:166 Code: 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 4c 8b 70 18 e9 40 ff ff ff e8 a3 36 cf ff 48 83 3d e3 0f 59 08 00 74 38 4c 89 ff 57 9d <0f> 1f 44 00 00 4d 85 e4 75 9e 49 c7 45 08 00 00 00 00 49 c7 45 00 RSP: 0018:ffff88809c757b50 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff04 RAX: 0000000000000007 RBX: ffff8880b2debd80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88809c74af08 RDI: 0000000000000286 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880b496ff00 R13: ffff88809c757b88 R14: ffff88813bff01c0 R15: 0000000000000286 quarantine_reduce+0x1a9/0x230 mm/kasan/quarantine.c:259 kasan_kmalloc+0xa2/0x160 mm/kasan/kasan.c:538 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc mm/slab.c:3397 [inline] kmem_cache_alloc+0x110/0x370 mm/slab.c:3557 prepare_creds+0x39/0x510 kernel/cred.c:255 do_faccessat+0x94/0x7a0 fs/open.c:359 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fae04a419c7 Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdf0ac4738 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 000055b0f521a2d0 RCX: 00007fae04a419c7 RDX: 00746e657665752f RSI: 0000000000000000 RDI: 00007ffdf0ac4740 RBP: 00007ffdf0ac47b0 R08: 0000000000004460 R09: 0000000000001010 R10: 00007fae04cffb58 R11: 0000000000000246 R12: 000055b0f3c33856 R13: 000055b0f5204d00 R14: 00007ffdf0ac4740 R15: 000055b0f5204a90 Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess): 0: 50 push %rax 1: 08 48 8d or %cl,-0x73(%rax) 4: 4a ff 83 e2 01 48 0f rex.WX incq 0xf4801e2(%rbx) b: 45 c1 4c 8b 70 18 rex.RB rorl $0x18,0x70(%r11,%rcx,4) 11: e9 40 ff ff ff jmpq 0xffffff56 16: e8 a3 36 cf ff callq 0xffcf36be 1b: 48 83 3d e3 0f 59 08 cmpq $0x0,0x8590fe3(%rip) # 0x8591006 22: 00 23: 74 38 je 0x5d 25: 4c 89 ff mov %r15,%rdi 28: 57 push %rdi 29: 9d popfq * 2a: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) <-- trapping instruction 2f: 4d 85 e4 test %r12,%r12 32: 75 9e jne 0xffffffd2 34: 49 c7 45 08 00 00 00 movq $0x0,0x8(%r13) 3b: 00 3c: 49 rex.WB 3d: c7 .byte 0xc7 3e: 45 rex.RB