------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 16 at fs/buffer.c:1235 __brelse fs/buffer.c:1235 [inline]
WARNING: CPU: 0 PID: 16 at fs/buffer.c:1235 __brelse+0x6d/0xb0 fs/buffer.c:1229
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__brelse fs/buffer.c:1235 [inline]
RIP: 0010:__brelse+0x6d/0xb0 fs/buffer.c:1229
Code: 84 d2 75 52 44 8b 63 60 31 ff 44 89 e6 e8 fb 18 7b ff 45 85 e4 75 20 e8 b1 16 7b ff 90 48 c7 c7 60 e8 7e 8b e8 44 09 3c ff 90 <0f> 0b 90 90 5b 5d 41 5c e9 96 16 7b ff e8 91 16 7b ff be 04 00 00
RSP: 0018:ffffc90000007f40 EFLAGS: 00010082
RAX: 0000000000000000 RBX: ffff88805b041000 RCX: ffffffff814e6e79
RDX: ffff88801d2b5a00 RSI: ffffffff814e6e86 RDI: 0000000000000001
RBP: ffff88805b041060 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88805b041000 R14: dffffc0000000000 R15: ffffffff821263f0
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f319ab08ab8 CR3: 0000000067e5a000 CR4: 0000000000350ef0
Call Trace:
brelse include/linux/buffer_head.h:324 [inline]
__invalidate_bh_lrus fs/buffer.c:1504 [inline]
invalidate_bh_lru+0xa2/0x190 fs/buffer.c:1517
csd_do_func kernel/smp.c:134 [inline]
__flush_smp_call_function_queue+0x27d/0x8c0 kernel/smp.c:540
__sysvec_call_function_single+0x8c/0x410 arch/x86/kernel/smp.c:271
instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
sysvec_call_function_single+0x9f/0xc0 arch/x86/kernel/smp.c:266
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 56 c5 46 f6 48 89 df e8 6e 42 47 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 95 4b 38 f6 65 8b 05 a6 04 e0 74 85 c0 74 16 5b
RSP: 0018:ffffc90000157bc8 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffffffff9a9e6e68 RCX: 1ffffffff20be7c1
RDX: 0000000000000000 RSI: ffffffff8b6cd040 RDI: ffffffff8bd1a6c0
RBP: 0000000000000216 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff905f804f R11: 0000000000000000 R12: 0000000000000006
R13: dffffc0000000000 R14: ffff88807f9a2550 R15: 1ffff9200002af7e
debug_object_deactivate+0x1f0/0x370 lib/debugobjects.c:778
debug_rcu_head_unqueue kernel/rcu/rcu.h:236 [inline]
rcu_do_batch kernel/rcu/tree.c:2559 [inline]
rcu_core+0x732/0x14d0 kernel/rcu/tree.c:2823
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
run_ksoftirqd kernel/softirq.c:927 [inline]
run_ksoftirqd+0x3a/0x60 kernel/softirq.c:919
smpboot_thread_fn+0x664/0xa30 kernel/smpboot.c:164
kthread+0x2c4/0x3a0 kernel/kthread.c:389
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 56 c5 46 f6 call 0xf646c569
13: 48 89 df mov %rbx,%rdi
16: e8 6e 42 47 f6 call 0xf6474289
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 95 4b 38 f6 call 0xf6384bc9
34: 65 8b 05 a6 04 e0 74 mov %gs:0x74e004a6(%rip),%eax # 0x74e004e1
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx