------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 5046 at fs/buffer.c:1247 __brelse fs/buffer.c:1247 [inline]
WARNING: CPU: 0 PID: 5046 at fs/buffer.c:1247 brelse include/linux/buffer_head.h:314 [inline]
WARNING: CPU: 0 PID: 5046 at fs/buffer.c:1247 __invalidate_bh_lrus fs/buffer.c:1486 [inline]
WARNING: CPU: 0 PID: 5046 at fs/buffer.c:1247 invalidate_bh_lru+0xfc/0x1b0 fs/buffer.c:1499
Modules linked in:
CPU: 0 PID: 5046 Comm: kworker/0:6 Not tainted 6.6.0-rc4-syzkaller-00229-g82714078aee4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:__brelse fs/buffer.c:1247 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:314 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1486 [inline]
RIP: 0010:invalidate_bh_lru+0xfc/0x1b0 fs/buffer.c:1499
Code: 00 e8 d8 3e df ff f0 ff 0b eb 21 e8 3e c0 84 ff 41 80 3c 2e 00 75 26 eb 2c e8 30 c0 84 ff 48 c7 c7 c0 20 18 8b e8 04 e7 4a ff <0f> 0b 48 bd 00 00 00 00 00 fc ff df 41 80 3c 2e 00 74 08 4c 89 ff
RSP: 0018:ffffc90000007f30 EFLAGS: 00010046
RAX: 8889f584d4487300 RBX: ffff888075d78c28 RCX: ffff88802456d940
RDX: 0000000080010002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff81543302 R09: 1ffff1101730516a
R10: dffffc0000000000 R11: ffffed101730516b R12: ffff8880b9837f38
R13: 0000000000000008 R14: 1ffff11017306fe8 R15: ffff8880b9837f40
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b87dfa1178 CR3: 0000000028ad7000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 csd_do_func kernel/smp.c:133 [inline]
 __flush_smp_call_function_queue+0x3e8/0x1560 kernel/smp.c:500
 __sysvec_call_function_single+0xa8/0x3d0 arch/x86/kernel/smp.c:292
 sysvec_call_function_single+0x8d/0xb0 arch/x86/kernel/smp.c:287
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:652
RIP: 0010:crng_make_state+0x5cb/0xa80 drivers/char/random.c:373
Code: 2b 25 0e 06 e9 08 fd ff ff e8 71 2a c3 fc e8 ac 9d 03 06 48 83 7c 24 28 00 74 8a e8 5f 2a c3 fc fb 48 c7 44 24 40 0e 36 e0 45 <48> b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 c7 04 08 00 00 00 00
RSP: 0018:ffffc90003c0f800 EFLAGS: 00000293
RAX: ffffffff84cadf31 RBX: 0000000000000000 RCX: ffff88802456d940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003c0f9b0 R08: ffffffff84cadea4 R09: 1ffffffff20dee8c
R10: dffffc0000000000 R11: fffffbfff20dee8d R12: 000000000000000c
R13: 000000000000000c R14: 0000000000000046 R15: ffff8880b98390f8
 _get_random_bytes+0xd7/0x2b0 drivers/char/random.c:385
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:775 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
 nsim_dev_trap_report_work+0x61e/0xa90 drivers/net/netdevsim/dev.c:850
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703
 worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784
 kthread+0x2d3/0x370 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>
----------------
Code disassembly (best guess), 4 bytes skipped:
   0:	e9 08 fd ff ff       	jmp    0xfffffd0d
   5:	e8 71 2a c3 fc       	call   0xfcc32a7b
   a:	e8 ac 9d 03 06       	call   0x6039dbb
   f:	48 83 7c 24 28 00    	cmpq   $0x0,0x28(%rsp)
  15:	74 8a                	je     0xffffffa1
  17:	e8 5f 2a c3 fc       	call   0xfcc32a7b
  1c:	fb                   	sti
  1d:	48 c7 44 24 40 0e 36 	movq   $0x45e0360e,0x40(%rsp)
  24:	e0 45
* 26:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax <-- trapping instruction
  2d:	fc ff df
  30:	48 8b 4c 24 38       	mov    0x38(%rsp),%rcx
  35:	c7 04 08 00 00 00 00 	movl   $0x0,(%rax,%rcx,1)