------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 5093 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline]
WARNING: CPU: 0 PID: 5093 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline]
WARNING: CPU: 0 PID: 5093 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline]
WARNING: CPU: 0 PID: 5093 at fs/buffer.c:1148 invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Modules linked in:
CPU: 0 PID: 5093 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:__brelse fs/buffer.c:1148 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:325 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1394 [inline]
RIP: 0010:invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Code: 00 e8 1c 56 e6 ff f0 41 ff 0e eb 20 e8 61 ec a1 ff 80 3c 2b 00 75 25 eb 2b e8 54 ec a1 ff 48 c7 c7 20 3f 17 8a e8 e8 89 c8 07 <0f> 0b 48 bd 00 00 00 00 00 fc ff df 80 3c 2b 00 74 08 4c 89 ff e8
RSP: 0018:ffffc90000007f60 EFLAGS: 00010046
RAX: c05b63772a3efe00 RBX: 1ffff11017206cb0 RCX: ffff88807b303b80
RDX: 0000000000010000 RSI: 0000000080010001 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: ffffed1017204f2c
R10: ffffed1017204f2c R11: 1ffff11017204f2b R12: ffff8880b9036578
R13: 0000000000000008 R14: ffff888074a784e8 R15: ffff8880b9036580
FS: 00005555708bc500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8df2562e60 CR3: 0000000023ca8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
flush_smp_call_function_queue+0x2a9/0x760 kernel/smp.c:628
__sysvec_call_function_single+0x98/0x240 arch/x86/kernel/smp.c:248
instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:214 [inline]
RIP: 0010:test_bit include/asm-generic/bitops/instrumented-non-atomic.h:135 [inline]
RIP: 0010:tomoyo_check_acl+0x2e6/0x3f0 security/tomoyo/domain.c:184
Code: 00 4d 8d 74 24 ff 44 89 f7 c1 ef 03 81 e7 f8 1f 00 00 4c 8b 7c 24 28 4c 01 ff be 08 00 00 00 e8 b0 ba 20 fe 31 f6 4d 0f a3 37 <40> 0f 93 c5 40 0f 92 c6 bf 02 00 00 00 e8 58 53 dc fd 40 84 ed 74
RSP: 0018:ffffc90002f0fa50 EFLAGS: 00000246
RAX: ffffffff839b7901 RBX: dffffc0000000000 RCX: ffffffff839b7940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888021de6030
RBP: ffff888021de6001 R08: dffffc0000000000 R09: ffffed10043bcc07
R10: ffffed10043bcc07 R11: 1ffff110043bcc06 R12: 000000000000002d
R13: 0000000000000ba0 R14: 000000000000002c R15: ffff888021de6030
tomoyo_path_permission+0x1b4/0x380 security/tomoyo/file.c:586
tomoyo_path_perm+0x363/0x510 security/tomoyo/file.c:838
tomoyo_path_symlink+0xa0/0xe0 security/tomoyo/tomoyo.c:199
security_path_symlink+0xdc/0x130 security/security.c:1179
do_symlinkat+0xff/0x6c0 fs/namei.c:4453
__do_sys_symlinkat fs/namei.c:4475 [inline]
__se_sys_symlinkat fs/namei.c:4472 [inline]
__x64_sys_symlinkat+0x95/0xa0 fs/namei.c:4472
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f8df24a42a7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0a 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcf5343358 EFLAGS: 00000202 ORIG_RAX: 000000000000010a
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f8df24a42a7
RDX: 00007f8df2527ab0 RSI: 00000000ffffff9c RDI: 00007ffcf53433e0
RBP: 00007ffcf534338c R08: 0000000000000017 R09: 00007ffcf53430a7
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000032
R13: 00000000000198b5 R14: 00007ffcf53433e0 R15: 00007ffcf53433e0
----------------
Code disassembly (best guess):
0: 00 4d 8d add %cl,-0x73(%rbp)
3: 74 24 je 0x29
5: ff 44 89 f7 incl -0x9(%rcx,%rcx,4)
9: c1 ef 03 shr $0x3,%edi
c: 81 e7 f8 1f 00 00 and $0x1ff8,%edi
12: 4c 8b 7c 24 28 mov 0x28(%rsp),%r15
17: 4c 01 ff add %r15,%rdi
1a: be 08 00 00 00 mov $0x8,%esi
1f: e8 b0 ba 20 fe call 0xfe20bad4
24: 31 f6 xor %esi,%esi
26: 4d 0f a3 37 bt %r14,(%r15)
* 2a: 40 0f 93 c5 setae %bpl <-- trapping instruction
2e: 40 0f 92 c6 setb %sil
32: bf 02 00 00 00 mov $0x2,%edi
37: e8 58 53 dc fd call 0xfddc5394
3c: 40 84 ed test %bpl,%bpl
3f: 74 .byte 0x74