------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4922 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 4922 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 4922 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 4922 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 4922 Comm: syz.0.16 Not tainted 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000caccd1c0 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000e24a8c28 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010003 x17: 0000000000010003 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010002 x10: 0000000000010002 x9 : 6bca97df046cfd00 x8 : 6bca97df046cfd00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] _raw_spin_unlock_irq+0xa0/0x128 kernel/locking/spinlock.c:202 spin_unlock_irq include/linux/spinlock.h:413 [inline] shmem_getpage_gfp+0x181c/0x1ef0 mm/shmem.c:1951 shmem_getpage mm/shmem.c:151 [inline] shmem_write_begin+0xe0/0x29c mm/shmem.c:2474 generic_perform_write+0x204/0x480 mm/filemap.c:3785 __generic_file_write_iter+0x23c/0x454 mm/filemap.c:3912 generic_file_write_iter+0xb0/0x1b4 mm/filemap.c:3944 call_write_iter include/linux/fs.h:2172 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x7c8/0xa2c fs/read_write.c:594 ksys_write+0x120/0x210 fs/read_write.c:647 __do_sys_write fs/read_write.c:659 [inline] __se_sys_write fs/read_write.c:656 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:656 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 388 hardirqs last enabled at (387): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] hardirqs last enabled at (387): [] _raw_spin_unlock_irq+0x98/0x128 kernel/locking/spinlock.c:202 hardirqs last disabled at (388): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (32): [] softirq_handle_end kernel/softirq.c:419 [inline] softirqs last enabled at (32): [] handle_softirqs+0xa4c/0xbf0 kernel/softirq.c:604 softirqs last disabled at (17): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last disabled at (17): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (17): [] invoke_softirq kernel/softirq.c:457 [inline] softirqs last disabled at (17): [] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659 ---[ end trace 5ca76294e75f1856 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4966 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 4966 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 4966 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 4966 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 4966 Comm: syz.0.38 Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000ce00d1c0 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000ed002df8 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010002 x17: 0000000000010002 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010001 x10: 0000000000010001 x9 : 5762204d52190600 x8 : 5762204d52190600 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010001 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el0_interrupt+0x94/0x260 arch/arm64/kernel/entry-common.c:683 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:690 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:695 el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:585 irq event stamp: 216 hardirqs last enabled at (215): [] el0t_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:629 hardirqs last disabled at (216): [] __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:690 softirqs last enabled at (8): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (6): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 5ca76294e75f1868 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 3652 Comm: udevd Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000d6d13680 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000def6fee0 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010004 x17: 0000000000010004 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010003 x10: 0000000000010003 x9 : 00f5ffe6053fcd00 x8 : 00f5ffe6053fcd00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010003 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0xb8/0x14c kernel/locking/spinlock.c:194 spin_unlock_irqrestore include/linux/spinlock.h:418 [inline] get_partial_node+0x240/0x2b8 mm/slub.c:2152 get_partial mm/slub.c:2232 [inline] ___slab_alloc+0x3ac/0xda8 mm/slub.c:3003 __slab_alloc+0x68/0xc0 mm/slub.c:3095 slab_alloc_node mm/slub.c:3186 [inline] slab_alloc mm/slub.c:3228 [inline] kmem_cache_alloc+0x2ac/0x3e4 mm/slub.c:3233 kmem_cache_zalloc include/linux/slab.h:725 [inline] __alloc_file+0x30/0x240 fs/file_table.c:132 alloc_empty_file+0xa0/0x184 fs/file_table.c:181 path_openat+0xcc/0x26e4 fs/namei.c:3728 do_filp_open+0x164/0x330 fs/namei.c:3769 do_sys_openat2+0x128/0x3d8 fs/open.c:1253 do_sys_open fs/open.c:1269 [inline] __do_sys_openat fs/open.c:1285 [inline] __se_sys_openat fs/open.c:1280 [inline] __arm64_sys_openat+0x120/0x154 fs/open.c:1280 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 1105758 hardirqs last enabled at (1105757): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (1105757): [] _raw_spin_unlock_irqrestore+0xa8/0x14c kernel/locking/spinlock.c:194 hardirqs last disabled at (1105758): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (1105714): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (1105712): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 5ca76294e75f186c ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4984 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 4984 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 4984 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 4984 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 4984 Comm: syz.0.47 Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000d894b680 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000def6f6b8 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010003 x17: 0000000000010003 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010002 x10: 0000000000010002 x9 : 8224243a10e5cb00 x8 : 8224243a10e5cb00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 zap_pte_range mm/memory.c:1379 [inline] zap_pmd_range mm/memory.c:1505 [inline] zap_pud_range mm/memory.c:1534 [inline] zap_p4d_range mm/memory.c:1555 [inline] unmap_page_range+0x9f8/0x1958 mm/memory.c:1576 unmap_single_vma+0x13c/0x1e4 mm/memory.c:1621 unmap_vmas+0x104/0x200 mm/memory.c:1653 exit_mmap+0x2a8/0x4e0 mm/mmap.c:3212 __mmput+0xec/0x3b8 kernel/fork.c:1127 mmput+0x80/0xc8 kernel/fork.c:1148 exit_mm+0x4a0/0x684 kernel/exit.c:550 do_exit+0x4ec/0x1f58 kernel/exit.c:870 do_group_exit+0x100/0x268 kernel/exit.c:997 get_signal+0x73c/0x1340 kernel/signal.c:2900 do_signal arch/arm64/kernel/signal.c:893 [inline] do_notify_resume+0x35c/0x3128 arch/arm64/kernel/signal.c:946 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 2100 hardirqs last enabled at (2099): [] lock_page_memcg+0x110/0x234 mm/memcontrol.c:2059 hardirqs last disabled at (2100): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (1252): [] softirq_handle_end kernel/softirq.c:419 [inline] softirqs last enabled at (1252): [] handle_softirqs+0xa4c/0xbf0 kernel/softirq.c:604 softirqs last disabled at (1237): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last disabled at (1237): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (1237): [] invoke_softirq kernel/softirq.c:457 [inline] softirqs last disabled at (1237): [] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659 ---[ end trace 5ca76294e75f1871 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 4645 Comm: syz-executor Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000c1bf9b40 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000def724e8 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010004 x17: 0000000000010004 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010003 x10: 0000000000010003 x9 : abd15cb6bd53e700 x8 : abd15cb6bd53e700 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010003 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:35 [inline] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] _raw_spin_unlock_irq+0xa0/0x128 kernel/locking/spinlock.c:202 spin_unlock_irq include/linux/spinlock.h:413 [inline] alloc_pid+0x2fc/0xa48 kernel/pid.c:236 copy_process+0x17a8/0x34ac kernel/fork.c:2306 kernel_clone+0x1d8/0x9d4 kernel/fork.c:2679 __do_sys_clone kernel/fork.c:2796 [inline] __se_sys_clone kernel/fork.c:2764 [inline] __arm64_sys_clone+0x138/0x190 kernel/fork.c:2764 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 289100 hardirqs last enabled at (289099): [] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline] hardirqs last enabled at (289099): [] _raw_spin_unlock_irq+0x98/0x128 kernel/locking/spinlock.c:202 hardirqs last disabled at (289100): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (288942): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (288940): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 5ca76294e75f1877 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 4645 Comm: syz-executor Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000c1bf9b40 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000def73060 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010203 x17: 0000000000010203 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010202 x10: 0000000000010202 x9 : abd15cb6bd53e700 x8 : abd15cb6bd53e700 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010202 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] lock_release+0x4a0/0x8e8 kernel/locking/lockdep.c:5646 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:174 [inline] _raw_spin_unlock_bh+0x90/0x174 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:408 [inline] lock_sock_nested+0x14c/0x1d4 net/core/sock.c:3258 lock_sock include/net/sock.h:1694 [inline] do_ip_getsockopt net/ipv4/ip_sockglue.c:1546 [inline] ip_getsockopt+0x310/0x158c net/ipv4/ip_sockglue.c:1780 tcp_getsockopt+0x214/0x2e74 net/ipv4/tcp.c:4313 sock_common_getsockopt+0xa8/0xc4 net/core/sock.c:3418 __sys_getsockopt+0x1e0/0x45c net/socket.c:2247 __do_sys_getsockopt net/socket.c:2262 [inline] __se_sys_getsockopt net/socket.c:2259 [inline] __arm64_sys_getsockopt+0xb8/0xd4 net/socket.c:2259 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 307607 hardirqs last enabled at (307605): [] local_daif_restore arch/arm64/include/asm/daifflags.h:75 [inline] hardirqs last enabled at (307605): [] el0_svc_common+0x9c/0x258 arch/arm64/kernel/syscall.c:107 hardirqs last disabled at (307607): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (307600): [] spin_unlock_bh include/linux/spinlock.h:408 [inline] softirqs last enabled at (307600): [] release_sock+0x1d0/0x258 net/core/sock.c:3277 softirqs last disabled at (307606): [] spin_lock_bh include/linux/spinlock.h:368 [inline] softirqs last disabled at (307606): [] lock_sock_nested+0xf4/0x1d4 net/core/sock.c:3254 ---[ end trace 5ca76294e75f187d ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4151 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 4151 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 4151 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 4151 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 4151 Comm: kworker/1:11 Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: events free_work pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000c7dc0000 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000def737a0 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010003 x17: 0000000000010003 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010002 x10: 0000000000010002 x9 : 0b61943011c99d00 x8 : 0b61943011c99d00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0xb8/0x14c kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:982 [inline] debug_check_no_obj_freed+0x450/0x46c lib/debugobjects.c:1003 __vunmap+0x270/0x9bc mm/vmalloc.c:2607 free_work+0x7c/0xac mm/vmalloc.c:95 process_one_work+0x79c/0x1140 kernel/workqueue.c:2310 worker_thread+0x8f4/0x101c kernel/workqueue.c:2457 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 irq event stamp: 37254 hardirqs last enabled at (37253): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (37253): [] _raw_spin_unlock_irqrestore+0xa8/0x14c kernel/locking/spinlock.c:194 hardirqs last disabled at (37254): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (37218): [] spin_unlock_bh include/linux/spinlock.h:408 [inline] softirqs last enabled at (37218): [] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] softirqs last enabled at (37218): [] wg_packet_decrypt_worker+0x8f8/0x980 drivers/net/wireguard/receive.c:506 softirqs last disabled at (37216): [] spin_lock_bh include/linux/spinlock.h:368 [inline] softirqs last disabled at (37216): [] ptr_ring_consume_bh include/linux/ptr_ring.h:365 [inline] softirqs last disabled at (37216): [] wg_packet_decrypt_worker+0x5cc/0x980 drivers/net/wireguard/receive.c:506 ---[ end trace 5ca76294e75f187f ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 15 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 15 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 15 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 15 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 15 Comm: rcu_preempt Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000c0953680 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000def73b40 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010003 x17: 0000000000010003 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010002 x10: 0000000000010002 x9 : 284139ff26613000 x8 : 284139ff26613000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0xb8/0x14c kernel/locking/spinlock.c:194 debug_object_free+0x290/0x3e0 lib/debugobjects.c:851 destroy_timer_on_stack kernel/time/timer.c:759 [inline] schedule_timeout+0x198/0x2c8 kernel/time/timer.c:1918 rcu_gp_fqs_loop+0x25c/0x11f0 kernel/rcu/tree.c:1972 rcu_gp_kthread+0xc4/0x2a8 kernel/rcu/tree.c:2145 kthread+0x374/0x454 kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 irq event stamp: 136952 hardirqs last enabled at (136951): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (136951): [] _raw_spin_unlock_irqrestore+0xa8/0x14c kernel/locking/spinlock.c:194 hardirqs last disabled at (136952): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (102788): [] softirq_handle_end kernel/softirq.c:419 [inline] softirqs last enabled at (102788): [] handle_softirqs+0xa4c/0xbf0 kernel/softirq.c:604 softirqs last disabled at (102733): [] __do_softirq kernel/softirq.c:610 [inline] softirqs last disabled at (102733): [] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] softirqs last disabled at (102733): [] invoke_softirq kernel/softirq.c:457 [inline] softirqs last disabled at (102733): [] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659 ---[ end trace 5ca76294e75f1881 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 3652 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 3652 Comm: udevd Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000d6d13680 x27: 1fffe0003421c65b x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000000 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000def73ee0 x20: ffff0001a10e32d8 x19: ffff8000113daee0 x18: 0000000000010002 x17: 0000000000010002 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010001 x10: 0000000000010001 x9 : 00f5ffe6053fcd00 x8 : 00f5ffe6053fcd00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010001 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 __ll_sc_atomic_fetch_add_relaxed arch/arm64/include/asm/atomic_ll_sc.h:-1 [inline] arch_atomic_fetch_add_relaxed arch/arm64/include/asm/atomic.h:49 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:112 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] sock_hold include/net/sock.h:737 [inline] netlink_attachskb+0x0/0x828 net/netlink/af_netlink.c:1172 netlink_sendmsg+0x6e8/0x9cc net/netlink/af_netlink.c:1905 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] ____sys_sendmsg+0x61c/0x920 net/socket.c:2436 ___sys_sendmsg+0x1d0/0x240 net/socket.c:2490 __sys_sendmsg net/socket.c:2519 [inline] __do_sys_sendmsg net/socket.c:2528 [inline] __se_sys_sendmsg net/socket.c:2526 [inline] __arm64_sys_sendmsg+0x1a8/0x254 net/socket.c:2526 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 1178426 hardirqs last enabled at (1178425): [] local_daif_restore arch/arm64/include/asm/daifflags.h:75 [inline] hardirqs last enabled at (1178425): [] el0_svc_common+0x9c/0x258 arch/arm64/kernel/syscall.c:107 hardirqs last disabled at (1178426): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (1178400): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (1178398): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 5ca76294e75f1882 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 5029 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 5029 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 5029 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 5029 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 5029 Comm: syz.0.70 Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000ce58d1c0 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000dee9f7a0 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010002 x17: 0000000000010002 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010001 x10: 0000000000010001 x9 : 7e6e82a14cef8800 x8 : 7e6e82a14cef8800 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010001 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el0_interrupt+0x94/0x260 arch/arm64/kernel/entry-common.c:683 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:690 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:695 el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:585 irq event stamp: 1228 hardirqs last enabled at (1227): [] el0t_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:629 hardirqs last disabled at (1228): [] __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:690 softirqs last enabled at (54): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (52): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 5ca76294e75f1885 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 5034 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 5034 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 5034 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 5034 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 5034 Comm: syz.0.72 Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000cc8f0000 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000dee9fb40 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010003 x17: 0000000000010003 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010002 x10: 0000000000010002 x9 : c334d5e56efb9000 x8 : c334d5e56efb9000 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010002 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] lock_page_memcg+0x120/0x234 mm/memcontrol.c:2059 page_add_file_rmap+0x148/0x8e4 mm/rmap.c:1219 do_set_pte+0x394/0x4e0 mm/memory.c:4069 filemap_map_pages+0x9c4/0xc50 mm/filemap.c:3344 do_fault_around mm/memory.c:4243 [inline] do_read_fault mm/memory.c:4258 [inline] do_fault mm/memory.c:4392 [inline] handle_pte_fault mm/memory.c:4650 [inline] __handle_mm_fault mm/memory.c:4785 [inline] handle_mm_fault+0x19c0/0x2950 mm/memory.c:4883 __do_page_fault arch/arm64/mm/fault.c:505 [inline] do_page_fault+0x694/0xad4 arch/arm64/mm/fault.c:605 do_translation_fault+0xe0/0x130 arch/arm64/mm/fault.c:686 do_mem_abort+0x6c/0x1ac arch/arm64/mm/fault.c:819 el0_da+0x90/0x1fc arch/arm64/kernel/entry-common.c:494 el0t_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:629 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 106 hardirqs last enabled at (105): [] lock_page_memcg+0x110/0x234 mm/memcontrol.c:2059 hardirqs last disabled at (106): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (8): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:31 softirqs last disabled at (6): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:18 ---[ end trace 5ca76294e75f1887 ]--- ------------[ cut here ]------------ VFS: brelse: Trying to free free buffer WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline] WARNING: CPU: 1 PID: 4645 at fs/buffer.c:1148 invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 Modules linked in: CPU: 1 PID: 4645 Comm: syz-executor Tainted: G W 5.15.187-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __brelse fs/buffer.c:1148 [inline] pc : brelse include/linux/buffer_head.h:325 [inline] pc : __invalidate_bh_lrus fs/buffer.c:1394 [inline] pc : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 lr : __brelse fs/buffer.c:1148 [inline] lr : brelse include/linux/buffer_head.h:325 [inline] lr : __invalidate_bh_lrus fs/buffer.c:1394 [inline] lr : invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 sp : ffff800008017de0 x29: ffff800008017de0 x28: ffff0000c1bf9b40 x27: 1fffe0003421c65c x26: 0000000000000001 x25: ffff0001a10e32d8 x24: 0000000000000001 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000decc96b8 x20: ffff0001a10e32e0 x19: ffff8000113daee0 x18: 0000000000010002 x17: 0000000000010002 x16: ffff8000111d162c x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000001 x12: 0000000000ff0100 x11: 0000000000010001 x10: 0000000000010001 x9 : abd15cb6bd53e700 x8 : abd15cb6bd53e700 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000080176d8 x4 : ffff80001425f400 x3 : ffff8000085051a4 x2 : 0000000000000001 x1 : 0000000100010001 x0 : 0000000000000027 Call trace: __brelse fs/buffer.c:1148 [inline] brelse include/linux/buffer_head.h:325 [inline] __invalidate_bh_lrus fs/buffer.c:1394 [inline] invalidate_bh_lru+0x128/0x234 fs/buffer.c:1407 flush_smp_call_function_queue+0x38c/0x81c kernel/smp.c:628 generic_smp_call_function_single_interrupt+0x18/0x24 kernel/smp.c:544 do_handle_IPI arch/arm64/kernel/smp.c:904 [inline] ipi_handler+0x10c/0x710 arch/arm64/kernel/smp.c:950 handle_percpu_devid_irq+0x29c/0x76c kernel/irq/chip.c:930 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq_desc kernel/irq/irqdesc.c:652 [inline] handle_domain_irq+0x144/0x1fc kernel/irq/irqdesc.c:707 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x24/0x30 arch/arm64/kernel/entry.S:855 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline] consume_stock mm/memcontrol.c:2212 [inline] try_charge_memcg+0x1e8/0x11bc mm/memcontrol.c:2607 obj_cgroup_charge_pages+0x8c/0x1a0 mm/memcontrol.c:3018 __memcg_kmem_charge_page+0x3c0/0x59c mm/memcontrol.c:3058 memcg_kmem_charge_page include/linux/memcontrol.h:1696 [inline] memcg_charge_kernel_stack kernel/fork.c:417 [inline] dup_task_struct+0x828/0xc44 kernel/fork.c:903 copy_process+0x4c8/0x34ac kernel/fork.c:2121 kernel_clone+0x1d8/0x9d4 kernel/fork.c:2679 __do_sys_clone kernel/fork.c:2796 [inline] __se_sys_clone kernel/fork.c:2764 [inline] __arm64_sys_clone+0x138/0x190 kernel/fork.c:2764 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 irq event stamp: 355826 hardirqs last enabled at (355825): [] consume_stock mm/memcontrol.c:2212 [inline] hardirqs last enabled at (355825): [] try_charge_memcg+0x1d8/0x11bc mm/memcontrol.c:2607 hardirqs last disabled at (355826): [] enter_el1_irq_or_nmi+0x10/0x1c arch/arm64/kernel/entry-common.c:227 softirqs last enabled at (355746): [] spin_unlock_bh include/linux/spinlock.h:408 [inline] softirqs last enabled at (355746): [] release_sock+0x1d0/0x258 net/core/sock.c:3277 softirqs last disabled at (355744): [] spin_lock_bh include/linux/spinlock.h:368 [inline] softirqs last disabled at (355744): [] release_sock+0x34/0x258 net/core/sock.c:3264 ---[ end trace 5ca76294e75f188a ]---