------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 154 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline]
WARNING: CPU: 0 PID: 154 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline]
WARNING: CPU: 0 PID: 154 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline]
WARNING: CPU: 0 PID: 154 at fs/buffer.c:1148 invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Modules linked in:
CPU: 0 PID: 154 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: netns cleanup_net
RIP: 0010:__brelse fs/buffer.c:1148 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:325 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1394 [inline]
RIP: 0010:invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Code: 00 e8 bc 04 e6 ff f0 41 ff 0e eb 20 e8 31 f7 a0 ff 80 3c 2b 00 75 25 eb 2b e8 24 f7 a0 ff 48 c7 c7 60 5a 37 8a e8 38 0e d9 07 <0f> 0b 48 bd 00 00 00 00 00 fc ff df 80 3c 2b 00 74 08 4c 89 ff e8
RSP: 0018:ffffc90000007f60 EFLAGS: 00010046
RAX: c0b7a0d049fb2c00 RBX: 1ffff11017206cb0 RCX: ffff88801bdf0000
RDX: 0000000000010000 RSI: 0000000080010001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff8880b902795b R09: 1ffff11017204f2b
R10: dffffc0000000000 R11: ffffed1017204f2c R12: ffff8880b9036578
R13: 0000000000000008 R14: ffff888071bc6df8 R15: ffff8880b9036580
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe1d5e74000 CR3: 000000002a8f2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
flush_smp_call_function_queue+0x2a9/0x760 kernel/smp.c:628
__sysvec_call_function_single+0x98/0x240 arch/x86/kernel/smp.c:248
instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:lock_is_held_type+0x13a/0x190 kernel/locking/lockdep.c:5671
Code: 75 40 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 46 41 f7 c5 00 02 00 00 74 01 fb 65 48 8b 04 25 28 00 00 00 <48> 3b 44 24 08 75 3c 89 e8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffffc90001f078d8 EFLAGS: 00000206
RAX: c0b7a0d049fb2c00 RBX: ffff88801bdf0000 RCX: c0b7a0d049fb2c00
RDX: 0000000000000000 RSI: ffffffff8a2b3a20 RDI: ffffffff8a79f800
RBP: 0000000000000000 R08: ffffffff8d89dc2f R09: 1ffffffff1b13b85
R10: dffffc0000000000 R11: fffffbfff1b13b86 R12: 0000000000000003
R13: 0000000000000246 R14: ffffffff8c31eb00 R15: ffff88801bdf0b68
lock_is_held include/linux/lockdep.h:287 [inline]
___might_sleep+0x9b/0x610 kernel/sched/core.c:9624
inet_twsk_purge+0x10a/0x840 net/ipv4/inet_timewait_sock.c:267
ops_exit_list net/core/net_namespace.c:177 [inline]
cleanup_net+0x791/0xba0 net/core/net_namespace.c:635
process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess):
0: 75 40 jne 0x42
2: 48 c7 04 24 00 00 00 movq $0x0,(%rsp)
9: 00
a: 9c pushf
b: 8f 04 24 pop (%rsp)
e: f7 04 24 00 02 00 00 testl $0x200,(%rsp)
15: 75 46 jne 0x5d
17: 41 f7 c5 00 02 00 00 test $0x200,%r13d
1e: 74 01 je 0x21
20: fb sti
21: 65 48 8b 04 25 28 00 mov %gs:0x28,%rax
28: 00 00
* 2a: 48 3b 44 24 08 cmp 0x8(%rsp),%rax <-- trapping instruction
2f: 75 3c jne 0x6d
31: 89 e8 mov %ebp,%eax
33: 48 83 c4 10 add $0x10,%rsp
37: 5b pop %rbx
38: 41 5c pop %r12
3a: 41 5d pop %r13
3c: 41 5e pop %r14
3e: 41 5f pop %r15