------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 4209 at fs/buffer.c:1148 __brelse fs/buffer.c:1148 [inline]
WARNING: CPU: 0 PID: 4209 at fs/buffer.c:1148 brelse include/linux/buffer_head.h:325 [inline]
WARNING: CPU: 0 PID: 4209 at fs/buffer.c:1148 __invalidate_bh_lrus fs/buffer.c:1394 [inline]
WARNING: CPU: 0 PID: 4209 at fs/buffer.c:1148 invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Modules linked in:
CPU: 0 PID: 4209 Comm: kworker/u4:5 Not tainted 5.15.186-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: netns cleanup_net
RIP: 0010:__brelse fs/buffer.c:1148 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:325 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1394 [inline]
RIP: 0010:invalidate_bh_lru+0xf8/0x1a0 fs/buffer.c:1407
Code: 00 e8 4c 55 e6 ff f0 41 ff 0e eb 20 e8 a1 da a0 ff 80 3c 2b 00 75 25 eb 2b e8 94 da a0 ff 48 c7 c7 20 51 17 8a e8 68 ef bf 07 <0f> 0b 48 bd 00 00 00 00 00 fc ff df 80 3c 2b 00 74 08 4c 89 ff e8
RSP: 0018:ffffc90000007f60 EFLAGS: 00010046
RAX: 3e0c53a454f54400 RBX: 1ffff11017206ca7 RCX: ffff888021c0bb80
RDX: 0000000000010000 RSI: 0000000080010001 RDI: 0000000000000000
RBP: 0000000000000000 R08: dffffc0000000000 R09: fffff52000000f51
R10: fffff52000000f51 R11: 1ffff92000000f50 R12: ffff8880b9036538
R13: 0000000000000000 R14: ffff8880713297a0 R15: ffff8880b9036538
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f869570c432 CR3: 000000007e148000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 flush_smp_call_function_queue+0x2a9/0x760 kernel/smp.c:628
 __sysvec_call_function_single+0x98/0x240 arch/x86/kernel/smp.c:248
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:243 [inline]
 sysvec_call_function_single+0x98/0xc0 arch/x86/kernel/smp.c:243
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x16/0x20 arch/x86/include/asm/idtentry.h:684
RIP: 0010:lock_release+0x584/0x870 kernel/locking/lockdep.c:5647
Code: 00 00 00 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 75 75 f7 44 24 50 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 2f 00 00 00 00 66 43 c7 44 2f 09 00 00 43 c6 44 2f 0b 00
RSP: 0018:ffffc90002fbf920 EFLAGS: 00000206
RAX: 0000000000000001 RBX: ad25f0b32bb3d951 RCX: 3e0c53a454f54400
RDX: 0000000000000003 RSI: ffffffff8a0b2460 RDI: ffffffff8a59a900
RBP: ffffc90002fbfa30 R08: dffffc0000000000 R09: fffffbfff1ad1586
R10: fffffbfff1ad1586 R11: 1ffffffff1ad1585 R12: ffff888021c0c6e8
R13: dffffc0000000000 R14: ffff888021c0c660 R15: 1ffff920005f7f30
 rcu_read_unlock include/linux/rcupdate.h:772 [inline]
 inet_twsk_purge+0x77d/0x810 net/ipv4/inet_timewait_sock.c:309
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x77b/0xb80 net/core/net_namespace.c:635
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	9c                   	pushf
   5:	8f 84 24 80 00 00 00 	pop    0x80(%rsp)
   c:	f6 84 24 81 00 00 00 	testb  $0x2,0x81(%rsp)
  13:	02
  14:	75 75                	jne    0x8b
  16:	f7 44 24 50 00 02 00 	testl  $0x200,0x50(%rsp)
  1d:	00
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	48 c7 44 24 60 0e 36 	movq   $0x45e0360e,0x60(%rsp)
  28:	e0 45
* 2a:	4b c7 04 2f 00 00 00 	movq   $0x0,(%r15,%r13,1) <-- trapping instruction
  31:	00
  32:	66 43 c7 44 2f 09 00 	movw   $0x0,0x9(%r15,%r13,1)
  39:	00
  3a:	43 c6 44 2f 0b 00    	movb   $0x0,0xb(%r15,%r13,1)