------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 0 PID: 5477 at fs/buffer.c:1235 __brelse fs/buffer.c:1235 [inline]
WARNING: CPU: 0 PID: 5477 at fs/buffer.c:1235 brelse include/linux/buffer_head.h:312 [inline]
WARNING: CPU: 0 PID: 5477 at fs/buffer.c:1235 __invalidate_bh_lrus fs/buffer.c:1487 [inline]
WARNING: CPU: 0 PID: 5477 at fs/buffer.c:1235 invalidate_bh_lru+0x102/0x1b0 fs/buffer.c:1500
Modules linked in:
CPU: 0 PID: 5477 Comm: sed Not tainted 6.7.0-rc7-syzkaller-gfbafc3e621c3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
RIP: 0010:__brelse fs/buffer.c:1235 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:312 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1487 [inline]
RIP: 0010:invalidate_bh_lru+0x102/0x1b0 fs/buffer.c:1500
Code: 14 41 df ff f0 ff 0b eb 25 e8 1a 3a 83 ff 41 80 3c 2e 00 75 2a eb 30 e8 0c 3a 83 ff 90 48 c7 c7 40 3e 78 8b e8 2f 2a 49 ff 90 <0f> 0b 90 90 48 bd 00 00 00 00 00 fc ff df 41 80 3c 2e 00 74 08 4c
RSP: 0000:ffffc90000007f30 EFLAGS: 00010046
RAX: d80a619c40cf3200 RBX: ffff888076bf7148 RCX: ffff888029709dc0
RDX: 0000000080010002 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff81546d22 R09: 1ffff11017305172
R10: dffffc0000000000 R11: ffffed1017305173 R12: ffff8880b9837f78
R13: 0000000000000008 R14: 1ffff11017306ff0 R15: ffff8880b9837f80
FS: 00007fcdffa00380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcdffba5dd0 CR3: 000000001f8ed000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
csd_do_func kernel/smp.c:133 [inline]
__flush_smp_call_function_queue+0x3e8/0x15a0 kernel/smp.c:511
__sysvec_call_function_single+0xa8/0x3e0 arch/x86/kernel/smp.c:267
sysvec_call_function_single+0x8f/0xb0 arch/x86/kernel/smp.c:262
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:656
RIP: 0010:percpu_counter_add_batch+0x29b/0x2e0 lib/percpu_counter.c:103
Code: 4d 85 e4 75 16 e8 95 cc d3 fc eb 15 e8 8e cc d3 fc e8 49 f0 5c 06 4d 85 e4 74 ea e8 7f cc d3 fc fb 48 c7 44 24 40 0e 36 e0 45 <48> 8b 44 24 38 49 c7 04 07 00 00 00 00 66 41 c7 44 07 09 00 00 41
RSP: 0000:ffffc90004f17740 EFLAGS: 00000293
RAX: ffffffff84baade1 RBX: 0000000000000000 RCX: ffff888029709dc0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004f17830 R08: ffffffff84baadb7 R09: 1ffffffff21bae6c
R10: dffffc0000000000 R11: fffffbfff21bae6d R12: 0000000000000200
R13: 1ffff110026e91cd R14: 0000000000000046 R15: dffffc0000000000
percpu_counter_add include/linux/percpu_counter.h:71 [inline]
add_mm_counter include/linux/mm.h:2567 [inline]
set_pte_range+0x3f4/0x8b0 mm/memory.c:4417
filemap_map_order0_folio mm/filemap.c:3501 [inline]
filemap_map_pages+0xee2/0x1820 mm/filemap.c:3547
do_fault_around mm/memory.c:4587 [inline]
do_read_fault mm/memory.c:4620 [inline]
do_fault mm/memory.c:4763 [inline]
do_pte_missing mm/memory.c:3731 [inline]
handle_pte_fault mm/memory.c:5039 [inline]
__handle_mm_fault mm/memory.c:5180 [inline]
handle_mm_fault+0x4b12/0x6680 mm/memory.c:5345
do_user_addr_fault arch/x86/mm/fault.c:1364 [inline]
handle_page_fault arch/x86/mm/fault.c:1505 [inline]
exc_page_fault+0x456/0x870 arch/x86/mm/fault.c:1561
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
RIP: 0033:0x7fcdffba5dd0
Code: 4c 89 c0 0f 01 d6 74 04 c5 fc 77 c3 c5 f8 77 c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f bc c0 48 39 c6 0f 42 c6 eb dd 0f 1f 40 00 <66> 0f 6e fe 89 f8 c4 e2 7d 78 ff c5 f9 ef c0 c1 e0 14 3d 00 00 00
RSP: 002b:00007fffc3913da8 EFLAGS: 00010202
RAX: 00007fcdffc371a0 RBX: 00007fffc3913e58 RCX: 00007fffc3913e80
RDX: 00007fffc3913e80 RSI: 000000000000002f RDI: 00007fffc3914e32
RBP: 00007fffc3914e32 R08: 0000000000000000 R09: 000000000000000d
R10: 00007fffc3913a90 R11: 0000000000000246 R12: 0000000000000004
R13: 00007fffc3913e58 R14: 00007fffc3913e80 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 4d 85 e4 test %r12,%r12
3: 75 16 jne 0x1b
5: e8 95 cc d3 fc call 0xfcd3cc9f
a: eb 15 jmp 0x21
c: e8 8e cc d3 fc call 0xfcd3cc9f
11: e8 49 f0 5c 06 call 0x65cf05f
16: 4d 85 e4 test %r12,%r12
19: 74 ea je 0x5
1b: e8 7f cc d3 fc call 0xfcd3cc9f
20: fb sti
21: 48 c7 44 24 40 0e 36 movq $0x45e0360e,0x40(%rsp)
28: e0 45
* 2a: 48 8b 44 24 38 mov 0x38(%rsp),%rax <-- trapping instruction
2f: 49 c7 04 07 00 00 00 movq $0x0,(%r15,%rax,1)
36: 00
37: 66 41 c7 44 07 09 00 movw $0x0,0x9(%r15,%rax,1)
3e: 00
3f: 41 rex.B