------------[ cut here ]------------
VFS: brelse: Trying to free free buffer
WARNING: CPU: 1 PID: 19 at fs/buffer.c:1229 __brelse fs/buffer.c:1229 [inline]
WARNING: CPU: 1 PID: 19 at fs/buffer.c:1229 brelse include/linux/buffer_head.h:324 [inline]
WARNING: CPU: 1 PID: 19 at fs/buffer.c:1229 __invalidate_bh_lrus fs/buffer.c:1498 [inline]
WARNING: CPU: 1 PID: 19 at fs/buffer.c:1229 invalidate_bh_lru+0x102/0x1b0 fs/buffer.c:1511
Modules linked in:
CPU: 1 UID: 0 PID: 19 Comm: rcu_exp_gp_kthr Not tainted 6.12.0-next-20241122-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__brelse fs/buffer.c:1229 [inline]
RIP: 0010:brelse include/linux/buffer_head.h:324 [inline]
RIP: 0010:__invalidate_bh_lrus fs/buffer.c:1498 [inline]
RIP: 0010:invalidate_bh_lru+0x102/0x1b0 fs/buffer.c:1511
Code: 44 ee da ff f0 ff 0b eb 25 e8 ba fa 6f ff 41 80 3c 2e 00 75 2a eb 30 e8 ac fa 6f ff 90 48 c7 c7 20 e1 18 8c e8 2f 99 30 ff 90 <0f> 0b 90 90 48 bd 00 00 00 00 00 fc ff df 41 80 3c 2e 00 74 08 4c
RSP: 0018:ffffc90000a18f30 EFLAGS: 00010046
RAX: 5dcbff9141adc100 RBX: ffff88807243c4e8 RCX: ffff88801ceabc00
RDX: 0000000000010000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff81601b32 R09: 1ffff110170e519a
R10: dffffc0000000000 R11: ffffed10170e519b R12: ffff8880b8739838
R13: 0000000000000008 R14: 1ffff110170e7308 R15: ffff8880b8739840
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555580ee3738 CR3: 000000000e736000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 csd_do_func kernel/smp.c:134 [inline]
 __flush_smp_call_function_queue+0x3fc/0x1690 kernel/smp.c:540
 __sysvec_call_function_single+0xb8/0x430 arch/x86/kernel/smp.c:271
 instr_sysvec_call_function_single arch/x86/kernel/smp.c:266 [inline]
 sysvec_call_function_single+0x9e/0xc0 arch/x86/kernel/smp.c:266
 </IRQ>
 <TASK>
 asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:709
RIP: 0010:finish_task_switch+0x1ea/0x870 kernel/sched/core.c:5243
Code: c9 50 e8 79 07 0c 00 48 83 c4 08 4c 89 f7 e8 9d 39 00 00 0f 1f 44 00 00 4c 89 f7 e8 90 6d 5c 0a e8 cb 9f 38 00 fb 48 8b 5d c0 <48> 8d bb f8 15 00 00 48 89 f8 48 c1 e8 03 49 be 00 00 00 00 00 fc
RSP: 0018:ffffc90000187b68 EFLAGS: 00000286
RAX: 5dcbff9141adc100 RBX: ffff88801ceabc00 RCX: ffffffff9a391903
RDX: dffffc0000000000 RSI: ffffffff8c0a9640 RDI: ffffffff8c5e88a0
RBP: ffffc90000187bb0 R08: ffffffff90185f37 R09: 1ffffffff2030be6
R10: dffffc0000000000 R11: fffffbfff2030be7 R12: 1ffff110170e7edc
R13: dffffc0000000000 R14: ffff8880b873e8c0 R15: ffff8880b873f6e0
 context_switch kernel/sched/core.c:5372 [inline]
 __schedule+0x1858/0x4c30 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 kthread_worker_fn+0x486/0xb70 kernel/kthread.c:851
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	c9                   	leave
   1:	50                   	push   %rax
   2:	e8 79 07 0c 00       	call   0xc0780
   7:	48 83 c4 08          	add    $0x8,%rsp
   b:	4c 89 f7             	mov    %r14,%rdi
   e:	e8 9d 39 00 00       	call   0x39b0
  13:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  18:	4c 89 f7             	mov    %r14,%rdi
  1b:	e8 90 6d 5c 0a       	call   0xa5c6db0
  20:	e8 cb 9f 38 00       	call   0x389ff0
  25:	fb                   	sti
  26:	48 8b 5d c0          	mov    -0x40(%rbp),%rbx
* 2a:	48 8d bb f8 15 00 00 	lea    0x15f8(%rbx),%rdi <-- trapping instruction
  31:	48 89 f8             	mov    %rdi,%rax
  34:	48 c1 e8 03          	shr    $0x3,%rax
  38:	49                   	rex.WB
  39:	be 00 00 00 00       	mov    $0x0,%esi
  3e:	00 fc                	add    %bh,%ah