------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff888057091090 object type: timer_list hint: rose_t0timer_expiry+0x0/0x150 include/linux/skbuff.h:2927
WARNING: lib/debugobjects.c:612 at debug_print_object+0x18e/0x2a0 lib/debugobjects.c:612, CPU#0: syz.1.4619/24974
Modules linked in:
CPU: 0 UID: 0 PID: 24974 Comm: syz.1.4619 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
RIP: 0010:debug_print_object+0x19b/0x2a0 lib/debugobjects.c:612
Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d 12 12 d2 0b 41 56 48 8b 14 dd 60 46 fa 8b 4c 89 e6 <67> 48 0f b9 3a 58 83 05 7c f9 c7 0b 01 48 83 c4 18 5b 5d 41 5c 41
RSP: 0018:ffffc90000007a18 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffffffff8bfa45a0 RSI: ffffffff8bfa41c0 RDI: ffffffff90c17f00
RBP: 0000000000000001 R08: ffff888057091090 R09: ffffffff8b92b900
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8bfa41c0
R13: ffffffff8b92b940 R14: ffffffff8a660700 R15: ffffc90000007b18
FS: 0000000000000000(0000) GS:ffff8881245dc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc5e03eaff8 CR3: 000000000e392000 CR4: 00000000003526f0
Call Trace:
__debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
debug_check_no_obj_freed+0x4da/0x630 lib/debugobjects.c:1129
slab_free_hook mm/slub.c:2471 [inline]
slab_free mm/slub.c:6670 [inline]
kfree+0x34c/0x690 mm/slub.c:6878
rose_neigh_put include/net/rose.h:166 [inline]
rose_timer_expiry+0x53f/0x630 net/rose/rose_timer.c:183
call_timer_fn+0x19a/0x590 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers+0x757/0xac0 kernel/time/timer.c:2373
__run_timer_base kernel/time/timer.c:2385 [inline]
__run_timer_base kernel/time/timer.c:2377 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2394
run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2404
handle_softirqs+0x1ea/0x910 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xef/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline]
RIP: 0010:lock_release kernel/locking/lockdep.c:5885 [inline]
RIP: 0010:lock_release+0x8b/0x2e0 kernel/locking/lockdep.c:5875
Code: 39 01 00 00 65 4c 8b 25 fb 16 01 12 41 8b bc 24 2c 0b 00 00 85 ff 0f 85 21 01 00 00 48 81 3b 00 16 eb 93 0f 84 14 01 00 00 9c <41> 5e fa 48 c7 c7 3a 52 d3 8d e8 06 84 93 09 65 ff 05 f7 5d 01 12
RSP: 0018:ffffc90003dcf1a0 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffffffff8e5e3360 RCX: ffffffff9159b401
RDX: 0000000000000000 RSI: ffffffff8bfa3420 RDI: 0000000000000000
RBP: ffffffff81b6a38e R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 000000000000f1ac R12: ffff888085328000
R13: ffffc90003dcf260 R14: ffffc90003dcf390 R15: ffffc90003dcf294
rcu_lock_release include/linux/rcupdate.h:341 [inline]
rcu_read_unlock include/linux/rcupdate.h:897 [inline]
class_rcu_destructor include/linux/rcupdate.h:1195 [inline]
unwind_next_frame+0x3c3/0x1ea0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x162/0x1e0 mm/page_owner.c:165
__reset_page_owner+0x84/0x190 mm/page_owner.c:320
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
free_unref_folios+0xb2a/0x1760 mm/page_alloc.c:3030
folios_put_refs+0x53c/0x840 mm/swap.c:1002
free_pages_and_swap_cache+0x242/0x480 mm/swap_state.c:355
__tlb_batch_free_encoded_pages+0xe9/0x280 mm/mmu_gather.c:137
tlb_batch_pages_flush mm/mmu_gather.c:150 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
tlb_flush_mmu mm/mmu_gather.c:405 [inline]
tlb_finish_mmu+0x1b0/0x810 mm/mmu_gather.c:530
exit_mmap+0x3c5/0xae0 mm/mmap.c:1290
__mmput+0x12a/0x410 kernel/fork.c:1173
mmput+0x67/0x80 kernel/fork.c:1196
exit_mm kernel/exit.c:581 [inline]
do_exit+0x78a/0x2a30 kernel/exit.c:959
do_group_exit+0xd5/0x2a0 kernel/exit.c:1112
get_signal+0x1ec7/0x21e0 kernel/signal.c:3034
arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x86/0x4b0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4fe/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4b71f9acb9
Code: Unable to access opcode bytes at 0x7f4b71f9ac8f.
RSP: 002b:00007f4b72e22028 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f4b72215fa0 RCX: 00007f4b71f9acb9
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000000
RBP: 00007f4b72008bf7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4b72216038 R14: 00007f4b72215fa0 R15: 00007ffc6280d138
----------------
Code disassembly (best guess):
0: b8 00 00 00 00 mov $0x0,%eax
5: 00 fc add %bh,%ah
7: ff lcall (bad)
8: df 48 89 fisttps -0x77(%rax)
b: fa cli
c: 48 c1 ea 03 shr $0x3,%rdx
10: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
14: 75 4f jne 0x65
16: 48 8d 3d 12 12 d2 0b lea 0xbd21212(%rip),%rdi # 0xbd2122f
1d: 41 56 push %r14
1f: 48 8b 14 dd 60 46 fa mov -0x7405b9a0(,%rbx,8),%rdx
26: 8b
27: 4c 89 e6 mov %r12,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 58 pop %rax
30: 83 05 7c f9 c7 0b 01 addl $0x1,0xbc7f97c(%rip) # 0xbc7f9b3
37: 48 83 c4 18 add $0x18,%rsp
3b: 5b pop %rbx
3c: 5d pop %rbp
3d: 41 5c pop %r12
3f: 41 rex.B