------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff88805becf890 object type: timer_list hint: rose_t0timer_expiry+0x0/0x350
WARNING: CPU: 0 PID: 9118 at lib/debugobjects.c:518 debug_print_object lib/debugobjects.c:515 [inline]
WARNING: CPU: 0 PID: 9118 at lib/debugobjects.c:518 __debug_check_no_obj_freed lib/debugobjects.c:990 [inline]
WARNING: CPU: 0 PID: 9118 at lib/debugobjects.c:518 debug_check_no_obj_freed+0x446/0x540 lib/debugobjects.c:1020
Modules linked in:
CPU: 0 PID: 9118 Comm: syz.4.652 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:debug_print_object lib/debugobjects.c:515 [inline]
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:990 [inline]
RIP: 0010:debug_check_no_obj_freed+0x446/0x540 lib/debugobjects.c:1020
Code: 4c 8b 4d 00 48 c7 c7 60 93 1c 8b 48 c7 c6 c0 8f 1c 8b 48 c7 c2 e0 94 1c 8b 8b 0c 24 4d 89 f8 41 55 e8 8e 91 1f fd 48 83 c4 08 <0f> 0b 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc ff df ff 05 b3 f0 59
RSP: 0000:ffffc90000007a50 EFLAGS: 00010296
RAX: fae0537b21ad0d00 RBX: ffffffff974adf80 RCX: ffff88802a7fda00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffffff8accac00 R08: ffffc90000007647 R09: 1ffff92000000ec8
R10: dffffc0000000000 R11: fffff52000000ec9 R12: ffff88805becfa00
R13: ffffffff897ac5a0 R14: ffff88805becf000 R15: ffff88805becf890
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe732c9cf40 CR3: 000000007e668000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 slab_free_hook mm/slub.c:1786 [inline]
 slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1e0 mm/slub.c:3843
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x4c6/0x5f0 net/rose/rose_timer.c:183
 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x542/0x800 kernel/time/timer.c:2023
 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:check_region_inline mm/kasan/generic.c:169 [inline]
RIP: 0010:kasan_check_range+0x12/0x290 mm/kasan/generic.c:187
Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b4 01 00 00 55 41 57 <41> 56 41 55 41 54 53 4c 8d 04 37 49 39 f8 0f 82 13 02 00 00 49 89
RSP: 0000:ffffc90004b1e868 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81682ab7
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e8b02a8
RBP: ffffc90004b1e988 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000963d24 R12: 1ffff92000963d1c
R13: ffff8880b8e41ed8 R14: 0000000000000000 R15: dffffc0000000000
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 cpumask_test_cpu include/linux/cpumask.h:504 [inline]
 cpu_online include/linux/cpumask.h:1082 [inline]
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0xb7/0x420 kernel/locking/lockdep.c:5725
 __raw_spin_trylock include/linux/spinlock_api_smp.h:90 [inline]
 _raw_spin_trylock+0x47/0x80 kernel/locking/spinlock.c:138
 spin_trylock include/linux/spinlock.h:361 [inline]
 rmqueue_pcplist mm/page_alloc.c:2780 [inline]
 rmqueue mm/page_alloc.c:2830 [inline]
 get_page_from_freelist+0x44f/0x19e0 mm/page_alloc.c:3217
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4500
 __folio_alloc+0x10/0x20 mm/page_alloc.c:4532
 vma_alloc_folio+0x47a/0x8f0 mm/mempolicy.c:2240
 shmem_alloc_folio+0x1a9/0x2a0 mm/shmem.c:1679
 shmem_alloc_and_acct_folio+0x1e6/0x6d0 mm/shmem.c:1704
 shmem_get_folio_gfp+0xcde/0x2aa0 mm/shmem.c:2041
 shmem_get_folio mm/shmem.c:2164 [inline]
 shmem_write_begin+0xf2/0x420 mm/shmem.c:2706
 generic_perform_write+0x2fe/0x5c0 mm/filemap.c:4031
 shmem_file_write_iter+0xfb/0x120 mm/shmem.c:2883
 __kernel_write_iter+0x28c/0x690 fs/read_write.c:517
 dump_emit_page fs/coredump.c:957 [inline]
 dump_user_range+0x420/0x860 fs/coredump.c:984
 elf_core_dump+0x31d0/0x3770 fs/binfmt_elf.c:2184
 do_coredump+0x17cc/0x24d0 fs/coredump.c:833
 get_signal+0x1133/0x13f0 kernel/signal.c:2888
 arch_do_signal_or_restart+0xc2/0x800 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:315
 exc_page_fault+0x8c/0x100 arch/x86/mm/fault.c:1519
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7fe731c527e7
Code: e8 8e fa ff ff 89 f2 48 8d 3d 9d 40 1b 00 48 8d 35 7c fa 1d 00 31 c0 e8 e7 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8
RSP: 002b:00007fe732c9d120 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007fe731d9c819
RDX: 00007fe732c9d140 RSI: 00007fe732c9d270 RDI: 000000000000000b
RBP: 00007fe731e32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fe732016308 R14: 00007fe732016270 R15: 00007ffd2d76cfa8
 </TASK>
----------------
Code disassembly (best guess):
   0:	0f 0b                	ud2
   2:	b8 ea ff ff ff       	mov    $0xffffffea,%eax
   7:	c3                   	ret
   8:	0f 0b                	ud2
   a:	b8 ea ff ff ff       	mov    $0xffffffea,%eax
   f:	c3                   	ret
  10:	cc                   	int3
  11:	cc                   	int3
  12:	cc                   	int3
  13:	cc                   	int3
  14:	cc                   	int3
  15:	cc                   	int3
  16:	cc                   	int3
  17:	cc                   	int3
  18:	66 0f 1f 00          	nopw   (%rax)
  1c:	b0 01                	mov    $0x1,%al
  1e:	48 85 f6             	test   %rsi,%rsi
  21:	0f 84 b4 01 00 00    	je     0x1db
  27:	55                   	push   %rbp
  28:	41 57                	push   %r15
* 2a:	41 56                	push   %r14 <-- trapping instruction
  2c:	41 55                	push   %r13
  2e:	41 54                	push   %r12
  30:	53                   	push   %rbx
  31:	4c 8d 04 37          	lea    (%rdi,%rsi,1),%r8
  35:	49 39 f8             	cmp    %rdi,%r8
  38:	0f 82 13 02 00 00    	jb     0x251
  3e:	49                   	rex.WB
  3f:	89                   	.byte 0x89