------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff88805443ac90 object type: timer_list hint: rose_t0timer_expiry+0x0/0x350 net/rose/rose_link.c:-1
WARNING: CPU: 1 PID: 11847 at lib/debugobjects.c:615 debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 11847 Comm: syz.3.1523 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Code: 4c 89 ff e8 37 f9 8b fd 4d 8b 0f 48 c7 c7 80 7e c0 8b 48 8b 34 24 4c 89 ea 89 e9 4d 89 f0 41 54 e8 fa 77 e9 fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 77 06 05 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41
RSP: 0000:ffffc90000a08a00 EFLAGS: 00010296
RAX: a13b109db42bfe00 RBX: dffffc0000000000 RCX: ffff8880247f3c80
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bfa658 R12: ffffffff8a3e0c40
R13: ffffffff8bc08000 R14: ffff88805443ac90 R15: ffffffff8b6cf600
FS:  0000555566284500(0000) GS:ffff888125e0f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c34e141 CR3: 0000000028e64000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x3a2/0x470 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2446 [inline]
 slab_free mm/slub.c:6574 [inline]
 kfree+0x115/0x6d0 mm/slub.c:6781
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x4cb/0x600 net/rose/rose_timer.c:183
 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
 handle_softirqs+0x283/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_is_held_type+0x137/0x190 kernel/locking/lockdep.c:5945
Code: 01 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 4c 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 05 d9 c9 45 07 <48> 3b 44 24 08 75 43 89 d8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f
RSP: 0000:ffffc9001d50f8c8 EFLAGS: 00000206
RAX: a13b109db42bfe00 RBX: 0000000000000001 RCX: a13b109db42bfe00
RDX: ffff8880247f3c80 RSI: ffffffff8d9d15ab RDI: ffffffff8bc074e0
RBP: 00000000ffffffff R08: ffffea0000684ec7 R09: 1ffffd40000d09d8
R10: dffffc0000000000 R11: fffff940000d09d9 R12: 0000000000000246
R13: ffff8880247f3c80 R14: ffffffff8e13d320 R15: 0000000000000001
 xa_entry include/linux/xarray.h:1226 [inline]
 xas_next_entry+0x202/0x3d0 include/linux/xarray.h:1731
 next_uptodate_folio+0x32/0x5d0 mm/filemap.c:3639
 filemap_map_pages+0x11ea/0x1c60 mm/filemap.c:3856
 do_fault_around mm/memory.c:5656 [inline]
 do_read_fault mm/memory.c:5689 [inline]
 do_fault mm/memory.c:5832 [inline]
 do_pte_missing mm/memory.c:4361 [inline]
 handle_pte_fault mm/memory.c:6177 [inline]
 __handle_mm_fault+0x347e/0x5400 mm/memory.c:6318
 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6487
 do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f3f9a06f0cd
Code: ff 48 83 e8 01 48 89 ee bf 01 00 00 00 48 c1 e0 0e 48 c1 ee 06 48 01 c8 48 89 e9 81 e6 ff 3f 00 00 48 c1 e9 03 83 e1 07 d3 e7 <40> 84 bc 06 20 20 00 00 0f 85 11 fd ff ff e9 c0 fd ff ff e8 3b 2b
RSP: 002b:00007ffc36267040 EFLAGS: 00010202
RAX: 000000110c34c000 RBX: 00007f3f9af15720 RCX: 0000000000000007
RDX: 000000000000087e RSI: 0000000000000121 RDI: 0000000000000080
RBP: ffffffff81a0487e R08: 00007f3f9a3e6038 R09: 00007f3f9a3d2000
R10: 00007f3f99bff008 R11: 0000000000000005 R12: 0000000000000005
R13: 0000000000000000 R14: ffffffff81a04919 R15: 0000000000001cf1
 </TASK>
----------------
Code disassembly (best guess):
   0:	01 75 44             	add    %esi,0x44(%rbp)
   3:	48 c7 04 24 00 00 00 	movq   $0x0,(%rsp)
   a:	00
   b:	9c                   	pushf
   c:	8f 04 24             	pop    (%rsp)
   f:	f7 04 24 00 02 00 00 	testl  $0x200,(%rsp)
  16:	75 4c                	jne    0x64
  18:	41 f7 c4 00 02 00 00 	test   $0x200,%r12d
  1f:	74 01                	je     0x22
  21:	fb                   	sti
  22:	65 48 8b 05 d9 c9 45 	mov    %gs:0x745c9d9(%rip),%rax        # 0x745ca03
  29:	07
* 2a:	48 3b 44 24 08       	cmp    0x8(%rsp),%rax <-- trapping instruction
  2f:	75 43                	jne    0x74
  31:	89 d8                	mov    %ebx,%eax
  33:	48 83 c4 10          	add    $0x10,%rsp
  37:	5b                   	pop    %rbx
  38:	41 5c                	pop    %r12
  3a:	41 5d                	pop    %r13
  3c:	41 5e                	pop    %r14
  3e:	41 5f                	pop    %r15