------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff888056053890 object type: timer_list hint: rose_t0timer_expiry+0x0/0x150 include/linux/skbuff.h:2927
WARNING: CPU: 1 PID: 12 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: iou_exit io_ring_exit_work
RIP: 0010:debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 41 56 48 8b 14 dd a0 8a f0 8b 4c 89 e6 48 c7 c7 20 7f f0 8b e8 ff 7b d0 fc 90 <0f> 0b 90 90 58 83 05 f6 dd d7 0b 01 48 83 c4 18 5b 5d 41 5c 41 5d
RSP: 0018:ffffc90000a08a18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff817b1cd8
RDX: ffff88801d2a5ac0 RSI: ffffffff817b1ce5 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8bf085c0
R13: ffffffff8b9021e0 R14: ffffffff8a4bf300 R15: ffffc90000a08b18
FS:  0000000000000000(0000) GS:ffff888124b06000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000dc5000 CR3: 00000000767b0000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2474 [inline]
 slab_free mm/slub.c:6642 [inline]
 kfree+0x291/0x6d0 mm/slub.c:6849
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x53f/0x630 net/rose/rose_timer.c:183
 call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers+0x6ef/0x960 kernel/time/timer.c:2372
 __run_timer_base kernel/time/timer.c:2384 [inline]
 __run_timer_base kernel/time/timer.c:2376 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2393
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x19/0xc0 kernel/rcu/tree.c:751
Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 53 65 ff 05 b3 e7 ff 11 e8 9e 42 bd 09 48 c7 c3 a8 d2 a2 93 <89> c5 83 f8 07 0f 87 82 00 00 00 48 8d 3c ed e0 2e cd 8d 48 b8 00
RSP: 0018:ffffc900001175e0 EFLAGS: 00000296
RAX: 0000000000000001 RBX: ffffffff93a2d2a8 RCX: 00000000f251cc2a
RDX: ffffffff816bf3cd RSI: ffffffff8bf07940 RDI: ffffffff8bf07980
RBP: ffffc900001176b0 R08: 25a8901442f27bf1 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff81a7e2a0
R13: ffffc90000117668 R14: 0000000000000000 R15: ffff88801d2a5ac0
 rcu_read_lock include/linux/rcupdate.h:868 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1195 [inline]
 unwind_next_frame+0xa3b/0x20a0 arch/x86/kernel/unwind_orc.c:479
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:559
 slab_free_hook mm/slub.c:2504 [inline]
 slab_free mm/slub.c:6642 [inline]
 kmem_cache_free+0x15e/0x6c0 mm/slub.c:6752
 __io_req_caches_free+0x19e/0x5c0 io_uring/io_uring.c:2824
 io_req_caches_free io_uring/io_uring.c:2836 [inline]
 io_ring_exit_work+0x387/0x10f0 io_uring/io_uring.c:3034
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	90                   	nop
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	f3 0f 1e fa          	endbr64
  15:	55                   	push   %rbp
  16:	53                   	push   %rbx
  17:	65 ff 05 b3 e7 ff 11 	incl   %gs:0x11ffe7b3(%rip)        # 0x11ffe7d1
  1e:	e8 9e 42 bd 09       	call   0x9bd42c1
  23:	48 c7 c3 a8 d2 a2 93 	mov    $0xffffffff93a2d2a8,%rbx
* 2a:	89 c5                	mov    %eax,%ebp <-- trapping instruction
  2c:	83 f8 07             	cmp    $0x7,%eax
  2f:	0f 87 82 00 00 00    	ja     0xb7
  35:	48 8d 3c ed e0 2e cd 	lea    -0x7232d120(,%rbp,8),%rdi
  3c:	8d
  3d:	48                   	rex.W
  3e:	b8                   	.byte 0xb8