------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff88807d715490 object type: timer_list hint: rose_t0timer_expiry+0x0/0x150 include/linux/skbuff.h:2927
WARNING: CPU: 0 PID: 11105 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Modules linked in:
CPU: 0 UID: 0 PID: 11105 Comm: kworker/0:2H Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events_highpri snd_vmidi_output_work
RIP: 0010:debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 41 56 48 8b 14 dd 20 fa f1 8b 4c 89 e6 48 c7 c7 a0 ee f1 8b e8 6f b2 c9 fc 90 <0f> 0b 90 90 58 83 05 56 eb d1 0b 01 48 83 c4 18 5b 5d 41 5c 41 5d
RSP: 0018:ffffc90000007a18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff817b5ee8
RDX: ffff88802d098000 RSI: ffffffff817b5ef5 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8bf1f540
R13: ffffffff8b901fe0 R14: ffffffff8a515ad0 R15: ffffc90000007b18
FS:  0000000000000000(0000) GS:ffff8881249da000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002000 CR3: 00000000760ba000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2454 [inline]
 slab_free mm/slub.c:6611 [inline]
 kfree+0x291/0x6d0 mm/slub.c:6818
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x53f/0x630 net/rose/rose_timer.c:183
 call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers+0x6ef/0x960 kernel/time/timer.c:2372
 __run_timer_base kernel/time/timer.c:2384 [inline]
 __run_timer_base kernel/time/timer.c:2376 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2393
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:121 [inline]
RIP: 0010:lock_release+0x60/0x2f0 kernel/locking/lockdep.c:5881
Code: 87 38 02 00 00 89 c0 48 0f a3 05 5b 63 ea 0e 0f 82 b1 01 00 00 8b 3d b3 93 ea 0e 85 ff 0f 84 25 01 00 00 65 8b 05 38 9f 0b 12 <85> c0 0f 85 16 01 00 00 65 4c 8b 35 78 5d 0b 12 41 8b b6 2c 0b 00
RSP: 0018:ffffc90003a0f900 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff88802fdea8b0 RCX: ffffffff89023d67
RDX: 0000000000000000 RSI: ffffffff8bf1e8c0 RDI: 0000000000000001
RBP: ffff88802fdea897 R08: 0000000000000007 R09: ffffffffffffefff
R10: ffff88802fdea897 R11: 0000000000000001 R12: ffffffff89023d7d
R13: ffff88802fdea888 R14: ffff88802fdea898 R15: 0000000000000001
 __raw_read_unlock include/linux/rwlock_api_smp.h:231 [inline]
 _raw_read_unlock+0x16/0x50 kernel/locking/spinlock.c:260
 class_read_lock_destructor include/linux/spinlock.h:593 [inline]
 snd_seq_port_use_ptr+0x14d/0x1b0 sound/core/seq/seq_ports.c:51
 _snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:618 [inline]
 snd_seq_deliver_single_event+0x188/0x7f0 sound/core/seq/seq_clientmgr.c:660
 __deliver_to_subscribers sound/core/seq/seq_clientmgr.c:707 [inline]
 deliver_to_subscribers sound/core/seq/seq_clientmgr.c:735 [inline]
 snd_seq_deliver_event+0x2c5/0x860 sound/core/seq/seq_clientmgr.c:785
 snd_seq_kernel_client_dispatch+0x120/0x1a0 sound/core/seq/seq_clientmgr.c:2407
 snd_vmidi_output_work+0x1d1/0x390 sound/core/seq/seq_virmidi.c:157
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	87 38                	xchg   %edi,(%rax)
   2:	02 00                	add    (%rax),%al
   4:	00 89 c0 48 0f a3    	add    %cl,-0x5cf0b740(%rcx)
   a:	05 5b 63 ea 0e       	add    $0xeea635b,%eax
   f:	0f 82 b1 01 00 00    	jb     0x1c6
  15:	8b 3d b3 93 ea 0e    	mov    0xeea93b3(%rip),%edi        # 0xeea93ce
  1b:	85 ff                	test   %edi,%edi
  1d:	0f 84 25 01 00 00    	je     0x148
  23:	65 8b 05 38 9f 0b 12 	mov    %gs:0x120b9f38(%rip),%eax        # 0x120b9f62
* 2a:	85 c0                	test   %eax,%eax <-- trapping instruction
  2c:	0f 85 16 01 00 00    	jne    0x148
  32:	65 4c 8b 35 78 5d 0b 	mov    %gs:0x120b5d78(%rip),%r14        # 0x120b5db2
  39:	12
  3a:	41                   	rex.B
  3b:	8b                   	.byte 0x8b
  3c:	b6 2c                	mov    $0x2c,%dh
  3e:	0b 00                	or     (%rax),%eax