------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff888056969890 object type: timer_list hint: rose_t0timer_expiry+0x0/0x150 include/linux/skbuff.h:2927
WARNING: CPU: 0 PID: 14912 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Modules linked in:
CPU: 0 UID: 0 PID: 14912 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 41 56 48 8b 14 dd 20 fb f1 8b 4c 89 e6 48 c7 c7 a0 ef f1 8b e8 4f 81 c7 fc 90 <0f> 0b 90 90 58 83 05 56 7d cf 0b 01 48 83 c4 18 5b 5d 41 5c 41 5d
RSP: 0018:ffffc90000007a18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff817b6ee8
RDX: ffff88803037c900 RSI: ffffffff817b6ef5 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffffffff8548 R12: ffffffff8bf1f640
R13: ffffffff8b901fe0 R14: ffffffff8a53ad30 R15: ffffc90000007b18
FS: 0000555566eac500(0000) GS:ffff8881249d6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f334cbe2060 CR3: 0000000040866000 CR4: 00000000003526f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
__debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129
slab_free_hook mm/slub.c:2454 [inline]
slab_free mm/slub.c:6611 [inline]
kfree+0x291/0x6d0 mm/slub.c:6818
rose_neigh_put include/net/rose.h:166 [inline]
rose_timer_expiry+0x53f/0x630 net/rose/rose_timer.c:183
call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers+0x6ef/0x960 kernel/time/timer.c:2372
__run_timer_base kernel/time/timer.c:2384 [inline]
__run_timer_base kernel/time/timer.c:2376 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2393
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:in_gate_area_no_mm+0x2f/0x70 arch/x86/entry/vsyscall/vsyscall_64.c:332
Code: 54 45 31 e4 55 53 48 89 fb e8 9d 02 91 00 8b 2d e7 4a ae 0c bf 02 00 00 00 89 ee e8 cb fd 90 00 83 fd 02 74 29 e8 81 02 91 00 <48> 81 e3 00 f0 ff ff 48 c7 c7 00 00 60 ff 45 31 e4 48 89 de e8 d8
RSP: 0018:ffffc90004cff388 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 00007f334c98ef03 RCX: ffffffff812c3625
RDX: ffff88803037c900 RSI: ffffffff812c362f RDI: 0000000000000005
RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000002
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: ffffc90004cff4a8 R14: 0000000000000000 R15: ffff88803037c900
is_kernel_text include/linux/kallsyms.h:31 [inline]
core_kernel_text kernel/extable.c:68 [inline]
kernel_text_address+0x35/0x100 kernel/extable.c:99
__kernel_text_address+0xd/0x40 kernel/extable.c:79
unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0xa6/0x100 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
kasan_save_track+0x14/0x30 mm/kasan/common.c:77
unpoison_slab_object mm/kasan/common.c:342 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:368
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4955 [inline]
slab_alloc_node mm/slub.c:5265 [inline]
kmem_cache_alloc_noprof+0x250/0x6e0 mm/slub.c:5272
vm_area_alloc+0x1f/0x160 mm/vma_init.c:32
__mmap_new_vma mm/vma.c:2461 [inline]
__mmap_region+0xf85/0x27a0 mm/vma.c:2670
mmap_region+0x32b/0x3f0 mm/vma.c:2740
do_mmap+0xa3e/0x1210 mm/mmap.c:558
vm_mmap_pgoff+0x29e/0x470 mm/util.c:581
ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:604
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f334c98ef03
Code: f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ca 41 f7 c1 ff 0f 00 00 75 14 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 25 c3 0f 1f 40 00 48 c7 c0 a8 ff ff ff 64 c7
RSP: 002b:00007ffc354f8708 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f334cbe2060 RCX: 00007f334c98ef03
RDX: 0000000000000001 RSI: 0000000002000000 RDI: 000000110c230000
RBP: 00007f334cbe2060 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffc354f8780
R13: 00007ffc354f8788 R14: 0000000000000009 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: 54 push %rsp
1: 45 31 e4 xor %r12d,%r12d
4: 55 push %rbp
5: 53 push %rbx
6: 48 89 fb mov %rdi,%rbx
9: e8 9d 02 91 00 call 0x9102ab
e: 8b 2d e7 4a ae 0c mov 0xcae4ae7(%rip),%ebp # 0xcae4afb
14: bf 02 00 00 00 mov $0x2,%edi
19: 89 ee mov %ebp,%esi
1b: e8 cb fd 90 00 call 0x90fdeb
20: 83 fd 02 cmp $0x2,%ebp
23: 74 29 je 0x4e
25: e8 81 02 91 00 call 0x9102ab
* 2a: 48 81 e3 00 f0 ff ff and $0xfffffffffffff000,%rbx <-- trapping instruction
31: 48 c7 c7 00 00 60 ff mov $0xffffffffff600000,%rdi
38: 45 31 e4 xor %r12d,%r12d
3b: 48 89 de mov %rbx,%rsi
3e: e8 .byte 0xe8
3f: d8 .byte 0xd8