------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff888044019890 object type: timer_list hint: rose_t0timer_expiry+0x0/0x150 include/linux/skbuff.h:2927
WARNING: CPU: 3 PID: 3328 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Modules linked in:
CPU: 3 UID: 0 PID: 3328 Comm: syz.0.27299 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 41 56 48 8b 14 dd a0 81 f0 8b 4c 89 e6 48 c7 c7 20 76 f0 8b e8 bf b3 ce fc 90 <0f> 0b 90 90 58 83 05 d6 da d5 0b 01 48 83 c4 18 5b 5d 41 5c 41 5d
RSP: 0018:ffffc900006f8a18 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff817b1cd8
RDX: ffff88802490c900 RSI: ffffffff817b1ce5 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8bf07cc0
R13: ffffffff8b9021e0 R14: ffffffff8a4da210 R15: ffffc900006f8b18
FS:  00007fc2e90376c0(0000) GS:ffff8880d6d06000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000003c00 CR3: 000000002daee000 CR4: 0000000000352ef0
DR0: 0000000000000008 DR1: 0000000000000002 DR2: 0000000000000081
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x4b7/0x600 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2474 [inline]
 slab_free mm/slub.c:6642 [inline]
 kfree+0x291/0x6d0 mm/slub.c:6849
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x53f/0x630 net/rose/rose_timer.c:183
 call_timer_fn+0x19a/0x620 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers+0x6ef/0x960 kernel/time/timer.c:2372
 __run_timer_base kernel/time/timer.c:2384 [inline]
 __run_timer_base kernel/time/timer.c:2376 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2393
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:preempt_latency_start kernel/sched/core.c:5777 [inline]
RIP: 0010:preempt_latency_start kernel/sched/core.c:5772 [inline]
RIP: 0010:preempt_count_add+0x9e/0x150 kernel/sched/core.c:5800
Code: 0f 00 85 c0 75 38 65 48 8b 2d c6 0b 18 12 48 8d bd 20 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 87 00 00 00 48 89 9d 20 15 00 00 5b 5d c3 cc cc cc cc 31 ff
RSP: 0018:ffffc900044b6f80 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffffffff81980758 RCX: 1ffffffff3562220
RDX: 1ffff11004921bc4 RSI: 0000000000000008 RDI: ffff88802490de20
RBP: ffff88802490c900 R08: 0000000000000000 R09: ffffed1008464793
R10: ffff888042323c9f R11: 0000000000000000 R12: ffff888042323cf8
R13: ffffc900044b71c8 R14: ffffffff90824250 R15: ffffffff81ff41f0
 __up_write kernel/locking/rwsem.c:1383 [inline]
 up_write+0x118/0x520 kernel/locking/rwsem.c:1643
 inode_unlock include/linux/fs.h:990 [inline]
 shmem_file_write_iter+0xcf/0x140 mm/shmem.c:3469
 __kernel_write_iter+0x31a/0xb10 fs/read_write.c:619
 dump_emit_page fs/coredump.c:1298 [inline]
 dump_user_range+0x413/0xb70 fs/coredump.c:1372
 elf_core_dump+0x29c3/0x3c00 fs/binfmt_elf.c:2111
 coredump_write fs/coredump.c:1049 [inline]
 vfs_coredump+0x2b9f/0x5670 fs/coredump.c:1170
 get_signal+0x22e1/0x26d0 kernel/signal.c:3019
 arch_do_signal_or_restart+0x8f/0x7c0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:40 [inline]
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 irqentry_exit_to_user_mode+0x176/0x310 kernel/entry/common.c:73
 asm_exc_invalid_op+0x1a/0x20 arch/x86/include/asm/idtentry.h:616
RIP: 0033:0x200000000006
Code: Unable to access opcode bytes at 0x1fffffffffdc.
RSP: 002b:00007fc2e9036338 EFLAGS: 00010202
RAX: 00000000000000da RBX: 00007fc2e83e5fa0 RCX: 00007fc2e818f6c9
RDX: 00007fc2e9036340 RSI: 00007fc2e9036470 RDI: 000000000000000d
RBP: 00007fc2e8211f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc2e83e6038 R14: 00007fc2e83e5fa0 R15: 00007fffc2525db8
 </TASK>
----------------
Code disassembly (best guess):
   0:	0f 00 85 c0 75 38 65 	sldt   0x653875c0(%rbp)
   7:	48 8b 2d c6 0b 18 12 	mov    0x12180bc6(%rip),%rbp        # 0x12180bd4
   e:	48 8d bd 20 15 00 00 	lea    0x1520(%rbp),%rdi
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df
  1f:	48 89 fa             	mov    %rdi,%rdx
  22:	48 c1 ea 03          	shr    $0x3,%rdx
  26:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
* 2a:	0f 85 87 00 00 00    	jne    0xb7 <-- trapping instruction
  30:	48 89 9d 20 15 00 00 	mov    %rbx,0x1520(%rbp)
  37:	5b                   	pop    %rbx
  38:	5d                   	pop    %rbp
  39:	c3                   	ret
  3a:	cc                   	int3
  3b:	cc                   	int3
  3c:	cc                   	int3
  3d:	cc                   	int3
  3e:	31 ff                	xor    %edi,%edi