------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff88805586dc90 object type: timer_list hint: rose_t0timer_expiry+0x0/0x350 net/rose/rose_link.c:-1
WARNING: CPU: 1 PID: 19116 at lib/debugobjects.c:615 debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 19116 Comm: syz.4.3373 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:debug_print_object+0x16b/0x1e0 lib/debugobjects.c:612
Code: 4c 89 ff e8 77 e4 92 fd 4d 8b 0f 48 c7 c7 80 0f bf 8b 48 8b 34 24 4c 89 ea 89 e9 4d 89 f0 41 54 e8 4a 4b f0 fc 48 83 c4 08 90 <0f> 0b 90 90 ff 05 57 32 ea 0a 48 83 c4 08 5b 41 5c 41 5d 41 5e 41
RSP: 0018:ffffc90000a08a00 EFLAGS: 00010296
RAX: 4bafba091b724e00 RBX: dffffc0000000000 RCX: ffff8880222a5ac0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff1bba650 R12: ffffffff8a3925a0
R13: ffffffff8bbf1100 R14: ffff88805586dc90 R15: ffffffff8b6cf600
FS:  0000000000000000(0000) GS:ffff88812623d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fea455e5fa4 CR3: 000000008eff0000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
 debug_check_no_obj_freed+0x3a2/0x470 lib/debugobjects.c:1129
 slab_free_hook mm/slub.c:2470 [inline]
 slab_free mm/slub.c:6630 [inline]
 kfree+0x115/0x6d0 mm/slub.c:6837
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x4cb/0x600 net/rose/rose_timer.c:183
 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
 handle_softirqs+0x286/0x870 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__asan_memset+0x2e/0x50 mm/kasan/shadow.c:87
Code: 55 41 56 53 48 89 d3 89 f5 49 89 fe 48 8b 4c 24 18 48 89 d6 ba 01 00 00 00 e8 7e e4 ff ff 84 c0 74 11 4c 89 f7 89 ee 48 89 da <5b> 41 5e 5d e9 b9 b9 20 09 31 c0 5b 41 5e 5d e9 fe 77 23 09 cc 66
RSP: 0018:ffffc9000cf3f5c8 EFLAGS: 00000202
RAX: ffff8880222a5a01 RBX: 0000000000000060 RCX: ffffffff8173b506
RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffffc9000cf3f648
RBP: 0000000000000000 R08: ffffc9000cf3f6a7 R09: 1ffff920019e7ed4
R10: dffffc0000000000 R11: fffff520019e7ed5 R12: 0000000000000000
R13: ffff8880222a5ac0 R14: ffffc9000cf3f648 R15: 0000000000000000
 __unwind_start+0x36/0x760 arch/x86/kernel/unwind_orc.c:686
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0xe4/0x150 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:56 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
 kasan_save_free_info mm/kasan/kasan.h:406 [inline]
 poison_slab_object mm/kasan/common.c:252 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
 kasan_slab_free include/linux/kasan.h:234 [inline]
 slab_free_hook mm/slub.c:2539 [inline]
 slab_free mm/slub.c:6630 [inline]
 kmem_cache_free+0x19b/0x690 mm/slub.c:6740
 do_exit+0x66f/0x2300 kernel/exit.c:961
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1107
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0xa0/0x790 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x72/0x130 kernel/entry/common.c:40
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 ret_from_fork+0x53f/0x870 arch/x86/kernel/process.c:167
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	55                   	push   %rbp
   1:	41 56                	push   %r14
   3:	53                   	push   %rbx
   4:	48 89 d3             	mov    %rdx,%rbx
   7:	89 f5                	mov    %esi,%ebp
   9:	49 89 fe             	mov    %rdi,%r14
   c:	48 8b 4c 24 18       	mov    0x18(%rsp),%rcx
  11:	48 89 d6             	mov    %rdx,%rsi
  14:	ba 01 00 00 00       	mov    $0x1,%edx
  19:	e8 7e e4 ff ff       	call   0xffffe49c
  1e:	84 c0                	test   %al,%al
  20:	74 11                	je     0x33
  22:	4c 89 f7             	mov    %r14,%rdi
  25:	89 ee                	mov    %ebp,%esi
  27:	48 89 da             	mov    %rbx,%rdx
* 2a:	5b                   	pop    %rbx <-- trapping instruction
  2b:	41 5e                	pop    %r14
  2d:	5d                   	pop    %rbp
  2e:	e9 b9 b9 20 09       	jmp    0x920b9ec
  33:	31 c0                	xor    %eax,%eax
  35:	5b                   	pop    %rbx
  36:	41 5e                	pop    %r14
  38:	5d                   	pop    %rbp
  39:	e9 fe 77 23 09       	jmp    0x923783c
  3e:	cc                   	int3
  3f:	66                   	data16