------------[ cut here ]------------
ODEBUG: free active (active state 0) object: ffff888058183890 object type: timer_list hint: rose_t0timer_expiry+0x0/0x150 include/linux/skbuff.h:2928
WARNING: lib/debugobjects.c:612 at debug_print_object+0x18e/0x2a0 lib/debugobjects.c:612, CPU#0: syz.5.618/8622
Modules linked in:
CPU: 0 UID: 0 PID: 8622 Comm: syz.5.618 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:debug_print_object+0x19b/0x2a0 lib/debugobjects.c:612
Code: b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 48 8d 3d b2 46 f0 0b 41 56 48 8b 14 dd 60 e8 1a 8c 4c 89 e6 <67> 48 0f b9 3a 58 83 05 fc f0 e5 0b 01 48 83 c4 18 5b 5d 41 5c 41
RSP: 0000:ffffc90000007a38 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: 0000000000000000
RDX: ffffffff8c1ae7a0 RSI: ffffffff8c1ae3c0 RDI: ffffffff90e38080
RBP: 0000000000000001 R08: ffff888058183890 R09: ffffffff8bb2c880
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff8c1ae3c0
R13: ffffffff8bb2c8c0 R14: ffffffff8a6d6bd0 R15: ffffc90000007b38
FS: 00007fa779aa16c0(0000) GS:ffff88812438b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffe70 CR3: 000000002ba73000 CR4: 0000000000350ef0
Call Trace:
__debug_check_no_obj_freed lib/debugobjects.c:1099 [inline]
debug_check_no_obj_freed+0x4da/0x630 lib/debugobjects.c:1129
slab_free_hook mm/slub.c:2601 [inline]
slab_free mm/slub.c:6082 [inline]
kfree+0x343/0x670 mm/slub.c:6399
rose_neigh_put include/net/rose.h:166 [inline]
rose_timer_expiry+0x53f/0x630 net/rose/rose_timer.c:183
call_timer_fn+0x19a/0x590 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers+0x757/0xac0 kernel/time/timer.c:2373
__run_timer_base kernel/time/timer.c:2385 [inline]
__run_timer_base kernel/time/timer.c:2377 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2394
run_timer_softirq+0x1a/0x50 kernel/time/timer.c:2404
handle_softirqs+0x1ea/0x910 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xef/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:const_folio_flags include/linux/page-flags.h:351 [inline]
RIP: 0010:folio_test_unevictable include/linux/page-flags.h:643 [inline]
RIP: 0010:folio_add_lru+0x138/0x460 mm/swap.c:507
Code: 0f 85 19 02 00 00 e8 57 a8 c2 ff 0f 1f 44 00 00 e8 4d a8 c2 ff 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 <0f> 85 d1 02 00 00 48 8b 6b 08 31 ff 83 e5 01 48 89 ee e8 01 a3 c2
RSP: 0000:ffffc90003306ba8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffffea00022d75c0 RCX: ffffffff824449fb
RDX: 1ffffd400045aeb9 RSI: ffffffff82444a13 RDI: ffff888028558000
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffea00022d75c8
R13: 0000000000000cc0 R14: 0000000000000001 R15: ffff88806a3a1b60
shmem_alloc_and_add_folio+0x72a/0xd40 mm/shmem.c:2031
shmem_get_folio_gfp+0x6ab/0x1900 mm/shmem.c:2567
shmem_get_folio mm/shmem.c:2673 [inline]
shmem_write_begin+0x1a4/0x420 mm/shmem.c:3326
generic_perform_write+0x292/0xa40 mm/filemap.c:4314
shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3501
__kernel_write_iter+0x2ac/0x920 fs/read_write.c:621
dump_emit_page fs/coredump.c:1299 [inline]
dump_user_range+0x3f9/0xb50 fs/coredump.c:1373
elf_core_dump+0x2d16/0x3c60 fs/binfmt_elf.c:2111
coredump_write fs/coredump.c:1050 [inline]
do_coredump fs/coredump.c:1127 [inline]
vfs_coredump+0x27b4/0x5570 fs/coredump.c:1201
get_signal+0x1f2a/0x21e0 kernel/signal.c:3019
arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:270 [inline]
irqentry_exit_to_user_mode include/linux/irq-entry-common.h:339 [inline]
irqentry_exit+0x1f8/0x670 kernel/entry/common.c:219
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fa778b9bf81
Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fa778e16090 RCX: 00007fa778b9bf79
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007fa778c327e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fa778e16128 R14: 00007fa778e16090 R15: 00007ffe527117c8
----------------
Code disassembly (best guess):
0: b8 00 00 00 00 mov $0x0,%eax
5: 00 fc add %bh,%ah
7: ff lcall (bad)
8: df 48 89 fisttps -0x77(%rax)
b: fa cli
c: 48 c1 ea 03 shr $0x3,%rdx
10: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
14: 75 4f jne 0x65
16: 48 8d 3d b2 46 f0 0b lea 0xbf046b2(%rip),%rdi # 0xbf046cf
1d: 41 56 push %r14
1f: 48 8b 14 dd 60 e8 1a mov -0x73e517a0(,%rbx,8),%rdx
26: 8c
27: 4c 89 e6 mov %r12,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 58 pop %rax
30: 83 05 fc f0 e5 0b 01 addl $0x1,0xbe5f0fc(%rip) # 0xbe5f133
37: 48 83 c4 18 add $0x18,%rsp
3b: 5b pop %rbx
3c: 5d pop %rbp
3d: 41 5c pop %r12
3f: 41 rex.B