------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint: rose_transmit_restart_request net/rose/rose_link.c:-1 [inline]
ODEBUG: free active (active state 0) object type: timer_list hint: rose_t0timer_expiry+0x0/0x350 net/rose/rose_link.c:284
WARNING: CPU: 0 PID: 4278 at lib/debugobjects.c:518 debug_print_object lib/debugobjects.c:515 [inline]
WARNING: CPU: 0 PID: 4278 at lib/debugobjects.c:518 __debug_check_no_obj_freed lib/debugobjects.c:979 [inline]
WARNING: CPU: 0 PID: 4278 at lib/debugobjects.c:518 debug_check_no_obj_freed+0x43c/0x530 lib/debugobjects.c:1009
Modules linked in:
CPU: 0 PID: 4278 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:debug_print_object lib/debugobjects.c:515 [inline]
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:979 [inline]
RIP: 0010:debug_check_no_obj_freed+0x43c/0x530 lib/debugobjects.c:1009
Code: ef e8 f8 72 c5 fd 4c 8b 45 00 48 c7 c7 00 06 df 8a 48 c7 c6 c0 02 df 8a 48 c7 c2 60 07 df 8a 8b 0c 24 4d 89 e9 e8 a4 7d 41 fd <0f> 0b 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc ff df ff 05 55 2d 14
RSP: 0018:ffffc90000007a10 EFLAGS: 00010246
RAX: f6d0f42b5d1b2a00 RBX: ffffffff96f0d6e0 RCX: ffff88801b373b80
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffffff8a8de220 R08: dffffc0000000000 R09: fffff52000000ed1
R10: fffff52000000ed1 R11: 1ffff92000000ed0 R12: ffff8880556ab600
R13: ffffffff8918ff80 R14: ffff8880556ab000 R15: ffff8880556ab490
FS: 000055557a3f5500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3adeb1 CR3: 000000005b2bc000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
slab_free_hook mm/slub.c:1704 [inline]
slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
__kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700
rose_neigh_put include/net/rose.h:166 [inline]
rose_timer_expiry+0x4a7/0x5d0 net/rose/rose_timer.c:183
call_timer_fn+0x1a0/0x670 kernel/time/timer.c:1504
expire_timers kernel/time/timer.c:1549 [inline]
__run_timers+0x525/0x7c0 kernel/time/timer.c:1820
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1833
handle_softirqs+0x2a1/0x920 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:preempt_count_sub+0x13/0x160 kernel/sched/core.c:5737
Code: ff ff 48 c7 c7 a8 aa 1f 8e e8 e9 39 79 00 89 df e9 5b ff ff ff 66 90 55 53 48 bb 00 00 00 00 00 fc ff df 48 c7 c0 40 91 be 96 <48> c1 e8 03 0f b6 04 18 84 c0 0f 85 bd 00 00 00 83 3d d6 da 66 15
RSP: 0018:ffffc90003ce7318 EFLAGS: 00000206
RAX: ffffffff96be9140 RBX: dffffc0000000000 RCX: ffffc90003ce7698
RDX: ffffc90003ce7401 RSI: dffffc0000000000 RDI: 0000000000000001
RBP: ffffffff8eaa3dac R08: ffffc90003ce7680 R09: ffffc90003ce7458
R10: fffff5200079ce8d R11: 1ffff9200079ce8b R12: ffffc90003ce0000
R13: dffffc0000000000 R14: ffffc90003ce7418 R15: ffffc90003ce7690
unwind_next_frame+0x1880/0x20b0 arch/x86/kernel/unwind_orc.c:629
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
save_stack+0xf3/0x1e0 mm/page_owner.c:127
__reset_page_owner+0x51/0x1a0 mm/page_owner.c:148
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1459 [inline]
free_pcp_prepare mm/page_alloc.c:1509 [inline]
free_unref_page_prepare+0x8b4/0x9a0 mm/page_alloc.c:3384
free_unref_page_list+0xbb/0x8e0 mm/page_alloc.c:3525
release_pages+0x1f92/0x2200 mm/swap.c:1035
__pagevec_release+0x6d/0xe0 mm/swap.c:1055
pagevec_release include/linux/pagevec.h:71 [inline]
folio_batch_release include/linux/pagevec.h:135 [inline]
shmem_undo_range+0x75b/0x2050 mm/shmem.c:946
shmem_truncate_range mm/shmem.c:1062 [inline]
shmem_evict_inode+0x248/0xa40 mm/shmem.c:1171
evict+0x485/0x870 fs/inode.c:705
do_unlinkat+0x377/0x560 fs/namei.c:4397
__do_sys_unlink fs/namei.c:4438 [inline]
__se_sys_unlink fs/namei.c:4436 [inline]
__x64_sys_unlink+0x45/0x50 fs/namei.c:4436
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f72d078e1d7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc755951d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f72d078e1d7
RDX: 00007ffc75595200 RSI: 00007ffc75595290 RDI: 00007ffc75595290
RBP: 00007ffc75595290 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffc75596320
R13: 00007f72d0811c2d R14: 0000000000089b24 R15: 00007ffc75596360
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 48 c7 c7 a8 aa 1f 8e mov $0xffffffff8e1faaa8,%rdi
7: e8 e9 39 79 00 call 0x7939f5
c: 89 df mov %ebx,%edi
e: e9 5b ff ff ff jmp 0xffffff6e
13: 66 90 xchg %ax,%ax
15: 55 push %rbp
16: 53 push %rbx
17: 48 bb 00 00 00 00 00 movabs $0xdffffc0000000000,%rbx
1e: fc ff df
21: 48 c7 c0 40 91 be 96 mov $0xffffffff96be9140,%rax
* 28: 48 c1 e8 03 shr $0x3,%rax <-- trapping instruction
2c: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax
30: 84 c0 test %al,%al
32: 0f 85 bd 00 00 00 jne 0xf5
38: 83 .byte 0x83
39: 3d d6 da 66 15 cmp $0x1566dad6,%eax