------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint: rose_transmit_restart_request net/rose/rose_link.c:-1 [inline]
ODEBUG: free active (active state 0) object type: timer_list hint: rose_t0timer_expiry+0x0/0x350 net/rose/rose_link.c:284
WARNING: CPU: 1 PID: 56 at lib/debugobjects.c:518 debug_print_object lib/debugobjects.c:515 [inline]
WARNING: CPU: 1 PID: 56 at lib/debugobjects.c:518 __debug_check_no_obj_freed lib/debugobjects.c:979 [inline]
WARNING: CPU: 1 PID: 56 at lib/debugobjects.c:518 debug_check_no_obj_freed+0x43c/0x530 lib/debugobjects.c:1009
Modules linked in:
CPU: 1 PID: 56 Comm: kworker/u4:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:debug_print_object lib/debugobjects.c:515 [inline]
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:979 [inline]
RIP: 0010:debug_check_no_obj_freed+0x43c/0x530 lib/debugobjects.c:1009
Code: ef e8 48 cc bd fd 4c 8b 45 00 48 c7 c7 c0 18 df 8a 48 c7 c6 80 15 df 8a 48 c7 c2 20 1a df 8a 8b 0c 24 4d 89 e9 e8 34 52 38 fd <0f> 0b 4c 8b 6c 24 18 48 b9 00 00 00 00 00 fc ff df ff 05 a5 7a 0a
RSP: 0018:ffffc900001e0a10 EFLAGS: 00010246
RAX: c4c78d33500e5900 RBX: ffffffff96ec4ec8 RCX: ffff88801dad9dc0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffffff8a8def40 R08: ffffc900001e0687 R09: 1ffff9200003c0d0
R10: dffffc0000000000 R11: fffff5200003c0d1 R12: ffff88807a07be00
R13: ffffffff892aadc0 R14: ffff88807a07b000 R15: ffff88807a07bc90
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555568f584e8 CR3: 000000000c88e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 slab_free_hook mm/slub.c:1704 [inline]
 slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x1f0 mm/slub.c:3700
 rose_neigh_put include/net/rose.h:166 [inline]
 rose_timer_expiry+0x4a7/0x5d0 net/rose/rose_timer.c:183
 call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x53e/0x800 kernel/time/timer.c:2023
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:csd_lock_wait kernel/smp.c:424 [inline]
RIP: 0010:smp_call_function_many_cond+0xea2/0x1290 kernel/smp.c:998
Code: 00 00 00 41 8b 1f 89 de 83 e6 01 31 ff e8 16 f5 0a 00 83 e3 01 48 bb 00 00 00 00 00 fc ff df 75 07 e8 a2 f1 0a 00 eb 37 f3 90 <41> 0f b6 04 1c 84 c0 75 10 41 f7 07 01 00 00 00 74 1e e8 87 f1 0a
RSP: 0018:ffffc90001577800 EFLAGS: 00000293
RAX: ffffffff81778129 RBX: dffffc0000000000 RCX: ffff88801dad9dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90001577960 R08: ffffffff90af6247 R09: 1ffffffff215ec48
R10: dffffc0000000000 R11: fffffbfff215ec49 R12: 1ffff110171c8601
R13: ffff8880b8f3bbc0 R14: 0000000000000000 R15: ffff8880b8e43008
 on_each_cpu_cond_mask+0x3b/0x80 kernel/smp.c:1165
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1574 [inline]
 text_poke_bp_batch+0x793/0x850 arch/x86/kernel/alternative.c:-1
 text_poke_flush arch/x86/kernel/alternative.c:1965 [inline]
 text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1972
 arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x11f/0x240 kernel/jump_label.c:207
 static_key_enable+0x16/0x20 kernel/jump_label.c:220
 toggle_allocation_gate+0xba/0x470 mm/kfence/core.c:820
 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	41 8b 1f             	mov    (%r15),%ebx
   5:	89 de                	mov    %ebx,%esi
   7:	83 e6 01             	and    $0x1,%esi
   a:	31 ff                	xor    %edi,%edi
   c:	e8 16 f5 0a 00       	call   0xaf527
  11:	83 e3 01             	and    $0x1,%ebx
  14:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  1b:	fc ff df
  1e:	75 07                	jne    0x27
  20:	e8 a2 f1 0a 00       	call   0xaf1c7
  25:	eb 37                	jmp    0x5e
  27:	f3 90                	pause
* 29:	41 0f b6 04 1c       	movzbl (%r12,%rbx,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	75 10                	jne    0x42
  32:	41 f7 07 01 00 00 00 	testl  $0x1,(%r15)
  39:	74 1e                	je     0x59
  3b:	e8                   	.byte 0xe8
  3c:	87 f1                	xchg   %esi,%ecx
  3e:	0a                   	.byte 0xa