------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 3462 at lib/refcount.c:28 refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 3462 Comm: kworker/1:4 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Workqueue: md_misc mddev_delayed_delete
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
lr : refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
sp : ffff8000a1427a80
x29: ffff8000a1427a80 x28: 0000000000000001 x27: ffff80008710df78
x26: 0000000000000000 x25: ffff0000192e3800 x24: ffff800087110000
x23: ffff000019986130 x22: 0000000000000004 x21: 1fffe00003330c26
x20: ffff000019986130 x19: 0000000000000003 x18: 0000000000000000
x17: 0000000000000000 x16: ffff00006a0ad4c4 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: ffff700014284eb9
x11: 1ffff00014284eb8 x10: ffff700014284eb8 x9 : dfff800000000000
x8 : ffff8000a14275c8 x7 : ffff8000a14276f0 x6 : ffff8000a1427640
x5 : ffff8000a1427628 x4 : 0000000000000002 x3 : 1fffe0000d41773e
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000017043c80
Call trace:
 refcount_warn_saturate+0x138/0x19c lib/refcount.c:28 (P)
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 kobject_put+0x29c/0x430 lib/kobject.c:737
 mddev_delayed_delete+0x14/0x20 drivers/md/md.c:5893
 process_one_work+0x7cc/0x18d4 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x734/0xb84 kernel/workqueue.c:3400
 kthread+0x348/0x5fc kernel/kthread.c:463
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 7172
hardirqs last  enabled at (7171): [<ffff800080254afc>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1531 [inline]
hardirqs last  enabled at (7171): [<ffff800080254afc>] finish_lock_switch kernel/sched/core.c:5105 [inline]
hardirqs last  enabled at (7171): [<ffff800080254afc>] finish_task_switch.isra.0+0x1a8/0x854 kernel/sched/core.c:5223
hardirqs last disabled at (7172): [<ffff800085437320>] el1_brk64+0x1c/0x48 arch/arm64/kernel/entry-common.c:574
softirqs last  enabled at (7142): [<ffff80008267911c>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (7142): [<ffff80008267911c>] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
softirqs last  enabled at (7142): [<ffff80008267911c>] wg_packet_decrypt_worker+0x250/0x3b0 drivers/net/wireguard/receive.c:499
softirqs last disabled at (7140): [<ffff800082678f38>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (7140): [<ffff800082678f38>] ptr_ring_consume_bh include/linux/ptr_ring.h:365 [inline]
softirqs last disabled at (7140): [<ffff800082678f38>] wg_packet_decrypt_worker+0x6c/0x3b0 drivers/net/wireguard/receive.c:499
---[ end trace 0000000000000000 ]---