------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 3 PID: 387 at lib/refcount.c:28 refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Modules linked in:
CPU: 3 UID: 0 PID: 387 Comm: kworker/u32:6 Not tainted 6.16.0-rc1-syzkaller-00236-g8c6bc74c7f89 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: netns cleanup_net
RIP: 0010:refcount_warn_saturate+0x14a/0x210 lib/refcount.c:28
Code: ff 89 de e8 48 f5 df fc 84 db 0f 85 66 ff ff ff e8 5b fa df fc c6 05 50 58 b4 0b 01 90 48 c7 c7 e0 24 15 8c e8 07 bf 9e fc 90 <0f> 0b 90 90 e9 43 ff ff ff e8 38 fa df fc 0f b6 1d 2b 58 b4 0b 31
RSP: 0000:ffffc900006f8d90 EFLAGS: 00010082
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817ae248
RDX: ffff8880252c0000 RSI: ffffffff817ae255 RDI: 0000000000000001
RBP: ffff888030f9e668 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888030f9e668
R13: ffff88802bb25000 R14: 0000000000000015 R15: 1ffff1102067f00c
FS:  0000000000000000(0000) GS:ffff8880d6a53000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007efcf05ab418 CR3: 0000000047848000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 p9_req_put+0x1ec/0x250 net/9p/client.c:404
 req_done+0x1dc/0x2e0 net/9p/trans_virtio.c:147
 vring_interrupt drivers/virtio/virtio_ring.c:2715 [inline]
 vring_interrupt+0x31e/0x400 drivers/virtio/virtio_ring.c:2690
 __handle_irq_event_percpu+0x229/0x7d0 kernel/irq/handle.c:158
 handle_irq_event_percpu kernel/irq/handle.c:193 [inline]
 handle_irq_event+0xab/0x1e0 kernel/irq/handle.c:210
 handle_edge_irq+0x28e/0xab0 kernel/irq/chip.c:789
 generic_handle_irq_desc include/linux/irqdesc.h:173 [inline]
 handle_irq arch/x86/kernel/irq.c:254 [inline]
 call_irq_handler arch/x86/kernel/irq.c:266 [inline]
 __common_interrupt+0xdf/0x250 arch/x86/kernel/irq.c:292
 common_interrupt+0xba/0xe0 arch/x86/kernel/irq.c:285
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:preempt_schedule_irq+0x4c/0x90 kernel/sched/core.c:7108
Code: df 55 65 48 8b 2d 6c 89 4b 08 53 48 89 eb 48 c1 eb 03 48 01 c3 bf 01 00 00 00 e8 ff 1b 08 f6 e8 da a5 42 f6 fb bf 01 00 00 00 <e8> af 99 ff ff 9c 58 fa f6 c4 02 75 1e bf 01 00 00 00 e8 4d a3 07
RSP: 0000:ffffc90003a77688 EFLAGS: 00000202
RAX: 000000000011313b RBX: ffffed1004a58000 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8de19e08 RDI: 0000000000000001
RBP: ffff8880252c0000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90a81457 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 irqentry_exit+0x36/0x90 kernel/entry/common.c:307
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:queue_work_on+0x86/0x1f0 kernel/workqueue.c:2397
Code: 38 00 45 84 f6 74 38 e8 68 4d 38 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 c6 48 38 00 48 85 db 0f 85 4f 01 00 00 45 31 f6 <e8> 45 4d 38 00 44 89 f0 5b 5d 41 5c 41 5d 41 5e c3 cc cc cc cc e8
RSP: 0000:ffffc90003a77758 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8183cf5c
RDX: ffff8880252c0000 RSI: ffffffff8183cf66 RDI: 0000000000000007
RBP: 0000000000000200 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000008
R13: ffff88801e2c7800 R14: 0000000000000001 R15: 0000000000000001
 queue_work include/linux/workqueue.h:662 [inline]
 netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:680 [inline]
 netdevice_event+0x6ed/0x9d0 drivers/infiniband/core/roce_gid_mgmt.c:823
 notifier_call_chain+0xb9/0x410 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230
 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
 call_netdevice_notifiers net/core/dev.c:2282 [inline]
 unregister_netdevice_many_notify+0xf9d/0x2700 net/core/dev.c:12077
 ops_exit_rtnl_list net/core/net_namespace.c:188 [inline]
 ops_undo_list+0x8fc/0xab0 net/core/net_namespace.c:249
 cleanup_net+0x408/0x890 net/core/net_namespace.c:686
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3402
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	df 55 65             	fists  0x65(%rbp)
   3:	48 8b 2d 6c 89 4b 08 	mov    0x84b896c(%rip),%rbp        # 0x84b8976
   a:	53                   	push   %rbx
   b:	48 89 eb             	mov    %rbp,%rbx
   e:	48 c1 eb 03          	shr    $0x3,%rbx
  12:	48 01 c3             	add    %rax,%rbx
  15:	bf 01 00 00 00       	mov    $0x1,%edi
  1a:	e8 ff 1b 08 f6       	call   0xf6081c1e
  1f:	e8 da a5 42 f6       	call   0xf642a5fe
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 af 99 ff ff       	call   0xffff99de <-- trapping instruction
  2f:	9c                   	pushf
  30:	58                   	pop    %rax
  31:	fa                   	cli
  32:	f6 c4 02             	test   $0x2,%ah
  35:	75 1e                	jne    0x55
  37:	bf 01 00 00 00       	mov    $0x1,%edi
  3c:	e8                   	.byte 0xe8
  3d:	4d                   	rex.WRB
  3e:	a3                   	.byte 0xa3
  3f:	07                   	(bad)