------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 962 at lib/refcount.c:28 refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 962 Comm: kworker/1:2 Not tainted 6.16.0-syzkaller-04405-g4b290aae788e #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Workqueue: md_misc mddev_delayed_delete
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
lr : refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
sp : ffff80008e927a80
x29: ffff80008e927a80 x28: 0000000000000001 x27: ffff80008708df78
x26: 0000000000000000 x25: ffff0000150e1f00 x24: ffff800087090000
x23: ffff000026240130 x22: 0000000000000004 x21: 1fffe00004c48026
x20: ffff000026240130 x19: 0000000000000003 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: ffff700011d24ec7
x11: 1ffff00011d24ec6 x10: ffff700011d24ec6 x9 : dfff800000000000
x8 : ffff80008e927638 x7 : ffff80008e927760 x6 : ffff80008e9276b0
x5 : ffff80008e927698 x4 : 0000000000000002 x3 : 1fffe0000d419d16
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000152c5ac0
Call trace:
 refcount_warn_saturate+0x138/0x19c lib/refcount.c:28 (P)
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 kobject_put+0x29c/0x430 lib/kobject.c:737
 mddev_delayed_delete+0x14/0x20 drivers/md/md.c:5893
 process_one_work+0x7cc/0x18d4 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x734/0xb84 kernel/workqueue.c:3402
 kthread+0x348/0x5fc kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
irq event stamp: 146962
hardirqs last  enabled at (146961): [<ffff800085407ea4>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1534 [inline]
hardirqs last  enabled at (146961): [<ffff800085407ea4>] __schedule+0x23c0/0x31cc kernel/sched/core.c:6962
hardirqs last disabled at (146962): [<ffff8000853f7d30>] el1_brk64+0x1c/0x48 arch/arm64/kernel/entry-common.c:574
softirqs last  enabled at (146934): [<ffff8000801b7810>] softirq_handle_end kernel/softirq.c:425 [inline]
softirqs last  enabled at (146934): [<ffff8000801b7810>] handle_softirqs+0x88c/0xdb4 kernel/softirq.c:607
softirqs last disabled at (146921): [<ffff800080010760>] __do_softirq+0x14/0x20 kernel/softirq.c:613
---[ end trace 0000000000000000 ]---