------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 14335 at lib/refcount.c:28 refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
Modules linked in:
CPU: 1 UID: 0 PID: 14335 Comm: kworker/1:0 Not tainted 6.16.0-syzkaller-04055-g14bed9bc81ba #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Workqueue: md_misc mddev_delayed_delete
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
lr : refcount_warn_saturate+0x138/0x19c lib/refcount.c:28
sp : ffff8000a1627a80
x29: ffff8000a1627a80 x28: 0000000000000001 x27: ffff80008708df78
x26: 0000000000000000 x25: ffff00000ec37500 x24: ffff800087090000
x23: ffff0000142aa130 x22: 0000000000000004 x21: 1fffe00002855426
x20: ffff0000142aa130 x19: 0000000000000003 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000001 x12: ffff700010e2618d
x11: 1ffff00010e2618c x10: ffff700010e2618c x9 : dfff800000000000
x8 : 0000000000000003 x7 : 0000000000000001 x6 : ffff700010e2618c
x5 : ffff800087130c60 x4 : 1fffe000024e3791 x3 : dfff800000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00001271bc80
Call trace:
 refcount_warn_saturate+0x138/0x19c lib/refcount.c:28 (P)
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 kobject_put+0x29c/0x430 lib/kobject.c:737
 mddev_delayed_delete+0x14/0x20 drivers/md/md.c:5893
 process_one_work+0x7cc/0x18d4 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3321 [inline]
 worker_thread+0x734/0xb84 kernel/workqueue.c:3402
 kthread+0x348/0x5fc kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
irq event stamp: 6426
hardirqs last  enabled at (6425): [<ffff80008033b238>] __up_console_sem+0x74/0x94 kernel/printk/printk.c:344
hardirqs last disabled at (6426): [<ffff8000853f4538>] el1_dbg+0x24/0x9c arch/arm64/kernel/entry-common.c:511
softirqs last  enabled at (6384): [<ffff80008262a48c>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (6384): [<ffff80008262a48c>] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline]
softirqs last  enabled at (6384): [<ffff80008262a48c>] wg_packet_decrypt_worker+0x250/0x3b0 drivers/net/wireguard/receive.c:499
softirqs last disabled at (6382): [<ffff80008262a2a8>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (6382): [<ffff80008262a2a8>] ptr_ring_consume_bh include/linux/ptr_ring.h:365 [inline]
softirqs last disabled at (6382): [<ffff80008262a2a8>] wg_packet_decrypt_worker+0x6c/0x3b0 drivers/net/wireguard/receive.c:499
---[ end trace 0000000000000000 ]---