md: md1 stopped.
md: md1 stopped.
md: md1 stopped.
md: md1 stopped.
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110, CPU#1: syz.1.4585/24953
Modules linked in:
CPU: 1 UID: 0 PID: 24953 Comm: syz.1.4585 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x9f/0x110
Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 0b 6d e6 fc 48 8d 3d 74 dc a3 0c 67 48 0f b9 3a eb 4a e8 f8 6c e6 fc 48 8d 3d 71 dc a3 0c <67> 48 0f b9 3a eb 37 e8 e5 6c e6 fc 48 8d 3d 6e dc a3 0c 67 48 0f
RSP: 0018:ffffc90008bbfb78 EFLAGS: 00010293
RAX: ffffffff84e1b568 RBX: 0000000000000002 RCX: ffff8881bbfabc00
RDX: 0000000000000000 RSI: ffffffff90587a20 RDI: ffffffff918591e0
RBP: 0000000000000000 R08: ffff8881bbfabc00 R09: 0000000000000005
R10: 0000000000000004 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffffffff21e12ca R14: ffff8881145f2128 R15: dffffc0000000000
FS:  00007fe7685ab6c0(0000) GS:ffff8882a7cbb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe7677ecc40 CR3: 00000001bb582000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 kobject_get+0xfa/0x120
 sysfs_break_active_protection+0x28/0xa0
 md_attr_store+0x28f/0x640
 kernfs_fop_write_iter+0x3a4/0x540
 vfs_write+0x612/0xba0
 ksys_write+0x150/0x270
 do_syscall_64+0x166/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe76779f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe7685ab028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe767a26360 RCX: 00007fe76779f559
RDX: 0000000000000005 RSI: 0000200000001a80 RDI: 000000000000001a
RBP: 00007fe767836b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe767a263f8 R14: 00007fe767a26360 R15: 00007ffd51994fe8
 </TASK>
