[  295.418089] refcount_t: underflow; use-after-free.
[  295.418105] WARNING: CPU: 7 PID: 3911 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x144
[  295.418124] Modules linked in: qcom_camss(-) imx800 venus_enc venus_dec venus_core v4l2_mem2mem videobuf2_v4l2 videobuf2_dma_sg videobuf2_dma_contig videobuf2_memops videobuf2_common ipa ath11k_ahb
[  295.418158] CPU: 7 PID: 3911 Comm: rmmod Not tainted 6.6.0-rc7-00162-g8dbaf6f3286e-dirty #5
[  295.418170] Hardware name: Fairphone 5 (DT)
[  295.418175] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  295.418185] pc : refcount_warn_saturate+0xf4/0x144
[  295.418193] lr : refcount_warn_saturate+0xf4/0x144
[  295.418200] sp : ffff80008790bba0
[  295.418205] x29: ffff80008790bba0 x28: ffff5242a14e3c00 x27: 0000000000000000
[  295.418216] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[  295.418226] x23: ffff52428001c090 x22: ffff5242809c6090 x21: 0000000000002f30
[  295.418236] x20: ffff52428dba5800 x19: ffffa32ef7dca910 x18: 0000000000000006
[  295.418247] x17: 6964656d2f73736d x16: 00000000000006a0 x15: 000000000000006a
[  295.418257] x14: 0000000000000035 x13: ffffa32ef7d11298 x12: 0000000000000981
[  295.418267] x11: 000000000000032b x10: ffffa32ef7d69298 x9 : ffffa32ef7d11298
[  295.418277] x8 : 00000000ffffefff x7 : ffffa32ef7d69298 x6 : 80000000fffff000
[  295.418287] x5 : ffff5243f6feeb88 x4 : ffff80008790ba10 x3 : ffffaf14ff533000
[  295.418297] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff5242a14e3c00
[  295.418307] Call trace:
[  295.418312]  refcount_warn_saturate+0xf4/0x144
[  295.418319]  device_link_put_kref+0x7c/0xb8
[  295.418327]  device_link_del+0x30/0x48
[  295.418334]  msm_vfe_genpd_cleanup+0x20/0x3c [qcom_camss]
[  295.419086]  camss_genpd_cleanup+0x5c/0x7c [qcom_camss]
[  295.419765]  camss_remove+0x80/0x90 [qcom_camss]
[  295.420445]  platform_remove+0x2c/0x6c
[  295.421124]  device_remove+0x4c/0x80
[  295.421793]  device_release_driver_internal+0x1cc/0x228
[  295.422451]  driver_detach+0x88/0xf8
[  295.423105]  bus_remove_driver+0x70/0xf4
[  295.423782]  driver_unregister+0x30/0x60
[  295.424447]  platform_driver_unregister+0x14/0x20
[  295.425113]  qcom_camss_driver_exit+0x18/0x1064 [qcom_camss]
[  295.425777]  __arm64_sys_delete_module+0x184/0x298
[  295.426431]  invoke_syscall+0x48/0x110
[  295.427079]  el0_svc_common.constprop.0+0x40/0xe0
[  295.427727]  do_el0_svc+0x1c/0x28
[  295.428371]  el0_svc+0x40/0xe4
[  295.429017]  el0t_64_sync_handler+0x120/0x12c
[  295.429662]  el0t_64_sync+0x190/0x194
[  295.430304] ---[ end trace 0000000000000000 ]---
[  295.431043] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000210
[  295.431724] Mem abort info:
[  295.432389]   ESR = 0x0000000096000006
[  295.433061]   EC = 0x25: DABT (current EL), IL = 32 bits
[  295.433714]   SET = 0, FnV = 0
[  295.434357]   EA = 0, S1PTW = 0
[  295.434993]   FSC = 0x06: level 2 translation fault
[  295.435633] Data abort info:
[  295.436274]   ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000
[  295.436931]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  295.437587]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  295.438240] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000151fcf000
[  295.438901] [0000000000000210] pgd=080000015418b003, p4d=080000015418b003, pud=0800000154193003, pmd=0000000000000000
[  295.439579] Internal error: Oops: 0000000096000006 [#1] SMP
[  295.440246] Modules linked in: qcom_camss(-) imx800 venus_enc venus_dec venus_core v4l2_mem2mem videobuf2_v4l2 videobuf2_dma_sg videobuf2_dma_contig videobuf2_memops videobuf2_common ipa ath11k_ahb
[  295.441636] CPU: 7 PID: 3911 Comm: rmmod Tainted: G        W          6.6.0-rc7-00162-g8dbaf6f3286e-dirty #5
[  295.442338] Hardware name: Fairphone 5 (DT)
[  295.443038] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  295.443747] pc : dev_pm_domain_detach+0x0/0x34
[  295.444464] lr : msm_vfe_genpd_cleanup+0x2c/0x3c [qcom_camss]
[  295.445195] sp : ffff80008790bbe0
[  295.445912] x29: ffff80008790bbe0 x28: ffff5242a14e3c00 x27: 0000000000000000
[  295.446637] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
[  295.447364] x23: ffff52428001c090 x22: ffff5242809c6090 x21: 0000000000002f30
[  295.448098] x20: ffff52428a5d9080 x19: ffff5242b7108e10 x18: ffffffffffffffff
[  295.448829] x17: 6964656d2f73736d x16: ffffa32ef6e69fbc x15: 3d305f454c424954
[  295.449554] x14: 0000000000000004 x13: ffff52428000a310 x12: 0000000000000000
[  295.450280] x11: ffff5242a8afaa18 x10: ffff5242a8afa910 x9 : ffff52428000a310
[  295.451007] x8 : 0000000000000001 x7 : 0000000000210d00 x6 : 0000000000000000
[  295.451735] x5 : 0000000000000001 x4 : fffffd490a24f9e0 x3 : 0000000080800077
[  295.452467] x2 : ffff5242893e7520 x1 : 0000000000000001 x0 : 0000000000000000
[  295.453201] Call trace:
[  295.453928]  dev_pm_domain_detach+0x0/0x34
[  295.454653]  camss_genpd_cleanup+0x5c/0x7c [qcom_camss]
[  295.455383]  camss_remove+0x80/0x90 [qcom_camss]
[  295.456107]  platform_remove+0x2c/0x6c
[  295.456818]  device_remove+0x4c/0x80
[  295.457523]  device_release_driver_internal+0x1cc/0x228
[  295.458230]  driver_detach+0x88/0xf8
[  295.458933]  bus_remove_driver+0x70/0xf4
[  295.459637]  driver_unregister+0x30/0x60
[  295.460336]  platform_driver_unregister+0x14/0x20
[  295.461039]  qcom_camss_driver_exit+0x18/0x1064 [qcom_camss]
[  295.461745]  __arm64_sys_delete_module+0x184/0x298
[  295.462448]  invoke_syscall+0x48/0x110
[  295.463148]  el0_svc_common.constprop.0+0x40/0xe0
[  295.463849]  do_el0_svc+0x1c/0x28
[  295.464548]  el0_svc+0x40/0xe4
[  295.465248]  el0t_64_sync_handler+0x120/0x12c
[  295.465947]  el0t_64_sync+0x190/0x194
[  295.466643] Code: a8c17bfd d50323bf d65f03c0 d65f03c0 (f9410802)
[  295.469350] ---[ end trace 0000000000000000 ]---