program: r0 = openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write$md_new_array(r0, &(0x7f0000000080)={'md', @num=0x0}, 0x3) r1 = openat$md(0xffffffffffffff9c, &(0x7f00000001c0)={'/dev/md', @num=0x0}, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000a80), 0x74, 0x160341) mkdirat(0xffffffffffffff9c, &(0x7f0000000ac0)='./debug\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000b00)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mount(0x0, &(0x7f0000000b40)='./debug\x00', &(0x7f0000000b80)='debugfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000bc0)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r4, &(0x7f0000000c00)='+p', 0x2) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000c40)) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000c80)=@usbdevfs_connect) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000640)=@nat={'nat\x00', 0x670, 0x5, 0x3c8, 0xa8, 0xa8, 0xfeffffff, 0x288, 0x288, 0x330, 0x330, 0xffffffff, 0x330, 0x330, 0x5, 0x0, {[{{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x6800, {0x0, @multicast2, @rand_addr=0x64010100, @port, @gre_key=0x3}}}}, {{@uncond, 0x0, 0x100, 0x138, 0x0, {0x0, 0x7}, [@common=@osf={{0x50}, {'syz0\x00'}}, @common=@set={{0x40}, {{0x1, [0x4, 0x7, 0x0, 0x6, 0x2, 0xc], 0x0, 0x4}}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x4, @private=0xa010102, @private=0xa010101, @port=0x4e22, @port=0x4e24}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x6, @dev={0xac, 0x14, 0x14, 0x43}, @multicast1, @port=0x4e22, @port=0x4e21}}}}, {{@ip={@multicast2, @multicast2, 0x0, 0x0, 'veth1_virt_wifi\x00', 'vlan0\x00'}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, @port, @gre_key=0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x428) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) syz_open_dev$dmmidi(&(0x7f0000000180), 0x2, 0x80000) write$FUSE_GETXATTR(r5, &(0x7f00000003c0)={0x18, 0x0, 0x0, {0xfd0}}, 0x18) select(0x20, 0x0, &(0x7f0000000200)={0x4, 0x472, 0x1, 0x25, 0x101, 0x8000000000000001, 0x0, 0x3}, &(0x7f0000000240)={0x9, 0x5, 0x10000, 0x6, 0x6b, 0xe09, 0x0, 0x12dd4d2c}, &(0x7f0000000380)={0x0, 0x2710}) setsockopt$inet_udp_int(r5, 0x11, 0x67, &(0x7f0000000140)=0x8, 0x4) ioctl$SET_ARRAY_INFO(r1, 0x40480923, &(0x7f0000000280)={0x0, 0x5a, 0x0, 0x7fff, 0x1, 0x800, 0x0, 0x42}) ioctl$ADD_NEW_DISK(r1, 0x40140921, &(0x7f0000000300)={0x0, {0x1, 0x0}, 0x0, 0xa}) openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$ADD_NEW_DISK(r1, 0x40140921, &(0x7f0000000340)={0x1, {0x1, 0x1}, 0x1, 0x6}) ioctl$RUN_ARRAY(r1, 0x400c0930, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000540)={'gretap0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000600)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000cc0)=ANY=[@ANYRES16, @ANYRES32=r6, @ANYRES16=0x0], 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4010) r7 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r7, &(0x7f0000000440)='7', 0x1) openat$md(0xffffffffffffff9c, &(0x7f0000000480)={'/dev/md', @named={'_syz', 0x0, '1'}}, 0x4803, 0x0) [ 103.179256][ T4663] Bluetooth: hci0: command tx timeout [ 103.280087][ T5345] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 103.281510][ T5346] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 103.281615][ T5346] block device autoloading is deprecated and will be removed. [ 103.393106][ T5346] hub 6-0:1.0: USB hub found [ 103.395572][ T5346] hub 6-0:1.0: 8 ports detected [ 103.434015][ T5346] xt_REDIRECT: bad rangesize 26624. [ 103.554901][ T5346] md/raid1:md0: active with 1 out of 66 mirrors [ 103.555450][ T5346] ------------[ cut here ]------------ [ 103.555458][ T5346] UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:8 [ 103.555469][ T5346] index 66 is out of range for type 'mdp_disk_t[27]' (aka 'struct mdp_device_descriptor_s[27]') [ 103.555489][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.555503][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.555510][ T5346] Call Trace: [ 103.555516][ T5346] [ 103.555521][ T5346] dump_stack_lvl+0xe8/0x150 [ 103.555632][ T5346] ubsan_epilogue+0xa/0x30 [ 103.555648][ T5346] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 103.555710][ T5346] super_90_sync+0xf95/0x21d0 [ 103.555776][ T5346] ? __pfx_super_90_sync+0x10/0x10 [ 103.555796][ T5346] md_update_sb+0xd0d/0x26a0 [ 103.555826][ T5346] ? __pfx_md_update_sb+0x10/0x10 [ 103.555838][ T5346] ? kernfs_put+0x7b9/0x820 [ 103.555854][ T5346] ? kernfs_create_link+0x1cd/0x240 [ 103.555870][ T5346] md_run+0x15b6/0x1cd0 [ 103.555889][ T5346] ? __pfx_md_run+0x10/0x10 [ 103.555910][ T5346] do_md_run+0x35/0x720 [ 103.555924][ T5346] ? md_ioctl+0x1e23/0x2610 [ 103.555942][ T5346] md_ioctl+0x1e2b/0x2610 [ 103.555959][ T5346] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 103.555975][ T5346] ? tomoyo_path_number_perm+0x219/0x5f0 [ 103.555990][ T5346] ? __pfx_md_ioctl+0x10/0x10 [ 103.556004][ T5346] ? do_vfs_ioctl+0x116f/0x1530 [ 103.556020][ T5346] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 103.556041][ T5346] ? do_futex+0x458/0x4e0 [ 103.556063][ T5346] ? __pfx_md_ioctl+0x10/0x10 [ 103.556079][ T5346] blkdev_ioctl+0x5e3/0x740 [ 103.556097][ T5346] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.556113][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.556128][ T5346] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.556141][ T5346] __se_sys_ioctl+0xfc/0x170 [ 103.556156][ T5346] do_syscall_64+0x166/0x520 [ 103.556171][ T5346] ? trace_irq_disable+0x3b/0x140 [ 103.556186][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.556198][ T5346] ? clear_bhb_loop+0x70/0xc0 [ 103.556212][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.556224][ T5346] RIP: 0033:0x7f80ee79f559 [ 103.556235][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.556245][ T5346] RSP: 002b:00007f80eabd3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.556259][ T5346] RAX: ffffffffffffffda RBX: 00007f80eea26090 RCX: 00007f80ee79f559 [ 103.556268][ T5346] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004 [ 103.556276][ T5346] RBP: 00007f80ee836b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.556284][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.556292][ T5346] R13: 00007f80eea26128 R14: 00007f80eea26090 R15: 00007ffd963ecff8 [ 103.556311][ T5346] [ 103.556573][ T5346] ---[ end trace ]--- [ 103.556581][ T5346] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 103.677291][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.681074][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.685290][ T5346] Call Trace: [ 103.686710][ T5346] [ 103.687916][ T5346] vpanic+0x56d/0xa60 [ 103.689555][ T5346] ? __pfx_vpanic+0x10/0x10 [ 103.691497][ T5346] panic+0xc5/0xd0 [ 103.693084][ T5346] ? __pfx_panic+0x10/0x10 [ 103.694861][ T5346] ? __pfx__printk+0x10/0x10 [ 103.696867][ T5346] check_panic_on_warn+0x89/0xb0 [ 103.698950][ T5346] __ubsan_handle_out_of_bounds+0xe8/0xf0 [ 103.701374][ T5346] super_90_sync+0xf95/0x21d0 [ 103.703339][ T5346] ? __pfx_super_90_sync+0x10/0x10 [ 103.705500][ T5346] md_update_sb+0xd0d/0x26a0 [ 103.707428][ T5346] ? __pfx_md_update_sb+0x10/0x10 [ 103.709630][ T5346] ? kernfs_put+0x7b9/0x820 [ 103.711676][ T5346] ? kernfs_create_link+0x1cd/0x240 [ 103.713911][ T5346] md_run+0x15b6/0x1cd0 [ 103.715724][ T5346] ? __pfx_md_run+0x10/0x10 [ 103.717669][ T5346] do_md_run+0x35/0x720 [ 103.719454][ T5346] ? md_ioctl+0x1e23/0x2610 [ 103.721433][ T5346] md_ioctl+0x1e2b/0x2610 [ 103.723360][ T5346] ? tomoyo_path_number_perm+0x4ba/0x5f0 [ 103.725606][ T5346] ? tomoyo_path_number_perm+0x219/0x5f0 [ 103.727797][ T5346] ? __pfx_md_ioctl+0x10/0x10 [ 103.729674][ T5346] ? do_vfs_ioctl+0x116f/0x1530 [ 103.731638][ T5346] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 103.733721][ T5346] ? do_futex+0x458/0x4e0 [ 103.735525][ T5346] ? __pfx_md_ioctl+0x10/0x10 [ 103.737514][ T5346] blkdev_ioctl+0x5e3/0x740 [ 103.739382][ T5346] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.741517][ T5346] ? bpf_lsm_file_ioctl+0x9/0x20 [ 103.743632][ T5346] ? __pfx_blkdev_ioctl+0x10/0x10 [ 103.745769][ T5346] __se_sys_ioctl+0xfc/0x170 [ 103.747675][ T5346] do_syscall_64+0x166/0x520 [ 103.749666][ T5346] ? trace_irq_disable+0x3b/0x140 [ 103.751862][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.754458][ T5346] ? clear_bhb_loop+0x70/0xc0 [ 103.756456][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.759008][ T5346] RIP: 0033:0x7f80ee79f559 [ 103.760872][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.768852][ T5346] RSP: 002b:00007f80eabd3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.772455][ T5346] RAX: ffffffffffffffda RBX: 00007f80eea26090 RCX: 00007f80ee79f559 [ 103.775870][ T5346] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004 [ 103.779236][ T5346] RBP: 00007f80ee836b20 R08: 0000000000000000 R09: 0000000000000000 [ 103.782593][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.785995][ T5346] R13: 00007f80eea26128 R14: 00007f80eea26090 R15: 00007ffd963ecff8 [ 103.789322][ T5346] [ 103.790992][ T5346] Kernel Offset: disabled [ 103.792854][ T5346] Rebooting in 86400 seconds..