program:
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x0}, 0x20)
syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
socket$phonet_pipe(0x23, 0x5, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./proc\x00', 0x4)
rename(0x0, 0x0)
r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="01", @ANYBLOB], 0x50)
ioctl$OCFS2_IOC_GROUP_ADD(r0, 0x40186f02, 0x0)
mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x4000, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000005600)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000005640)='./sys\x00', &(0x7f0000005680)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000056c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000005700)='./dev\x00', &(0x7f0000005740)='devtmpfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000005780)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r2, &(0x7f00000057c0)='md0', 0x3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000005800)='./dev/md0\x00', 0x2, 0x0)
ioctl(r3, 0x40480923, &(0x7f0000005840)="00000000000000000000000000000000050000000010000003000000030000000000000001000000000000000100000003000000030000000000000000000000020000000010")
ioctl(r3, 0x40140921, &(0x7f00000058c0)="0000000001")
ioctl(r3, 0x400c0930, 0x0)
write(r1, &(0x7f0000005940)='2', 0x1)
syz_open_procfs(0x0, 0x0)
[ 115.283462][ T4670] Bluetooth: hci0: command tx timeout
[ 115.491861][ T5357] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 115.574517][ T5357] FAULT_INJECTION: forcing a failure.
[ 115.574517][ T5357] name fail_page_alloc, interval 1, probability 0, space 0, times 1
[ 115.574544][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 115.574563][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 115.574570][ T5357] Call Trace:
[ 115.574586][ T5357]
[ 115.574592][ T5357] dump_stack_lvl+0xe8/0x150
[ 115.574699][ T5357] should_fail_ex+0x410/0x560
[ 115.574762][ T5357] prepare_alloc_pages+0x21e/0x5f0
[ 115.574790][ T5357] __alloc_frozen_pages_noprof+0x17a/0x400
[ 115.574807][ T5357] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 115.574829][ T5357] ? policy_nodemask+0x2cc/0x8e0
[ 115.574844][ T5357] ? rcu_is_watching+0x16/0xb0
[ 115.574873][ T5357] alloc_pages_mpol+0x21e/0x390
[ 115.574892][ T5357] ___kmalloc_large_node+0x7b/0x170
[ 115.574906][ T5357] __kmalloc_large_noprof+0x1a/0x90
[ 115.574918][ T5357] setup_conf+0x420/0x2ad0
[ 115.574982][ T5357] ? __pfx___schedule+0x10/0x10
[ 115.575094][ T5357] ? xa_find_after+0xae/0x430
[ 115.575106][ T5357] ? __pfx_setup_conf+0x10/0x10
[ 115.575124][ T5357] ? preempt_schedule_common+0x7f/0xd0
[ 115.575141][ T5357] raid5_run+0x8cc/0x2560
[ 115.575156][ T5357] ? _raw_spin_unlock+0x41/0x50
[ 115.575167][ T5357] ? get_pers+0x22b/0x2e0
[ 115.575185][ T5357] ? __pfx_get_pers+0x10/0x10
[ 115.575208][ T5357] md_run+0xc3d/0x1cd0
[ 115.575231][ T5357] ? __pfx_md_run+0x10/0x10
[ 115.575254][ T5357] do_md_run+0x35/0x720
[ 115.575269][ T5357] ? md_ioctl+0x1e23/0x2610
[ 115.575283][ T5357] md_ioctl+0x1e2b/0x2610
[ 115.575296][ T5357] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 115.575324][ T5357] ? tomoyo_path_number_perm+0x219/0x5f0
[ 115.575345][ T5357] ? __pfx_md_ioctl+0x10/0x10
[ 115.575355][ T5357] ? do_vfs_ioctl+0x116f/0x1530
[ 115.575381][ T5357] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 115.575403][ T5357] ? do_futex+0x458/0x4e0
[ 115.575426][ T5357] ? __pfx_md_ioctl+0x10/0x10
[ 115.575437][ T5357] blkdev_ioctl+0x5e3/0x740
[ 115.575456][ T5357] ? __pfx_blkdev_ioctl+0x10/0x10
[ 115.575473][ T5357] ? bpf_lsm_file_ioctl+0x9/0x20
[ 115.575490][ T5357] ? __pfx_blkdev_ioctl+0x10/0x10
[ 115.575504][ T5357] __se_sys_ioctl+0xfc/0x170
[ 115.575514][ T5357] do_syscall_64+0x166/0x520
[ 115.575526][ T5357] ? trace_irq_disable+0x3b/0x140
[ 115.575541][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.575553][ T5357] ? clear_bhb_loop+0x70/0xc0
[ 115.575568][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.575579][ T5357] RIP: 0033:0x7fae13d9f559
[ 115.575593][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 115.575602][ T5357] RSP: 002b:00007fae14d1cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 115.575617][ T5357] RAX: ffffffffffffffda RBX: 00007fae14025fa0 RCX: 00007fae13d9f559
[ 115.575625][ T5357] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000007
[ 115.575633][ T5357] RBP: 00007fae13e36b20 R08: 0000000000000000 R09: 0000000000000000
[ 115.575641][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 115.575648][ T5357] R13: 00007fae14026038 R14: 00007fae14025fa0 R15: 00007ffc696bc988
[ 115.575667][ T5357]
[ 115.575787][ T5357] ==================================================================
[ 115.575793][ T5357] BUG: KASAN: null-ptr-deref in free_conf+0x81/0x5d0
[ 115.575810][ T5357] Read of size 8 at addr 0000000000000028 by task syz.0.0/5357
[ 115.575818][ T5357]
[ 115.575824][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 115.575836][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 115.575843][ T5357] Call Trace:
[ 115.575848][ T5357]
[ 115.575853][ T5357] dump_stack_lvl+0xe8/0x150
[ 115.575871][ T5357] ? free_conf+0x81/0x5d0
[ 115.575885][ T5357] kasan_report+0x117/0x150
[ 115.575900][ T5357] ? free_conf+0x81/0x5d0
[ 115.575916][ T5357] kasan_check_range+0x264/0x2c0
[ 115.575930][ T5357] free_conf+0x81/0x5d0
[ 115.575947][ T5357] setup_conf+0x1720/0x2ad0
[ 115.575962][ T5357] ? __pfx___schedule+0x10/0x10
[ 115.575976][ T5357] ? xa_find_after+0xae/0x430
[ 115.575986][ T5357] ? __pfx_setup_conf+0x10/0x10
[ 115.576000][ T5357] ? preempt_schedule_common+0x7f/0xd0
[ 115.576013][ T5357] raid5_run+0x8cc/0x2560
[ 115.576027][ T5357] ? _raw_spin_unlock+0x41/0x50
[ 115.576038][ T5357] ? get_pers+0x22b/0x2e0
[ 115.576055][ T5357] ? __pfx_get_pers+0x10/0x10
[ 115.576073][ T5357] md_run+0xc3d/0x1cd0
[ 115.576090][ T5357] ? __pfx_md_run+0x10/0x10
[ 115.576108][ T5357] do_md_run+0x35/0x720
[ 115.576123][ T5357] ? md_ioctl+0x1e23/0x2610
[ 115.576133][ T5357] md_ioctl+0x1e2b/0x2610
[ 115.576143][ T5357] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 115.576160][ T5357] ? tomoyo_path_number_perm+0x219/0x5f0
[ 115.576178][ T5357] ? __pfx_md_ioctl+0x10/0x10
[ 115.576188][ T5357] ? do_vfs_ioctl+0x116f/0x1530
[ 115.576203][ T5357] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 115.576218][ T5357] ? do_futex+0x458/0x4e0
[ 115.576233][ T5357] ? __pfx_md_ioctl+0x10/0x10
[ 115.576243][ T5357] blkdev_ioctl+0x5e3/0x740
[ 115.576257][ T5357] ? __pfx_blkdev_ioctl+0x10/0x10
[ 115.576271][ T5357] ? bpf_lsm_file_ioctl+0x9/0x20
[ 115.576284][ T5357] ? __pfx_blkdev_ioctl+0x10/0x10
[ 115.576297][ T5357] __se_sys_ioctl+0xfc/0x170
[ 115.576309][ T5357] do_syscall_64+0x166/0x520
[ 115.576322][ T5357] ? trace_irq_disable+0x3b/0x140
[ 115.576337][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.576348][ T5357] ? clear_bhb_loop+0x70/0xc0
[ 115.576360][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.576371][ T5357] RIP: 0033:0x7fae13d9f559
[ 115.576382][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 115.576390][ T5357] RSP: 002b:00007fae14d1cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 115.576401][ T5357] RAX: ffffffffffffffda RBX: 00007fae14025fa0 RCX: 00007fae13d9f559
[ 115.576410][ T5357] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000007
[ 115.576418][ T5357] RBP: 00007fae13e36b20 R08: 0000000000000000 R09: 0000000000000000
[ 115.576426][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 115.576432][ T5357] R13: 00007fae14026038 R14: 00007fae14025fa0 R15: 00007ffc696bc988
[ 115.576467][ T5357]
[ 115.576474][ T5357] ==================================================================
[ 115.576530][ T5357] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 115.846496][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 115.850235][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 115.854480][ T5357] Call Trace:
[ 115.855962][ T5357]
[ 115.857253][ T5357] vpanic+0x56d/0xa60
[ 115.858966][ T5357] ? rcu_is_watching+0x16/0xb0
[ 115.861117][ T5357] ? __pfx_vpanic+0x10/0x10
[ 115.863133][ T5357] ? __pfx___schedule+0x10/0x10
[ 115.865130][ T5357] panic+0xc5/0xd0
[ 115.866724][ T5357] ? __pfx_panic+0x10/0x10
[ 115.868612][ T5357] ? preempt_schedule_thunk+0x16/0x40
[ 115.870971][ T5357] ? free_conf+0x81/0x5d0
[ 115.872827][ T5357] check_panic_on_warn+0x89/0xb0
[ 115.874972][ T5357] ? free_conf+0x81/0x5d0
[ 115.877042][ T5357] end_report+0x73/0x170
[ 115.878921][ T5357] ? free_conf+0x81/0x5d0
[ 115.880795][ T5357] kasan_report+0x128/0x150
[ 115.882726][ T5357] ? free_conf+0x81/0x5d0
[ 115.884505][ T5357] kasan_check_range+0x264/0x2c0
[ 115.886604][ T5357] free_conf+0x81/0x5d0
[ 115.888341][ T5357] setup_conf+0x1720/0x2ad0
[ 115.890286][ T5357] ? __pfx___schedule+0x10/0x10
[ 115.892314][ T5357] ? xa_find_after+0xae/0x430
[ 115.894255][ T5357] ? __pfx_setup_conf+0x10/0x10
[ 115.896359][ T5357] ? preempt_schedule_common+0x7f/0xd0
[ 115.898614][ T5357] raid5_run+0x8cc/0x2560
[ 115.900467][ T5357] ? _raw_spin_unlock+0x41/0x50
[ 115.902509][ T5357] ? get_pers+0x22b/0x2e0
[ 115.904326][ T5357] ? __pfx_get_pers+0x10/0x10
[ 115.906308][ T5357] md_run+0xc3d/0x1cd0
[ 115.908190][ T5357] ? __pfx_md_run+0x10/0x10
[ 115.910102][ T5357] do_md_run+0x35/0x720
[ 115.911910][ T5357] ? md_ioctl+0x1e23/0x2610
[ 115.913833][ T5357] md_ioctl+0x1e2b/0x2610
[ 115.915748][ T5357] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 115.918103][ T5357] ? tomoyo_path_number_perm+0x219/0x5f0
[ 115.920538][ T5357] ? __pfx_md_ioctl+0x10/0x10
[ 115.922522][ T5357] ? do_vfs_ioctl+0x116f/0x1530
[ 115.924580][ T5357] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 115.926757][ T5357] ? do_futex+0x458/0x4e0
[ 115.928581][ T5357] ? __pfx_md_ioctl+0x10/0x10
[ 115.930615][ T5357] blkdev_ioctl+0x5e3/0x740
[ 115.932675][ T5357] ? __pfx_blkdev_ioctl+0x10/0x10
[ 115.934821][ T5357] ? bpf_lsm_file_ioctl+0x9/0x20
[ 115.936989][ T5357] ? __pfx_blkdev_ioctl+0x10/0x10
[ 115.939131][ T5357] __se_sys_ioctl+0xfc/0x170
[ 115.941146][ T5357] do_syscall_64+0x166/0x520
[ 115.943445][ T5357] ? trace_irq_disable+0x3b/0x140
[ 115.945835][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.948457][ T5357] ? clear_bhb_loop+0x70/0xc0
[ 115.950450][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 115.952952][ T5357] RIP: 0033:0x7fae13d9f559
[ 115.954899][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 115.962963][ T5357] RSP: 002b:00007fae14d1cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 115.966495][ T5357] RAX: ffffffffffffffda RBX: 00007fae14025fa0 RCX: 00007fae13d9f559
[ 115.970199][ T5357] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000007
[ 115.973628][ T5357] RBP: 00007fae13e36b20 R08: 0000000000000000 R09: 0000000000000000
[ 115.976985][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 115.980235][ T5357] R13: 00007fae14026038 R14: 00007fae14025fa0 R15: 00007ffc696bc988
[ 115.983548][ T5357]
[ 115.985230][ T5357] Kernel Offset: disabled
[ 115.987052][ T5357] Rebooting in 86400 seconds..