program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='sysfs\x00', 0x8, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x98, 0x130, 0xffffffff, 0xffffffff, 0x0, 0x98, 0x1f0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x8081, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="0000004a0000000004000002000000020000000000000001000000007c")
ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001")
ioctl(r1, 0x2, 0x0)
mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/modprobe\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='/bin/true', 0x9)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='md0\x00', 0x3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x2, 0x0)
write(r4, &(0x7f0000000300)='raid1', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='1:0', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x141)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0)
write(r6, &(0x7f0000000480)='0', 0x1)
r7 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/array_state\x00', 0x2, 0x0)
write(r7, &(0x7f0000000500)='active', 0x6)
[ 96.396137][ T5279] Bluetooth: hci0: command tx timeout
[ 96.531535][ T5321] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 96.572889][ T5321] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 96.606532][ T5321] md: could not open device unknown-block(1,0).
[ 96.666401][ T5321] md/raid1:md0: active with 1 out of 124 mirrors
[ 96.671572][ T5321] ------------[ cut here ]------------
[ 96.671585][ T5321] UBSAN: array-index-out-of-bounds in drivers/md/md.c:1726:20
[ 96.672184][ T5321] index 28 is out of range for type 'mdp_disk_t[27]' (aka 'struct mdp_device_descriptor_s[27]')
[ 96.672203][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.672219][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.672227][ T5321] Call Trace:
[ 96.672234][ T5321]
[ 96.672241][ T5321] dump_stack_lvl+0xe8/0x150
[ 96.672343][ T5321] ubsan_epilogue+0xa/0x30
[ 96.672361][ T5321] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 96.672458][ T5321] super_90_sync+0x1398/0x21d0
[ 96.672527][ T5321] ? __pfx_super_90_sync+0x10/0x10
[ 96.672543][ T5321] md_update_sb+0xd0d/0x26a0
[ 96.672581][ T5321] ? __pfx_md_update_sb+0x10/0x10
[ 96.672598][ T5321] ? kernfs_put+0x7b9/0x820
[ 96.672643][ T5321] ? kernfs_create_link+0x187/0x200
[ 96.672664][ T5321] md_run+0x15b6/0x1cd0
[ 96.672683][ T5321] ? __lock_acquire+0x1511/0x2de0
[ 96.672719][ T5321] ? __pfx_md_run+0x10/0x10
[ 96.672741][ T5321] ? set_disk_ro+0x1da/0x220
[ 96.672772][ T5321] ? __pfx_set_disk_ro+0x10/0x10
[ 96.672795][ T5321] do_md_run+0x35/0x720
[ 96.672811][ T5321] array_state_store+0x958/0xe90
[ 96.672835][ T5321] md_attr_store+0x3b7/0x640
[ 96.672856][ T5321] ? __pfx_sysfs_kf_write+0x10/0x10
[ 96.672868][ T5321] kernfs_fop_write_iter+0x3a4/0x540
[ 96.672885][ T5321] vfs_write+0x612/0xba0
[ 96.672922][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 96.672945][ T5321] ? __fget_files+0x2a/0x420
[ 96.672978][ T5321] ksys_write+0x150/0x270
[ 96.672994][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 96.673018][ T5321] do_syscall_64+0x166/0x520
[ 96.673031][ T5321] ? trace_irq_disable+0x3b/0x140
[ 96.673052][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.673065][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 96.673079][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.673093][ T5321] RIP: 0033:0x7fa77c99e159
[ 96.673105][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.673116][ T5321] RSP: 002b:00007fa77d7c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 96.673130][ T5321] RAX: ffffffffffffffda RBX: 00007fa77cc25fa0 RCX: 00007fa77c99e159
[ 96.673140][ T5321] RDX: 0000000000000006 RSI: 0000200000000500 RDI: 000000000000000b
[ 96.673149][ T5321] RBP: 00007fa77ca3503b R08: 0000000000000000 R09: 0000000000000000
[ 96.673157][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.673163][ T5321] R13: 00007fa77cc26038 R14: 00007fa77cc25fa0 R15: 00007fff05b372c8
[ 96.673184][ T5321]
[ 96.673242][ T5321] ---[ end trace ]---
[ 96.673251][ T5321] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 96.796618][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.800318][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.804437][ T5321] Call Trace:
[ 96.805854][ T5321]
[ 96.807080][ T5321] vpanic+0x56d/0xa60
[ 96.808707][ T5321] ? __pfx_vpanic+0x10/0x10
[ 96.810607][ T5321] panic+0xc5/0xd0
[ 96.812204][ T5321] ? __pfx_panic+0x10/0x10
[ 96.814282][ T5321] ? __pfx__printk+0x10/0x10
[ 96.816355][ T5321] check_panic_on_warn+0x89/0xb0
[ 96.818580][ T5321] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 96.821143][ T5321] super_90_sync+0x1398/0x21d0
[ 96.823418][ T5321] ? __pfx_super_90_sync+0x10/0x10
[ 96.825786][ T5321] md_update_sb+0xd0d/0x26a0
[ 96.827921][ T5321] ? __pfx_md_update_sb+0x10/0x10
[ 96.830271][ T5321] ? kernfs_put+0x7b9/0x820
[ 96.832393][ T5321] ? kernfs_create_link+0x187/0x200
[ 96.834747][ T5321] md_run+0x15b6/0x1cd0
[ 96.836604][ T5321] ? __lock_acquire+0x1511/0x2de0
[ 96.838700][ T5321] ? __pfx_md_run+0x10/0x10
[ 96.840656][ T5321] ? set_disk_ro+0x1da/0x220
[ 96.842592][ T5321] ? __pfx_set_disk_ro+0x10/0x10
[ 96.844686][ T5321] do_md_run+0x35/0x720
[ 96.846402][ T5321] array_state_store+0x958/0xe90
[ 96.848617][ T5321] md_attr_store+0x3b7/0x640
[ 96.850723][ T5321] ? __pfx_sysfs_kf_write+0x10/0x10
[ 96.853050][ T5321] kernfs_fop_write_iter+0x3a4/0x540
[ 96.855388][ T5321] vfs_write+0x612/0xba0
[ 96.857241][ T5321] ? __pfx_vfs_write+0x10/0x10
[ 96.859417][ T5321] ? __fget_files+0x2a/0x420
[ 96.861575][ T5321] ksys_write+0x150/0x270
[ 96.863614][ T5321] ? __pfx_ksys_write+0x10/0x10
[ 96.865783][ T5321] do_syscall_64+0x166/0x520
[ 96.867820][ T5321] ? trace_irq_disable+0x3b/0x140
[ 96.870099][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.872847][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 96.874979][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.877506][ T5321] RIP: 0033:0x7fa77c99e159
[ 96.879237][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.887581][ T5321] RSP: 002b:00007fa77d7c7fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 96.891224][ T5321] RAX: ffffffffffffffda RBX: 00007fa77cc25fa0 RCX: 00007fa77c99e159
[ 96.894652][ T5321] RDX: 0000000000000006 RSI: 0000200000000500 RDI: 000000000000000b
[ 96.898843][ T5321] RBP: 00007fa77ca3503b R08: 0000000000000000 R09: 0000000000000000
[ 96.902445][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.906013][ T5321] R13: 00007fa77cc26038 R14: 00007fa77cc25fa0 R15: 00007fff05b372c8
[ 96.909471][ T5321]
[ 96.911213][ T5321] Kernel Offset: disabled
[ 96.913092][ T5321] Rebooting in 86400 seconds..