program:
openat$dm_control(0xffffffffffffff9c, 0x0, 0x88002, 0x0)
r0 = openat$md_new_array(0xffffffffffffff9c, &(0x7f0000010bc0), 0x1, 0x0)
write$md_new_array(r0, &(0x7f0000010c00)={'md', @num=0x0}, 0x3)
r1 = openat$md(0xffffffffffffff9c, &(0x7f0000010c40)={'/dev/md', @num=0x0}, 0x2, 0x0)
syz_open_procfs(0x0, &(0x7f0000000000)='net/vlan/config\x00')
ioctl$SET_ARRAY_INFO(r1, 0x40480923, &(0x7f0000010c80)={0x0, 0x2, 0x0, 0x7fff, 0x1, 0x27fe, 0x0, 0x402})
ioctl$ADD_NEW_DISK(r1, 0x40140921, &(0x7f0000010d00)={0x0, {0x1, 0x0}, 0x0, 0x6})
ioctl$ADD_NEW_DISK(r1, 0x40140921, 0x0)
ioctl$RUN_ARRAY(r1, 0x400c0930, 0x0)
pwrite64(r1, 0x0, 0x0, 0x1000)
write$md_new_array(0xffffffffffffffff, &(0x7f0000000080)={'md', @num=0x0}, 0x3)
openat$md_sysfs(0xffffffffffffff9c, 0x0, 0x1, 0x0)
r2 = openat$md_sysfs(0xffffffffffffff9c, &(0x7f00000001c0)={'/sys/block/md', @num=0x0, '/md/', @array='component_size\x00'}, 0x1, 0x0)
write$md_sysfs(r2, &(0x7f0000000200)=@str='512', 0x3)
[ 133.514195][ T4669] Bluetooth: hci0: command tx timeout
[ 133.579639][ T5362] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 133.738845][ T5362] md/raid1:md0: active with 1 out of 1026 mirrors
[ 133.739493][ T5362] ------------[ cut here ]------------
[ 133.739512][ T5362] UBSAN: array-index-out-of-bounds in drivers/md/md.c:1726:20
[ 133.739532][ T5362] index 28 is out of range for type 'mdp_disk_t[27]' (aka 'struct mdp_device_descriptor_s[27]')
[ 133.739558][ T5362] CPU: 0 UID: 0 PID: 5362 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 133.739572][ T5362] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 133.739580][ T5362] Call Trace:
[ 133.739603][ T5362]
[ 133.739620][ T5362] dump_stack_lvl+0xe8/0x150
[ 133.739732][ T5362] ubsan_epilogue+0xa/0x30
[ 133.739755][ T5362] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 133.739811][ T5362] super_90_sync+0x1398/0x21d0
[ 133.739867][ T5362] ? __pfx_super_90_sync+0x10/0x10
[ 133.739894][ T5362] md_update_sb+0xd0d/0x26a0
[ 133.739929][ T5362] ? __pfx_md_update_sb+0x10/0x10
[ 133.739944][ T5362] ? kernfs_put+0x7b9/0x820
[ 133.739961][ T5362] ? kernfs_create_link+0x1cd/0x240
[ 133.739979][ T5362] md_run+0x15b6/0x1cd0
[ 133.740001][ T5362] ? __pfx_md_run+0x10/0x10
[ 133.740025][ T5362] do_md_run+0x35/0x720
[ 133.740041][ T5362] ? md_ioctl+0x1e23/0x2610
[ 133.740059][ T5362] md_ioctl+0x1e2b/0x2610
[ 133.740096][ T5362] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 133.740119][ T5362] ? tomoyo_path_number_perm+0x219/0x5f0
[ 133.740137][ T5362] ? __pfx_md_ioctl+0x10/0x10
[ 133.740155][ T5362] ? do_vfs_ioctl+0x116f/0x1530
[ 133.740176][ T5362] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 133.740191][ T5362] ? trace_sched_exit_tp+0x3a/0x130
[ 133.740223][ T5362] ? do_futex+0x3e7/0x4e0
[ 133.740255][ T5362] ? __pfx_md_ioctl+0x10/0x10
[ 133.740274][ T5362] blkdev_ioctl+0x5e3/0x740
[ 133.740296][ T5362] ? __pfx_blkdev_ioctl+0x10/0x10
[ 133.740313][ T5362] ? bpf_lsm_file_ioctl+0x9/0x20
[ 133.740355][ T5362] ? __pfx_blkdev_ioctl+0x10/0x10
[ 133.740370][ T5362] __se_sys_ioctl+0xfc/0x170
[ 133.740387][ T5362] do_syscall_64+0x166/0x520
[ 133.740440][ T5362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 133.740456][ T5362] ? clear_bhb_loop+0x70/0xc0
[ 133.740471][ T5362] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 133.740482][ T5362] RIP: 0033:0x7f0a2ff9f559
[ 133.740497][ T5362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 133.740506][ T5362] RSP: 002b:00007f0a30ec4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 133.740528][ T5362] RAX: ffffffffffffffda RBX: 00007f0a30225fa0 RCX: 00007f0a2ff9f559
[ 133.740538][ T5362] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004
[ 133.740545][ T5362] RBP: 00007f0a30036b20 R08: 0000000000000000 R09: 0000000000000000
[ 133.740553][ T5362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 133.740560][ T5362] R13: 00007f0a30226038 R14: 00007f0a30225fa0 R15: 00007ffd048fea58
[ 133.740591][ T5362]
[ 133.740812][ T5362] ---[ end trace ]---
[ 133.740833][ T5362] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 133.862169][ T5362] CPU: 0 UID: 0 PID: 5362 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 133.867773][ T5362] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 133.871368][ T5362] Call Trace:
[ 133.872571][ T5362]
[ 133.873712][ T5362] vpanic+0x56d/0xa60
[ 133.875182][ T5362] ? __pfx_vpanic+0x10/0x10
[ 133.877036][ T5362] panic+0xc5/0xd0
[ 133.878442][ T5362] ? __pfx_panic+0x10/0x10
[ 133.880058][ T5362] ? __pfx__printk+0x10/0x10
[ 133.881678][ T5362] check_panic_on_warn+0x89/0xb0
[ 133.883408][ T5362] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 133.885469][ T5362] super_90_sync+0x1398/0x21d0
[ 133.887305][ T5362] ? __pfx_super_90_sync+0x10/0x10
[ 133.889325][ T5362] md_update_sb+0xd0d/0x26a0
[ 133.891024][ T5362] ? __pfx_md_update_sb+0x10/0x10
[ 133.892955][ T5362] ? kernfs_put+0x7b9/0x820
[ 133.894776][ T5362] ? kernfs_create_link+0x1cd/0x240
[ 133.896832][ T5362] md_run+0x15b6/0x1cd0
[ 133.898545][ T5362] ? __pfx_md_run+0x10/0x10
[ 133.900459][ T5362] do_md_run+0x35/0x720
[ 133.902106][ T5362] ? md_ioctl+0x1e23/0x2610
[ 133.903949][ T5362] md_ioctl+0x1e2b/0x2610
[ 133.905661][ T5362] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 133.907810][ T5362] ? tomoyo_path_number_perm+0x219/0x5f0
[ 133.910033][ T5362] ? __pfx_md_ioctl+0x10/0x10
[ 133.911823][ T5362] ? do_vfs_ioctl+0x116f/0x1530
[ 133.913723][ T5362] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 133.915659][ T5362] ? trace_sched_exit_tp+0x3a/0x130
[ 133.917816][ T5362] ? do_futex+0x3e7/0x4e0
[ 133.919596][ T5362] ? __pfx_md_ioctl+0x10/0x10
[ 133.921454][ T5362] blkdev_ioctl+0x5e3/0x740
[ 133.923343][ T5362] ? __pfx_blkdev_ioctl+0x10/0x10
[ 133.925424][ T5362] ? bpf_lsm_file_ioctl+0x9/0x20
[ 133.927506][ T5362] ? __pfx_blkdev_ioctl+0x10/0x10
[ 133.929589][ T5362] __se_sys_ioctl+0xfc/0x170
[ 133.931550][ T5362] do_syscall_64+0x166/0x520
[ 133.933425][ T5362] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 133.935829][ T5362] ? clear_bhb_loop+0x70/0xc0
[ 133.937789][ T5362] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 133.940183][ T5362] RIP: 0033:0x7f0a2ff9f559
[ 133.942066][ T5362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 133.949849][ T5362] RSP: 002b:00007f0a30ec4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 133.953230][ T5362] RAX: ffffffffffffffda RBX: 00007f0a30225fa0 RCX: 00007f0a2ff9f559
[ 133.956273][ T5362] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000004
[ 133.959514][ T5362] RBP: 00007f0a30036b20 R08: 0000000000000000 R09: 0000000000000000
[ 133.962626][ T5362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 133.965840][ T5362] R13: 00007f0a30226038 R14: 00007f0a30225fa0 R15: 00007ffd048fea58
[ 133.969182][ T5362]
[ 133.970739][ T5362] Kernel Offset: disabled
[ 133.972479][ T5362] Rebooting in 86400 seconds..