program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='sysfs\x00', 0x8, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x98, 0x130, 0xffffffff, 0xffffffff, 0x0, 0x98, 0x1f0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x8081, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="0000004a0000000004000002000000020000000000000001000000007c")
ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001")
ioctl(r1, 0x2, 0x0)
mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/modprobe\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='/bin/true', 0x9)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='md0\x00', 0x3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x2, 0x0)
write(r4, &(0x7f0000000300)='raid1', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='1:0', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x141)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0)
write(r6, &(0x7f0000000480)='0', 0x1)
r7 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/array_state\x00', 0x2, 0x0)
write(r7, &(0x7f0000000500)='active', 0x6)
[ 94.163961][ T5280] Bluetooth: hci0: command tx timeout
[ 94.460056][ T5317] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 94.498914][ T5317] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 94.541879][ T5317] md: could not open device unknown-block(1,0).
[ 94.598011][ T5317] md/raid1:md0: active with 1 out of 124 mirrors
[ 94.599776][ T5317] ------------[ cut here ]------------
[ 94.599800][ T5317] UBSAN: array-index-out-of-bounds in drivers/md/md.c:1726:20
[ 94.599819][ T5317] index 28 is out of range for type 'mdp_disk_t[27]' (aka 'struct mdp_device_descriptor_s[27]')
[ 94.599830][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.599844][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.599852][ T5317] Call Trace:
[ 94.599889][ T5317]
[ 94.599901][ T5317] dump_stack_lvl+0xe8/0x150
[ 94.599959][ T5317] ubsan_epilogue+0xa/0x30
[ 94.599974][ T5317] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 94.600021][ T5317] super_90_sync+0x1398/0x21d0
[ 94.600067][ T5317] ? __pfx_super_90_sync+0x10/0x10
[ 94.600078][ T5317] md_update_sb+0xd0d/0x26a0
[ 94.600113][ T5317] ? __pfx_md_update_sb+0x10/0x10
[ 94.600129][ T5317] ? kernfs_put+0x7b9/0x820
[ 94.600147][ T5317] ? kernfs_create_link+0x187/0x200
[ 94.600164][ T5317] md_run+0x15b6/0x1cd0
[ 94.600180][ T5317] ? __lock_acquire+0x1511/0x2de0
[ 94.600199][ T5317] ? __pfx_md_run+0x10/0x10
[ 94.600216][ T5317] ? set_disk_ro+0x1da/0x220
[ 94.600231][ T5317] ? __pfx_set_disk_ro+0x10/0x10
[ 94.600250][ T5317] do_md_run+0x35/0x720
[ 94.600264][ T5317] array_state_store+0x958/0xe90
[ 94.600286][ T5317] md_attr_store+0x3b7/0x640
[ 94.600308][ T5317] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.600321][ T5317] kernfs_fop_write_iter+0x3a4/0x540
[ 94.600332][ T5317] vfs_write+0x612/0xba0
[ 94.600345][ T5317] ? __pfx_vfs_write+0x10/0x10
[ 94.600358][ T5317] ? __fget_files+0x2a/0x420
[ 94.600370][ T5317] ksys_write+0x150/0x270
[ 94.600381][ T5317] ? __pfx_ksys_write+0x10/0x10
[ 94.600395][ T5317] do_syscall_64+0x166/0x520
[ 94.600416][ T5317] ? trace_irq_disable+0x3b/0x140
[ 94.600428][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.600441][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 94.600455][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.600466][ T5317] RIP: 0033:0x7f1fd9b9e159
[ 94.600480][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.600500][ T5317] RSP: 002b:00007f1fdaa0dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.600515][ T5317] RAX: ffffffffffffffda RBX: 00007f1fd9e25fa0 RCX: 00007f1fd9b9e159
[ 94.600524][ T5317] RDX: 0000000000000006 RSI: 0000200000000500 RDI: 000000000000000b
[ 94.600534][ T5317] RBP: 00007f1fd9c3503b R08: 0000000000000000 R09: 0000000000000000
[ 94.600542][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.600549][ T5317] R13: 00007f1fd9e26038 R14: 00007f1fd9e25fa0 R15: 00007fffad190ac8
[ 94.600571][ T5317]
[ 94.602063][ T5317] ---[ end trace ]---
[ 94.602088][ T5317] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 94.723736][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.727529][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.731272][ T5317] Call Trace:
[ 94.732570][ T5317]
[ 94.733929][ T5317] vpanic+0x56d/0xa60
[ 94.735754][ T5317] ? __pfx_vpanic+0x10/0x10
[ 94.737754][ T5317] panic+0xc5/0xd0
[ 94.739385][ T5317] ? __pfx_panic+0x10/0x10
[ 94.741153][ T5317] ? __pfx__printk+0x10/0x10
[ 94.743195][ T5317] check_panic_on_warn+0x89/0xb0
[ 94.745452][ T5317] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 94.747951][ T5317] super_90_sync+0x1398/0x21d0
[ 94.750125][ T5317] ? __pfx_super_90_sync+0x10/0x10
[ 94.752492][ T5317] md_update_sb+0xd0d/0x26a0
[ 94.754629][ T5317] ? __pfx_md_update_sb+0x10/0x10
[ 94.756928][ T5317] ? kernfs_put+0x7b9/0x820
[ 94.759035][ T5317] ? kernfs_create_link+0x187/0x200
[ 94.761439][ T5317] md_run+0x15b6/0x1cd0
[ 94.763357][ T5317] ? __lock_acquire+0x1511/0x2de0
[ 94.765640][ T5317] ? __pfx_md_run+0x10/0x10
[ 94.767628][ T5317] ? set_disk_ro+0x1da/0x220
[ 94.769572][ T5317] ? __pfx_set_disk_ro+0x10/0x10
[ 94.771773][ T5317] do_md_run+0x35/0x720
[ 94.773626][ T5317] array_state_store+0x958/0xe90
[ 94.775854][ T5317] md_attr_store+0x3b7/0x640
[ 94.777901][ T5317] ? __pfx_sysfs_kf_write+0x10/0x10
[ 94.780219][ T5317] kernfs_fop_write_iter+0x3a4/0x540
[ 94.782554][ T5317] vfs_write+0x612/0xba0
[ 94.784505][ T5317] ? __pfx_vfs_write+0x10/0x10
[ 94.786689][ T5317] ? __fget_files+0x2a/0x420
[ 94.788816][ T5317] ksys_write+0x150/0x270
[ 94.790785][ T5317] ? __pfx_ksys_write+0x10/0x10
[ 94.793023][ T5317] do_syscall_64+0x166/0x520
[ 94.795047][ T5317] ? trace_irq_disable+0x3b/0x140
[ 94.797151][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.799692][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 94.801717][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.804284][ T5317] RIP: 0033:0x7f1fd9b9e159
[ 94.806335][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.814674][ T5317] RSP: 002b:00007f1fdaa0dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 94.818311][ T5317] RAX: ffffffffffffffda RBX: 00007f1fd9e25fa0 RCX: 00007f1fd9b9e159
[ 94.821833][ T5317] RDX: 0000000000000006 RSI: 0000200000000500 RDI: 000000000000000b
[ 94.825313][ T5317] RBP: 00007f1fd9c3503b R08: 0000000000000000 R09: 0000000000000000
[ 94.828821][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.832304][ T5317] R13: 00007f1fd9e26038 R14: 00007f1fd9e25fa0 R15: 00007fffad190ac8
[ 94.835868][ T5317]
[ 94.837691][ T5317] Kernel Offset: disabled
[ 94.839676][ T5317] Rebooting in 86400 seconds..