program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='sysfs\x00', 0x8, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x98, 0x130, 0xffffffff, 0xffffffff, 0x0, 0x98, 0x1f0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x8081, 0x0)
write(r0, &(0x7f0000000200)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="0000004a0000000004000002000000020000000000000001000000007c")
ioctl(r1, 0x40140921, &(0x7f0000000420)="0100000001")
ioctl(r1, 0x2, 0x0)
mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/kernel/modprobe\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='/bin/true', 0x9)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r3, &(0x7f0000000280)='md0\x00', 0x3)
r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/level\x00', 0x2, 0x0)
write(r4, &(0x7f0000000300)='raid1', 0x5)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r5, &(0x7f0000000380)='1:0', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/block/md0/md/raid_disks\x00', 0x2, 0x141)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/dev-ram0/slot\x00', 0x2, 0x0)
write(r6, &(0x7f0000000480)='0', 0x1)
r7 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/array_state\x00', 0x2, 0x0)
write(r7, &(0x7f0000000500)='active', 0x6)
write(r4, &(0x7f0000000540)='raid0', 0x5)
[ 102.206773][ T4646] Bluetooth: hci0: command tx timeout
[ 102.323024][ T5324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 102.369819][ T5324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 102.413666][ T5324] md: could not open device unknown-block(1,0).
[ 102.540651][ T5324] md/raid1:md0: active with 1 out of 124 mirrors
[ 102.541237][ T5324] ------------[ cut here ]------------
[ 102.541246][ T5324] UBSAN: array-index-out-of-bounds in drivers/md/md.c:1726:20
[ 102.541256][ T5324] index 28 is out of range for type 'mdp_disk_t[27]' (aka 'struct mdp_device_descriptor_s[27]')
[ 102.541293][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.541306][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.541336][ T5324] Call Trace:
[ 102.541343][ T5324]
[ 102.541349][ T5324] dump_stack_lvl+0xe8/0x150
[ 102.541409][ T5324] ubsan_epilogue+0xa/0x30
[ 102.541424][ T5324] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 102.541517][ T5324] super_90_sync+0x1398/0x21d0
[ 102.541579][ T5324] ? __pfx_super_90_sync+0x10/0x10
[ 102.541595][ T5324] md_update_sb+0xd0d/0x26a0
[ 102.541624][ T5324] ? __pfx_md_update_sb+0x10/0x10
[ 102.541639][ T5324] ? kernfs_put+0x7b9/0x820
[ 102.541657][ T5324] ? kernfs_create_link+0x187/0x200
[ 102.541675][ T5324] md_run+0x15b6/0x1cd0
[ 102.541691][ T5324] ? __lock_acquire+0x1511/0x2de0
[ 102.541711][ T5324] ? __pfx_md_run+0x10/0x10
[ 102.541728][ T5324] ? set_disk_ro+0x1da/0x220
[ 102.541744][ T5324] ? __pfx_set_disk_ro+0x10/0x10
[ 102.541765][ T5324] do_md_run+0x35/0x720
[ 102.541779][ T5324] array_state_store+0x958/0xe90
[ 102.541799][ T5324] md_attr_store+0x3b7/0x640
[ 102.541818][ T5324] ? __pfx_sysfs_kf_write+0x10/0x10
[ 102.541831][ T5324] kernfs_fop_write_iter+0x3a4/0x540
[ 102.541846][ T5324] vfs_write+0x612/0xba0
[ 102.541867][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 102.541888][ T5324] ? __fget_files+0x2a/0x420
[ 102.541938][ T5324] ksys_write+0x150/0x270
[ 102.541958][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 102.541990][ T5324] do_syscall_64+0x166/0x520
[ 102.542014][ T5324] ? trace_irq_disable+0x3b/0x140
[ 102.542027][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.542041][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 102.542057][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.542069][ T5324] RIP: 0033:0x7f205cb9e159
[ 102.542081][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.542090][ T5324] RSP: 002b:00007f205da80fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.542103][ T5324] RAX: ffffffffffffffda RBX: 00007f205ce25fa0 RCX: 00007f205cb9e159
[ 102.542110][ T5324] RDX: 0000000000000006 RSI: 0000200000000500 RDI: 000000000000000b
[ 102.542117][ T5324] RBP: 00007f205cc3503b R08: 0000000000000000 R09: 0000000000000000
[ 102.542124][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.542131][ T5324] R13: 00007f205ce26038 R14: 00007f205ce25fa0 R15: 00007ffff49af998
[ 102.542151][ T5324]
[ 102.542317][ T5324] ---[ end trace ]---
[ 102.542327][ T5324] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 102.667849][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.671524][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.675688][ T5324] Call Trace:
[ 102.677191][ T5324]
[ 102.678538][ T5324] vpanic+0x56d/0xa60
[ 102.680314][ T5324] ? __pfx_vpanic+0x10/0x10
[ 102.682328][ T5324] panic+0xc5/0xd0
[ 102.683982][ T5324] ? __pfx_panic+0x10/0x10
[ 102.685847][ T5324] ? __pfx__printk+0x10/0x10
[ 102.687951][ T5324] check_panic_on_warn+0x89/0xb0
[ 102.690142][ T5324] __ubsan_handle_out_of_bounds+0xe8/0xf0
[ 102.692743][ T5324] super_90_sync+0x1398/0x21d0
[ 102.694811][ T5324] ? __pfx_super_90_sync+0x10/0x10
[ 102.697094][ T5324] md_update_sb+0xd0d/0x26a0
[ 102.699122][ T5324] ? __pfx_md_update_sb+0x10/0x10
[ 102.701131][ T5324] ? kernfs_put+0x7b9/0x820
[ 102.703052][ T5324] ? kernfs_create_link+0x187/0x200
[ 102.705300][ T5324] md_run+0x15b6/0x1cd0
[ 102.707220][ T5324] ? __lock_acquire+0x1511/0x2de0
[ 102.709413][ T5324] ? __pfx_md_run+0x10/0x10
[ 102.711519][ T5324] ? set_disk_ro+0x1da/0x220
[ 102.713541][ T5324] ? __pfx_set_disk_ro+0x10/0x10
[ 102.715689][ T5324] do_md_run+0x35/0x720
[ 102.717518][ T5324] array_state_store+0x958/0xe90
[ 102.719750][ T5324] md_attr_store+0x3b7/0x640
[ 102.721868][ T5324] ? __pfx_sysfs_kf_write+0x10/0x10
[ 102.724158][ T5324] kernfs_fop_write_iter+0x3a4/0x540
[ 102.726524][ T5324] vfs_write+0x612/0xba0
[ 102.728394][ T5324] ? __pfx_vfs_write+0x10/0x10
[ 102.730372][ T5324] ? __fget_files+0x2a/0x420
[ 102.732235][ T5324] ksys_write+0x150/0x270
[ 102.734109][ T5324] ? __pfx_ksys_write+0x10/0x10
[ 102.736232][ T5324] do_syscall_64+0x166/0x520
[ 102.738258][ T5324] ? trace_irq_disable+0x3b/0x140
[ 102.740398][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.743081][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 102.745185][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.747644][ T5324] RIP: 0033:0x7f205cb9e159
[ 102.749513][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.757757][ T5324] RSP: 002b:00007f205da80fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 102.761416][ T5324] RAX: ffffffffffffffda RBX: 00007f205ce25fa0 RCX: 00007f205cb9e159
[ 102.764876][ T5324] RDX: 0000000000000006 RSI: 0000200000000500 RDI: 000000000000000b
[ 102.768296][ T5324] RBP: 00007f205cc3503b R08: 0000000000000000 R09: 0000000000000000
[ 102.771687][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.775225][ T5324] R13: 00007f205ce26038 R14: 00007f205ce25fa0 R15: 00007ffff49af998
[ 102.778563][ T5324]
[ 102.780331][ T5324] Kernel Offset: disabled
[ 102.782190][ T5324] Rebooting in 86400 seconds..