program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000700)='./sys\x00', &(0x7f0000000740)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000400)='md0', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000480)="00000000000000000000000000000000050000000010000003000000030000000000000001000000000000000100000003000000030000000000000000000000020000000010")
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./debug\x00', &(0x7f0000000080)='debugfs\x00', 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8c}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x4)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./debug/dynamic_debug/control\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='+p', 0x2)
ioctl(r1, 0x40140921, &(0x7f0000000500)="0000000001")
r3 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./dev/md0\x00', 0x4002, 0x0)
ioctl(r3, 0x400c0930, 0x0) (fail_nth: 7)
[ 104.168754][ T5295] Bluetooth: hci0: command tx timeout
[ 104.364738][ T5341] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 104.718097][ T5341] FAULT_INJECTION: forcing a failure.
[ 104.718097][ T5341] name fail_page_alloc, interval 1, probability 0, space 0, times 1
[ 104.718122][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 104.718135][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.718159][ T5341] Call Trace:
[ 104.718218][ T5341]
[ 104.718231][ T5341] dump_stack_lvl+0xe8/0x150
[ 104.718388][ T5341] should_fail_ex+0x3eb/0x540
[ 104.718525][ T5341] prepare_alloc_pages+0x21e/0x5f0
[ 104.718581][ T5341] __alloc_frozen_pages_noprof+0x17c/0x410
[ 104.718597][ T5341] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 104.718624][ T5341] ? policy_nodemask+0x31b/0x980
[ 104.718635][ T5341] ? rcu_is_watching+0x16/0xb0
[ 104.718671][ T5341] alloc_pages_mpol+0x21e/0x390
[ 104.718683][ T5341] ___kmalloc_large_node+0x7b/0x170
[ 104.718693][ T5341] __kmalloc_large_noprof+0x1a/0x90
[ 104.718701][ T5341] setup_conf+0x420/0x2ad0
[ 104.718784][ T5341] ? xa_find_after+0xae/0x430
[ 104.718890][ T5341] ? __pfx_setup_conf+0x10/0x10
[ 104.718911][ T5341] raid5_run+0x8cc/0x2560
[ 104.718924][ T5341] ? _raw_spin_unlock+0x28/0x50
[ 104.718932][ T5341] ? get_pers+0x22b/0x2e0
[ 104.718943][ T5341] ? __pfx_get_pers+0x10/0x10
[ 104.718954][ T5341] ? _raw_spin_unlock_irqrestore+0x47/0x80
[ 104.718963][ T5341] md_run+0xc3d/0x1cd0
[ 104.718977][ T5341] ? __pfx_md_run+0x10/0x10
[ 104.718991][ T5341] do_md_run+0x35/0x720
[ 104.718999][ T5341] ? md_ioctl+0x1e23/0x2610
[ 104.719007][ T5341] md_ioctl+0x1e2b/0x2610
[ 104.719014][ T5341] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 104.719028][ T5341] ? tomoyo_path_number_perm+0x219/0x5f0
[ 104.719041][ T5341] ? __pfx_md_ioctl+0x10/0x10
[ 104.719056][ T5341] ? do_vfs_ioctl+0x116f/0x1530
[ 104.719073][ T5341] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 104.719105][ T5341] ? __pfx_md_ioctl+0x10/0x10
[ 104.719122][ T5341] blkdev_ioctl+0x5e3/0x740
[ 104.719136][ T5341] ? __pfx_blkdev_ioctl+0x10/0x10
[ 104.719148][ T5341] ? bpf_lsm_file_ioctl+0x9/0x20
[ 104.719191][ T5341] ? __pfx_blkdev_ioctl+0x10/0x10
[ 104.719202][ T5341] __se_sys_ioctl+0xfc/0x170
[ 104.719215][ T5341] do_syscall_64+0x166/0x520
[ 104.719225][ T5341] ? trace_irq_disable+0x3b/0x140
[ 104.719248][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.719263][ T5341] ? clear_bhb_loop+0x70/0xc0
[ 104.719278][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.719285][ T5341] RIP: 0033:0x7f7d33f9f559
[ 104.719294][ T5341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 104.719300][ T5341] RSP: 002b:00007f7d34df0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 104.719324][ T5341] RAX: ffffffffffffffda RBX: 00007f7d34225fa0 RCX: 00007f7d33f9f559
[ 104.719329][ T5341] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000006
[ 104.719333][ T5341] RBP: 00007f7d34df1050 R08: 0000000000000000 R09: 0000000000000000
[ 104.719337][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 104.719342][ T5341] R13: 00007f7d34226038 R14: 00007f7d34225fa0 R15: 00007fff5f493228
[ 104.719352][ T5341]
[ 104.719368][ T5341] ==================================================================
[ 104.719372][ T5341] BUG: KASAN: null-ptr-deref in free_conf+0x81/0x5d0
[ 104.719383][ T5341] Read of size 8 at addr 0000000000000028 by task syz.0.0/5341
[ 104.719398][ T5341]
[ 104.719412][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 104.719426][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.719432][ T5341] Call Trace:
[ 104.719437][ T5341]
[ 104.719441][ T5341] dump_stack_lvl+0xe8/0x150
[ 104.719456][ T5341] ? free_conf+0x81/0x5d0
[ 104.719469][ T5341] kasan_report+0x117/0x150
[ 104.719484][ T5341] ? free_conf+0x81/0x5d0
[ 104.719499][ T5341] kasan_check_range+0x264/0x2c0
[ 104.719512][ T5341] free_conf+0x81/0x5d0
[ 104.719526][ T5341] setup_conf+0x1720/0x2ad0
[ 104.719543][ T5341] ? xa_find_after+0xae/0x430
[ 104.719558][ T5341] ? __pfx_setup_conf+0x10/0x10
[ 104.719574][ T5341] raid5_run+0x8cc/0x2560
[ 104.719586][ T5341] ? _raw_spin_unlock+0x28/0x50
[ 104.719595][ T5341] ? get_pers+0x22b/0x2e0
[ 104.719604][ T5341] ? __pfx_get_pers+0x10/0x10
[ 104.719613][ T5341] ? _raw_spin_unlock_irqrestore+0x47/0x80
[ 104.719621][ T5341] md_run+0xc3d/0x1cd0
[ 104.719631][ T5341] ? __pfx_md_run+0x10/0x10
[ 104.719642][ T5341] do_md_run+0x35/0x720
[ 104.719650][ T5341] ? md_ioctl+0x1e23/0x2610
[ 104.719657][ T5341] md_ioctl+0x1e2b/0x2610
[ 104.719662][ T5341] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 104.719671][ T5341] ? tomoyo_path_number_perm+0x219/0x5f0
[ 104.719680][ T5341] ? __pfx_md_ioctl+0x10/0x10
[ 104.719689][ T5341] ? do_vfs_ioctl+0x116f/0x1530
[ 104.719698][ T5341] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 104.719711][ T5341] ? __pfx_md_ioctl+0x10/0x10
[ 104.719720][ T5341] blkdev_ioctl+0x5e3/0x740
[ 104.719727][ T5341] ? __pfx_blkdev_ioctl+0x10/0x10
[ 104.719734][ T5341] ? bpf_lsm_file_ioctl+0x9/0x20
[ 104.719742][ T5341] ? __pfx_blkdev_ioctl+0x10/0x10
[ 104.719748][ T5341] __se_sys_ioctl+0xfc/0x170
[ 104.719757][ T5341] do_syscall_64+0x166/0x520
[ 104.719765][ T5341] ? trace_irq_disable+0x3b/0x140
[ 104.719774][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.719780][ T5341] ? clear_bhb_loop+0x70/0xc0
[ 104.719787][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.719794][ T5341] RIP: 0033:0x7f7d33f9f559
[ 104.719802][ T5341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 104.719810][ T5341] RSP: 002b:00007f7d34df0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 104.719820][ T5341] RAX: ffffffffffffffda RBX: 00007f7d34225fa0 RCX: 00007f7d33f9f559
[ 104.719827][ T5341] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000006
[ 104.719833][ T5341] RBP: 00007f7d34df1050 R08: 0000000000000000 R09: 0000000000000000
[ 104.719840][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 104.719846][ T5341] R13: 00007f7d34226038 R14: 00007f7d34225fa0 R15: 00007fff5f493228
[ 104.719858][ T5341]
[ 104.719861][ T5341] ==================================================================
[ 104.719868][ T5341] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 104.987547][ T5341] CPU: 0 UID: 0 PID: 5341 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 104.991381][ T5341] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.995807][ T5341] Call Trace:
[ 104.997411][ T5341]
[ 104.998847][ T5341] vpanic+0x26f/0x710
[ 105.000859][ T5341] panic+0xc5/0xd0
[ 105.002477][ T5341] ? __pfx_panic+0x10/0x10
[ 105.004430][ T5341] ? free_conf+0x81/0x5d0
[ 105.006429][ T5341] ? rcu_is_watching+0x16/0xb0
[ 105.008462][ T5341] ? free_conf+0x81/0x5d0
[ 105.010258][ T5341] check_panic_on_warn+0x89/0xb0
[ 105.012412][ T5341] ? free_conf+0x81/0x5d0
[ 105.014257][ T5341] end_report+0x73/0x170
[ 105.016181][ T5341] ? free_conf+0x81/0x5d0
[ 105.018006][ T5341] kasan_report+0x128/0x150
[ 105.019795][ T5341] ? free_conf+0x81/0x5d0
[ 105.021571][ T5341] kasan_check_range+0x264/0x2c0
[ 105.023681][ T5341] free_conf+0x81/0x5d0
[ 105.025480][ T5341] setup_conf+0x1720/0x2ad0
[ 105.027482][ T5341] ? xa_find_after+0xae/0x430
[ 105.029453][ T5341] ? __pfx_setup_conf+0x10/0x10
[ 105.031479][ T5341] raid5_run+0x8cc/0x2560
[ 105.033282][ T5341] ? _raw_spin_unlock+0x28/0x50
[ 105.035153][ T5341] ? get_pers+0x22b/0x2e0
[ 105.036986][ T5341] ? __pfx_get_pers+0x10/0x10
[ 105.039036][ T5341] ? _raw_spin_unlock_irqrestore+0x47/0x80
[ 105.041385][ T5341] md_run+0xc3d/0x1cd0
[ 105.043152][ T5341] ? __pfx_md_run+0x10/0x10
[ 105.045161][ T5341] do_md_run+0x35/0x720
[ 105.046995][ T5341] ? md_ioctl+0x1e23/0x2610
[ 105.048961][ T5341] md_ioctl+0x1e2b/0x2610
[ 105.050888][ T5341] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 105.053334][ T5341] ? tomoyo_path_number_perm+0x219/0x5f0
[ 105.055718][ T5341] ? __pfx_md_ioctl+0x10/0x10
[ 105.057851][ T5341] ? do_vfs_ioctl+0x116f/0x1530
[ 105.060085][ T5341] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 105.062467][ T5341] ? __pfx_md_ioctl+0x10/0x10
[ 105.064575][ T5341] blkdev_ioctl+0x5e3/0x740
[ 105.066677][ T5341] ? __pfx_blkdev_ioctl+0x10/0x10
[ 105.068912][ T5341] ? bpf_lsm_file_ioctl+0x9/0x20
[ 105.071252][ T5341] ? __pfx_blkdev_ioctl+0x10/0x10
[ 105.073307][ T5341] __se_sys_ioctl+0xfc/0x170
[ 105.075239][ T5341] do_syscall_64+0x166/0x520
[ 105.077209][ T5341] ? trace_irq_disable+0x3b/0x140
[ 105.079160][ T5341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.081509][ T5341] ? clear_bhb_loop+0x70/0xc0
[ 105.083460][ T5341] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 105.085639][ T5341] RIP: 0033:0x7f7d33f9f559
[ 105.087387][ T5341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 105.094786][ T5341] RSP: 002b:00007f7d34df0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 105.097809][ T5341] RAX: ffffffffffffffda RBX: 00007f7d34225fa0 RCX: 00007f7d33f9f559
[ 105.101193][ T5341] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000006
[ 105.104202][ T5341] RBP: 00007f7d34df1050 R08: 0000000000000000 R09: 0000000000000000
[ 105.107857][ T5341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 105.111783][ T5341] R13: 00007f7d34226038 R14: 00007f7d34225fa0 R15: 00007fff5f493228
[ 105.115513][ T5341]
[ 105.122905][ T5341] Kernel Offset: disabled
[ 105.124802][ T5341] Rebooting in 86400 seconds..