program:
socket$inet_tcp(0x2, 0x1, 0x0)
r0 = openat$md_new_array(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0)
write$md_new_array(r0, &(0x7f0000000040)={'md', @num=0x0}, 0x3)
r1 = openat$md(0xffffffffffffff9c, &(0x7f000000c380)={'/dev/md', @num=0x0}, 0x2, 0x0)
ioctl$SET_ARRAY_INFO(r1, 0x40480923, &(0x7f000000c3c0)={0x0, 0x0, 0x0, 0x7fff, 0x5, 0x4d1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2000})
ioctl$ADD_NEW_DISK(r1, 0x40140921, &(0x7f000000c440)={0x6, {0x1, 0x1}, 0x0, 0x2e})
ioctl$RUN_ARRAY(r1, 0x400c0930, 0x0) (fail_nth: 7)
[ 103.550510][ T4664] Bluetooth: hci0: command tx timeout
[ 103.715814][ T5354] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[ 103.847439][ T5354] md/raid:md0: not clean -- starting background reconstruction
[ 103.847478][ T5354] FAULT_INJECTION: forcing a failure.
[ 103.847478][ T5354] name fail_page_alloc, interval 1, probability 0, space 0, times 1
[ 103.847493][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.847505][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.847540][ T5354] Call Trace:
[ 103.847555][ T5354]
[ 103.847561][ T5354] dump_stack_lvl+0xe8/0x150
[ 103.847716][ T5354] should_fail_ex+0x3eb/0x540
[ 103.847789][ T5354] prepare_alloc_pages+0x21e/0x5f0
[ 103.847821][ T5354] __alloc_frozen_pages_noprof+0x17c/0x410
[ 103.847837][ T5354] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[ 103.847856][ T5354] ? policy_nodemask+0x31b/0x980
[ 103.847872][ T5354] ? rcu_is_watching+0x16/0xb0
[ 103.847890][ T5354] alloc_pages_mpol+0x21e/0x390
[ 103.847909][ T5354] ___kmalloc_large_node+0x7b/0x170
[ 103.847924][ T5354] __kmalloc_large_noprof+0x1a/0x90
[ 103.847936][ T5354] setup_conf+0x420/0x2ad0
[ 103.848005][ T5354] ? _printk+0xdd/0x130
[ 103.848021][ T5354] ? __pfx__printk+0x10/0x10
[ 103.848032][ T5354] ? xa_find_after+0xae/0x430
[ 103.848101][ T5354] ? __pfx_setup_conf+0x10/0x10
[ 103.848122][ T5354] raid5_run+0x8cc/0x2560
[ 103.848136][ T5354] ? _raw_spin_unlock+0x28/0x50
[ 103.848147][ T5354] ? get_pers+0x22b/0x2e0
[ 103.848163][ T5354] ? __pfx_get_pers+0x10/0x10
[ 103.848183][ T5354] md_run+0xc3d/0x1cd0
[ 103.848206][ T5354] ? __pfx_md_run+0x10/0x10
[ 103.848228][ T5354] do_md_run+0x35/0x720
[ 103.848242][ T5354] ? md_ioctl+0x1e23/0x2610
[ 103.848254][ T5354] md_ioctl+0x1e2b/0x2610
[ 103.848265][ T5354] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 103.848277][ T5354] ? tomoyo_path_number_perm+0x219/0x5f0
[ 103.848288][ T5354] ? __pfx_md_ioctl+0x10/0x10
[ 103.848303][ T5354] ? do_vfs_ioctl+0x116f/0x1530
[ 103.848321][ T5354] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 103.848354][ T5354] ? __pfx_md_ioctl+0x10/0x10
[ 103.848370][ T5354] blkdev_ioctl+0x5e3/0x740
[ 103.848384][ T5354] ? __pfx_blkdev_ioctl+0x10/0x10
[ 103.848398][ T5354] ? bpf_lsm_file_ioctl+0x9/0x20
[ 103.848413][ T5354] ? __pfx_blkdev_ioctl+0x10/0x10
[ 103.848424][ T5354] __se_sys_ioctl+0xfc/0x170
[ 103.848438][ T5354] do_syscall_64+0x166/0x520
[ 103.848451][ T5354] ? trace_irq_disable+0x3b/0x140
[ 103.848466][ T5354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.848477][ T5354] ? clear_bhb_loop+0x70/0xc0
[ 103.848491][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.848502][ T5354] RIP: 0033:0x7fb3c299f559
[ 103.848512][ T5354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.848519][ T5354] RSP: 002b:00007fb3c3886fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 103.848528][ T5354] RAX: ffffffffffffffda RBX: 00007fb3c2c25fa0 RCX: 00007fb3c299f559
[ 103.848534][ T5354] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000005
[ 103.848538][ T5354] RBP: 00007fb3c3887050 R08: 0000000000000000 R09: 0000000000000000
[ 103.848542][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 103.848546][ T5354] R13: 00007fb3c2c26038 R14: 00007fb3c2c25fa0 R15: 00007ffcc2965838
[ 103.848560][ T5354]
[ 103.848722][ T5354] ==================================================================
[ 103.848729][ T5354] BUG: KASAN: null-ptr-deref in free_conf+0x81/0x5d0
[ 103.848745][ T5354] Read of size 8 at addr 0000000000000028 by task syz.0.0/5354
[ 103.848753][ T5354]
[ 103.848758][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 103.848770][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 103.848776][ T5354] Call Trace:
[ 103.848781][ T5354]
[ 103.848785][ T5354] dump_stack_lvl+0xe8/0x150
[ 103.848801][ T5354] ? free_conf+0x81/0x5d0
[ 103.848814][ T5354] kasan_report+0x117/0x150
[ 103.848828][ T5354] ? free_conf+0x81/0x5d0
[ 103.848842][ T5354] kasan_check_range+0x264/0x2c0
[ 103.848857][ T5354] free_conf+0x81/0x5d0
[ 103.848871][ T5354] setup_conf+0x1720/0x2ad0
[ 103.848886][ T5354] ? _printk+0xdd/0x130
[ 103.848899][ T5354] ? __pfx__printk+0x10/0x10
[ 103.848909][ T5354] ? xa_find_after+0xae/0x430
[ 103.848924][ T5354] ? __pfx_setup_conf+0x10/0x10
[ 103.848939][ T5354] raid5_run+0x8cc/0x2560
[ 103.848948][ T5354] ? _raw_spin_unlock+0x28/0x50
[ 103.848957][ T5354] ? get_pers+0x22b/0x2e0
[ 103.848971][ T5354] ? __pfx_get_pers+0x10/0x10
[ 103.848986][ T5354] md_run+0xc3d/0x1cd0
[ 103.849002][ T5354] ? __pfx_md_run+0x10/0x10
[ 103.849018][ T5354] do_md_run+0x35/0x720
[ 103.849031][ T5354] ? md_ioctl+0x1e23/0x2610
[ 103.849040][ T5354] md_ioctl+0x1e2b/0x2610
[ 103.849050][ T5354] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 103.849065][ T5354] ? tomoyo_path_number_perm+0x219/0x5f0
[ 103.849077][ T5354] ? __pfx_md_ioctl+0x10/0x10
[ 103.849089][ T5354] ? do_vfs_ioctl+0x116f/0x1530
[ 103.849099][ T5354] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 103.849118][ T5354] ? __pfx_md_ioctl+0x10/0x10
[ 103.849133][ T5354] blkdev_ioctl+0x5e3/0x740
[ 103.849144][ T5354] ? __pfx_blkdev_ioctl+0x10/0x10
[ 103.849155][ T5354] ? bpf_lsm_file_ioctl+0x9/0x20
[ 103.849168][ T5354] ? __pfx_blkdev_ioctl+0x10/0x10
[ 103.849178][ T5354] __se_sys_ioctl+0xfc/0x170
[ 103.849190][ T5354] do_syscall_64+0x166/0x520
[ 103.849198][ T5354] ? trace_irq_disable+0x3b/0x140
[ 103.849208][ T5354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.849215][ T5354] ? clear_bhb_loop+0x70/0xc0
[ 103.849222][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 103.849229][ T5354] RIP: 0033:0x7fb3c299f559
[ 103.849235][ T5354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.849241][ T5354] RSP: 002b:00007fb3c3886fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 103.849252][ T5354] RAX: ffffffffffffffda RBX: 00007fb3c2c25fa0 RCX: 00007fb3c299f559
[ 103.849260][ T5354] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000005
[ 103.849266][ T5354] RBP: 00007fb3c3887050 R08: 0000000000000000 R09: 0000000000000000
[ 103.849272][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 103.849279][ T5354] R13: 00007fb3c2c26038 R14: 00007fb3c2c25fa0 R15: 00007ffcc2965838
[ 103.849290][ T5354]
[ 103.849294][ T5354] ==================================================================
[ 103.849301][ T5354] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 104.129024][ T5354] CPU: 0 UID: 0 PID: 5354 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 104.132847][ T5354] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 104.137125][ T5354] Call Trace:
[ 104.138621][ T5354]
[ 104.139921][ T5354] vpanic+0x26f/0x710
[ 104.141599][ T5354] panic+0xc5/0xd0
[ 104.143295][ T5354] ? __pfx_panic+0x10/0x10
[ 104.145314][ T5354] ? free_conf+0x81/0x5d0
[ 104.147258][ T5354] ? rcu_is_watching+0x16/0xb0
[ 104.149328][ T5354] ? free_conf+0x81/0x5d0
[ 104.151183][ T5354] check_panic_on_warn+0x89/0xb0
[ 104.153284][ T5354] ? free_conf+0x81/0x5d0
[ 104.155144][ T5354] end_report+0x73/0x170
[ 104.156898][ T5354] ? free_conf+0x81/0x5d0
[ 104.158711][ T5354] kasan_report+0x128/0x150
[ 104.160618][ T5354] ? free_conf+0x81/0x5d0
[ 104.162425][ T5354] kasan_check_range+0x264/0x2c0
[ 104.164330][ T5354] free_conf+0x81/0x5d0
[ 104.165940][ T5354] setup_conf+0x1720/0x2ad0
[ 104.167798][ T5354] ? _printk+0xdd/0x130
[ 104.169539][ T5354] ? __pfx__printk+0x10/0x10
[ 104.171606][ T5354] ? xa_find_after+0xae/0x430
[ 104.173574][ T5354] ? __pfx_setup_conf+0x10/0x10
[ 104.175645][ T5354] raid5_run+0x8cc/0x2560
[ 104.177357][ T5354] ? _raw_spin_unlock+0x28/0x50
[ 104.179426][ T5354] ? get_pers+0x22b/0x2e0
[ 104.181328][ T5354] ? __pfx_get_pers+0x10/0x10
[ 104.183403][ T5354] md_run+0xc3d/0x1cd0
[ 104.185253][ T5354] ? __pfx_md_run+0x10/0x10
[ 104.187158][ T5354] do_md_run+0x35/0x720
[ 104.188994][ T5354] ? md_ioctl+0x1e23/0x2610
[ 104.190908][ T5354] md_ioctl+0x1e2b/0x2610
[ 104.192748][ T5354] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 104.195047][ T5354] ? tomoyo_path_number_perm+0x219/0x5f0
[ 104.197276][ T5354] ? __pfx_md_ioctl+0x10/0x10
[ 104.199073][ T5354] ? do_vfs_ioctl+0x116f/0x1530
[ 104.200880][ T5354] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 104.202920][ T5354] ? __pfx_md_ioctl+0x10/0x10
[ 104.204771][ T5354] blkdev_ioctl+0x5e3/0x740
[ 104.206601][ T5354] ? __pfx_blkdev_ioctl+0x10/0x10
[ 104.208628][ T5354] ? bpf_lsm_file_ioctl+0x9/0x20
[ 104.210763][ T5354] ? __pfx_blkdev_ioctl+0x10/0x10
[ 104.212853][ T5354] __se_sys_ioctl+0xfc/0x170
[ 104.214830][ T5354] do_syscall_64+0x166/0x520
[ 104.216871][ T5354] ? trace_irq_disable+0x3b/0x140
[ 104.219117][ T5354] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.221777][ T5354] ? clear_bhb_loop+0x70/0xc0
[ 104.223866][ T5354] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 104.226451][ T5354] RIP: 0033:0x7fb3c299f559
[ 104.228429][ T5354] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 104.236918][ T5354] RSP: 002b:00007fb3c3886fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 104.240335][ T5354] RAX: ffffffffffffffda RBX: 00007fb3c2c25fa0 RCX: 00007fb3c299f559
[ 104.243568][ T5354] RDX: 0000000000000000 RSI: 00000000400c0930 RDI: 0000000000000005
[ 104.246739][ T5354] RBP: 00007fb3c3887050 R08: 0000000000000000 R09: 0000000000000000
[ 104.250101][ T5354] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 104.253587][ T5354] R13: 00007fb3c2c26038 R14: 00007fb3c2c25fa0 R15: 00007ffcc2965838
[ 104.256763][ T5354]
[ 104.263713][ T5354] Kernel Offset: disabled
[ 104.265549][ T5354] Rebooting in 86400 seconds..