t_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:55:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x7914}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:50 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000034010000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:55:50 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x7000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:50 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0xfffffdef, &(0x7f0000000200)}, 0x0) 08:55:50 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x3) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x400, 0x0) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f00000000c0)={'gre0\x00', 0x3}) ioctl(r0, 0x80000000, &(0x7f0000000100)="025cc83d6d345f8f762070") setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x2d0, 0x1, 0x7f, 0xb615, 0x8}, 0xc) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000400000000000000000400800000000000000008000000800000000000000002000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:55:50 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) tkill(r0, 0x15) 08:55:50 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x1000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 932.057304] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 932.087425] binder: 14391:14392 BC_FREE_BUFFER u0000000000000000 no match [ 932.094479] binder: 14391:14392 got transaction to invalid handle 08:55:50 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x23, &(0x7f0000000200)}, 0x0) 08:55:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 932.100773] binder: 14391:14392 transaction failed 29201/-22, size 2-0 line 2852 [ 932.120654] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 932.136873] XFS (loop6): SB sanity check failed [ 932.141739] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 932.152966] XFS (loop6): Unmount and run xfs_repair [ 932.158053] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 932.164768] 0000000014d95811: 58 46 53 42 00 00 10 00 00 00 34 01 00 00 10 00 XFSB......4..... [ 932.173647] 00000000edda598c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 932.182539] 0000000005a97ffb: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 932.191420] 000000005dffe11f: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ 08:55:50 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xfffffffffffff000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:50 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:50 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x4, &(0x7f0000000200)}, 0x0) [ 932.200310] 000000004e18e291: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 932.209197] 000000001ab9b52e: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 932.218078] 00000000381ff596: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 932.226984] 00000000ea801da8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 932.230112] binder: 14391:14430 BC_FREE_BUFFER u0000000000000000 no match [ 932.242913] binder: 14391:14430 got transaction to invalid handle [ 932.249203] binder: 14391:14430 transaction failed 29201/-22, size 2-0 line 2852 08:55:50 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x4300}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 932.256074] XFS (loop6): SB validate failed with error -117. 08:55:50 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x3c00000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 932.385218] binder: undelivered TRANSACTION_ERROR: 29201 [ 932.390880] binder: undelivered TRANSACTION_ERROR: 29201 08:55:51 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:55:51 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x301, &(0x7f0000000200)}, 0x0) 08:55:51 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x7a}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:51 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000006000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:55:51 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4305000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:51 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f00000000c0)={0x0, 0xf2, "2a914081da7510e2447f73d9cf9e7e98a40633f0fecc20987e678d171bed0a1c2fcb1a95ecb94bcadd9c71ad233643d465d3ecad4090a3aa7e7671687fc382f3b3350671a198bffdc4db1ceb8f829909429dbced887d9af7575d025bbf874e9dcc57f5ead1c454dfc311cc5e50fb74a1a1c7bd883b6045c64a7c49b7e5374e7c1a5c2f31426a842dfbd82cd443c1b9a555e492ed949245579e92158d79462b5b058585ff5c94ad2255d45034f0fd55cbae3b37b66b1da20470453f39e483713c31de3abdcce7a396f5c82881ac9dbbcbb4a6537598c4bbb29293746a646ada26f763707d0c491a29d4810217cde1f4d7f9ef"}, &(0x7f0000000000)=0xfa) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000040)={r2, 0xb, "ca2e2de636247b79dcf57c"}, &(0x7f00000001c0)=0x13) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) [ 933.066821] binder: 14463:14471 BC_FREE_BUFFER u0000000000000000 no match [ 933.090744] binder: 14463:14471 transaction failed 29189/-22, size 0-0 line 2852 [ 933.114860] XFS (loop6): SB sanity check failed [ 933.119284] binder: undelivered TRANSACTION_ERROR: 29189 [ 933.119669] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 933.136211] XFS (loop6): Unmount and run xfs_repair [ 933.141264] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 933.147970] 00000000898451e0: 58 46 53 42 00 00 10 00 00 00 06 00 00 00 10 00 XFSB............ [ 933.156854] 0000000067b8b461: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 933.165742] 0000000013db96c3: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 933.174639] 0000000055b11b38: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 933.183536] 00000000c373225e: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 933.192430] 00000000a53ecefe: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 933.201309] 00000000b08a18c7: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 933.210189] 00000000223e6e98: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 933.219121] XFS (loop6): SB validate failed with error -117. 08:55:53 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$EVIOCGREP(r1, 0x80084503, &(0x7f0000000040)=""/45) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x3) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) timer_settime(0x0, 0x1, &(0x7f000006b000)={{0x0, 0x8}, {r2, r3+30000000}}, &(0x7f0000000000)) tkill(r0, 0x15) ioctl$int_in(r1, 0x5421, &(0x7f0000000080)=0x9) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000140)={0x0, 0x8}, &(0x7f0000000180)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000240)={r4, 0x7fffffff}, &(0x7f0000000280)=0x8) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f00000000c0)=0x7f, 0x4) 08:55:53 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x5a0, &(0x7f0000000200)}, 0x0) 08:55:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xf0ffffffffffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0xfffffff0}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:53 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000000a100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:55:53 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:55:53 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x0, 0x0) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000180)=0xfff, 0x4) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x530}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000100)={r3, 0x3, 0x6, 0x80cd, 0xc0, 0x5}, &(0x7f0000000140)=0x14) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000240)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f0000000400)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0xf4, r4, 0xa30, 0x70bd2d, 0x25dfdbfb, {0x1}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8cbe}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_DAEMON={0x84, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1={0xff, 0x1, [], 0x1}}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x400}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bridge\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2={0xff, 0x2, [], 0x1}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote={0xfe, 0x80, [], 0xbb}}]}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffffffff}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}]}, 0xf4}, 0x1, 0x0, 0x0, 0x20000001}, 0x1) setsockopt$kcm_KCM_RECV_DISABLE(r2, 0x119, 0x1, &(0x7f00000001c0)=0x6, 0x4) 08:55:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x9000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:53 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x7ffff000, &(0x7f0000000200)}, 0x0) [ 935.071228] binder: 14503:14504 BC_FREE_BUFFER u0000000000000000 no match [ 935.085376] binder: 14503:14504 transaction failed 29189/-22, size 0-0 line 2852 [ 935.138564] validate_nla: 4 callbacks suppressed [ 935.138573] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 935.156219] binder: 14503:14504 BC_FREE_BUFFER u0000000000000000 no match [ 935.163877] XFS (loop6): SB sanity check failed [ 935.168730] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 935.179861] XFS (loop6): Unmount and run xfs_repair [ 935.184952] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 935.189154] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 935.191650] 00000000ca47e2b5: 58 46 53 42 00 00 10 00 00 00 00 00 00 0a 10 00 XFSB............ [ 935.191667] 000000008823739f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 935.216774] 0000000019cbc424: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 935.221879] binder: 14503:14504 transaction failed 29189/-22, size 0-0 line 2852 08:55:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x88470000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 935.225657] 00000000ffafa5db: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 935.225668] 00000000187c4915: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 935.225679] 000000005e4ba383: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 935.225687] 00000000fbfe2463: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 935.225705] 000000006c7f0aae: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 935.268130] binder: undelivered TRANSACTION_ERROR: 29189 08:55:53 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x7, &(0x7f0000000200)}, 0x0) 08:55:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x100000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 935.285576] XFS (loop6): SB validate failed with error -117. 08:55:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x600], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 935.338685] binder: undelivered TRANSACTION_ERROR: 29189 [ 935.398440] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 935.432740] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:55:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0xa, &(0x7f0000000200)}, 0x0) 08:55:54 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000140)="025cc83d6d345f8f762070ae29251db757672eff7865314b22879f6e4a9a0f4673806d6c8f0684119edaa9ccdcfa179da8856df91871629389b6fe2b8b8c28cb274a3bb70b7c3dda691c48b284abc89d39de6e235a40d9743b4cc1a448d807aefab40f315795511b771c3229906df70d15cad5f3ea8b4116b07f47faf00b87fdc7807bbd4dfe21a9fddf572fa6449ae9ec1a791ea28ff7cf0103") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="000000fbffffff00"], 0x0, 0x0, &(0x7f0000000680)}) 08:55:54 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000005100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:55:54 executing program 7: r0 = gettid() r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:55:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x6000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:54 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4888], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:54 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:55:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x3, &(0x7f0000000200)}, 0x0) 08:55:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x3], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 936.034672] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 936.054799] binder: 14573:14574 BC_FREE_BUFFER u0000000000000000 no match [ 936.068104] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 936.070898] binder: 14573:14574 transaction failed 29189/-22, size 0-0 line 2852 [ 936.119106] XFS (loop6): SB sanity check failed [ 936.123941] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 936.133808] binder: undelivered TRANSACTION_ERROR: 29189 [ 936.135088] XFS (loop6): Unmount and run xfs_repair [ 936.145583] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 936.152314] 00000000a5d1eaf8: 58 46 53 42 00 00 10 00 00 00 00 00 00 05 10 00 XFSB............ 08:55:54 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:54 executing program 0: r0 = socket$inet6(0xa, 0xa, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x80000000000802) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000680)}) 08:55:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x6c000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 936.161190] 00000000bc9bdfa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 936.170073] 00000000cf0be468: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 936.178953] 000000005ed38de9: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 936.187862] 0000000076fa6a85: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 936.196740] 0000000043763a9d: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 936.205640] 0000000046189c18: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... 08:55:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xc0ffffff00000000}, 0x0) 08:55:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x401000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 936.214528] 000000000f47cde6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 936.224121] XFS (loop6): SB validate failed with error -117. 08:55:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x800e0000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x400000000000000}, 0x0) 08:55:54 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000004100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 936.313284] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:55:54 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 936.369471] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 936.472425] XFS (loop6): SB sanity check failed [ 936.477289] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 936.488439] XFS (loop6): Unmount and run xfs_repair [ 936.493502] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 936.500228] 00000000ac6ee09c: 58 46 53 42 00 00 10 00 00 00 00 00 00 04 10 00 XFSB............ [ 936.509114] 0000000043673b6d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 936.517994] 0000000082db1677: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 936.526871] 0000000071a3f260: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 936.535736] 000000005c1ce47f: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 936.544607] 00000000be1e893f: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 936.553471] 000000009099acbd: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 936.562359] 00000000af78856a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 936.571299] XFS (loop6): SB validate failed with error -117. 08:55:57 executing program 7: r0 = gettid() r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x84400, 0x20) r3 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000000c0)=0x14, 0x800) kcmp$KCMP_EPOLL_TFD(r0, r0, 0x7, r1, &(0x7f0000000100)={r2, r3, 0x6}) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r4 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r4, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r4, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:55:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8dffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:57 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x10000000000000}, 0x0) 08:55:57 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x800000800) syz_init_net_socket$llc(0x1a, 0x3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:55:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x6000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:57 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000002620000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:55:57 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:55:57 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x8000000}, 0x0) 08:55:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xe00000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 939.129066] binder: 14660:14661 BC_FREE_BUFFER u0000000000000000 no match [ 939.135410] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 939.157054] binder: 14660:14661 transaction failed 29189/-22, size 0-0 line 2852 08:55:57 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x0, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 939.178267] XFS (loop6): SB sanity check failed [ 939.183088] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 939.186777] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 939.194240] XFS (loop6): Unmount and run xfs_repair [ 939.194258] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 939.203113] binder: 14660:14688 BC_FREE_BUFFER u0000000000000000 no match [ 939.206699] 00000000ceb2faff: 58 46 53 42 00 00 10 00 00 00 02 62 00 00 10 00 XFSB.......b.... [ 939.215562] binder: 14660:14688 transaction failed 29189/-22, size 0-0 line 2852 [ 939.220319] 000000004c3c2f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 939.220331] 00000000db6a6919: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 939.220340] 000000006740a1b4: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 939.220357] 00000000330588f7: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 939.250278] binder: undelivered TRANSACTION_ERROR: 29189 08:55:57 executing program 0: r0 = socket$inet6(0xa, 0xfffffffffffe, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0xffffffffffffff56, 0x0, &(0x7f0000000680)}) r2 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, @dev}, &(0x7f0000000040)=0x10, 0x80000) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000180)=""/42) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x3}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r2, 0x84, 0x23, &(0x7f0000000140)={r3, 0x5}, 0x8) [ 939.254460] 0000000041a076ac: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 939.254472] 000000007064334c: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 939.254483] 00000000a76e16f5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 939.256708] XFS (loop6): SB validate failed with error -117. [ 939.272493] binder: undelivered TRANSACTION_ERROR: 29189 08:55:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xe8030000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:57 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xa00}, 0x0) 08:55:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x7a00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:57 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000a0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 939.353641] binder: 14698:14701 BC_FREE_BUFFER u0000000000000000 no match [ 939.374810] binder: 14698:14701 transaction failed 29189/-22, size 0-0 line 2852 [ 939.432664] binder: 14698:14701 ioctl c008ae05 20000180 returned -22 [ 939.471152] binder: 14698:14701 BC_FREE_BUFFER u0000000000000000 no match [ 939.483326] binder: 14698:14701 transaction failed 29189/-22, size 0-0 line 2852 [ 939.501978] binder: 14698:14721 ioctl c008ae05 20000180 returned -22 [ 939.509100] XFS (loop6): SB sanity check failed [ 939.514093] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 939.525238] XFS (loop6): Unmount and run xfs_repair [ 939.530315] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 939.537045] 00000000158f87f4: 58 46 53 42 00 00 10 00 00 00 00 0a 00 00 10 00 XFSB............ [ 939.545921] 000000004c973615: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 939.554808] 00000000336bf6e3: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 939.563680] 00000000bb515eb0: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 939.572545] 0000000069934027: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 939.581402] 000000002588e47e: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 939.590257] 000000001ca972de: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 939.599113] 00000000438ee5f5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 939.608374] XFS (loop6): SB validate failed with error -117. 08:55:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x300}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x3e8], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:58 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0xffffffffffffff28) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:55:58 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x8}, 0x0) 08:55:58 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000003f100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:55:58 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000003c0)=0x0) ioprio_set$pid(0x2, r2, 0x8e9f) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x224080, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_REJECT(r3, &(0x7f0000000100)={0x9, 0x108, 0xfa00, {r4, 0xf5, "798cd1", "6813ec30fc252d2b1503a76aaf9614468efdefb2bcc5f8101820c3922814ce1fa3b00599930ef4b47216e5d4ae6e0f014dd7c275c1c36bc101142ee6f271bc294cb0182a81a3ff4bf6d139a23f6238ed6117ddade4fd66ccc79313ff01c68707381a533842581d969f195ba92b1d2841ce58bdda4dafeccf238d7ced3c82fd38279638ac7ec34bd48c4d42e34618816286dab74049b7a2f2a21a2f09f385ce37da85b854d885cd7f2f7feb80fc7960dee648cdf665370004c94a1127fc8698c78b4184ba383e6cfcc156f72f7ad11b7cc2506df8188534bb04db75d4c1de1781ecfd827ba943f287e3b0a047f45113d4c7fbf71cd316f13acf201de9e9999da4"}}, 0x110) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000240)={0x0, 0x80000001, 0x3ff, 0xffffffff, 0xfffffffffffffffe, 0x400}, &(0x7f00000002c0)=0x14) connect$l2tp(r3, &(0x7f0000000380)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x2, 0x2, 0x4, 0x4, {0xa, 0x4e24, 0x1, @mcast1={0xff, 0x1, [], 0x1}, 0x7}}}, 0x3a) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000300)={r5, 0x81}, &(0x7f0000000340)=0x8) [ 940.076350] binder: BINDER_SET_CONTEXT_MGR already set 08:55:58 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:55:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8847000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x7}, 0x0) 08:55:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x7}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:58 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 940.102695] binder: 14746:14749 ioctl 40046207 0 returned -16 [ 940.175527] binder: 14746:14749 BC_FREE_BUFFER u0000000000000000 no match [ 940.188989] XFS (loop6): SB sanity check failed [ 940.193813] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 940.198131] binder: 14746:14749 got transaction to context manager from process owning it [ 940.204956] XFS (loop6): Unmount and run xfs_repair [ 940.204969] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 940.204982] 000000007450d066: 58 46 53 42 00 00 10 00 00 00 00 00 00 3f 10 00 XFSB.........?.. [ 940.204998] 00000000f83e3565: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 940.213351] binder: 14746:14749 transaction failed 29201/-22, size 0-0 line 2843 [ 940.218366] 00000000606488e0: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 940.259382] 000000009c631271: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ 08:55:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x5900000000000000}, 0x0) 08:55:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xe000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:58 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000140)) read(r1, &(0x7f0000000040)=""/105, 0x390) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) syz_open_dev$amidi(&(0x7f0000000180)='/dev/amidi#\x00', 0x80, 0x200000) getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r1, 0x12, 0x2, &(0x7f00000000c0)=""/12, &(0x7f0000000100)=0xc) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) [ 940.268829] 000000003d381f7f: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 940.277727] 00000000fe07142d: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 940.286613] 00000000e0a8a660: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 940.295507] 00000000cf52ecac: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 940.304659] XFS (loop6): SB validate failed with error -117. 08:55:58 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(0xffffffffffffffff, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xf4010000}, 0x0) [ 940.327682] validate_nla: 4 callbacks suppressed [ 940.327692] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 940.351631] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 940.367216] binder: BINDER_SET_CONTEXT_MGR already set 08:55:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4788], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:58 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000d0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 940.377192] binder: 14746:14797 ioctl 40046207 0 returned -16 [ 940.380579] binder: BINDER_SET_CONTEXT_MGR already set [ 940.413152] binder: 14746:14749 BC_FREE_BUFFER u0000000000000000 no match 08:55:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x7914000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x31000000}, 0x0) [ 940.441217] binder_alloc: 14746: binder_alloc_buf, no vma [ 940.446911] binder: 14746:14749 transaction failed 29189/-3, size 0-0 line 2967 [ 940.472246] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 940.507194] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 940.519432] binder: 14746:14795 ioctl 40046207 0 returned -16 [ 940.537811] binder: undelivered TRANSACTION_ERROR: 29201 [ 940.548887] XFS (loop6): SB sanity check failed [ 940.551533] binder: undelivered TRANSACTION_ERROR: 29189 [ 940.553687] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 940.570256] XFS (loop6): Unmount and run xfs_repair [ 940.575320] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 940.582052] 00000000fb7f7fe7: 58 46 53 42 00 00 10 00 00 00 00 0d 00 00 10 00 XFSB............ [ 940.590918] 00000000be739925: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:55:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xd], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:58 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x0) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 940.599805] 00000000b983a00e: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 940.608686] 00000000657ffe60: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 940.617576] 000000009a4f1be9: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 940.626463] 00000000de41131e: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 940.635349] 00000000110e0e0a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 940.644240] 00000000467e126a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 940.653258] XFS (loop6): SB validate failed with error -117. 08:55:59 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:55:59 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xe00}, 0x0) 08:55:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x9effffff00000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:55:59 executing program 0: r0 = creat(&(0x7f0000000000)='./file0\x00', 0x10) r1 = accept$alg(0xffffffffffffff9c, 0x0, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r1) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:55:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x0) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:59 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000f6ffffff100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:55:59 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xfeffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:59 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x0) 08:55:59 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xe803000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:59 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3f00}, 0x0) 08:55:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x0) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 941.259689] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 941.270961] binder: 14858:14859 BC_FREE_BUFFER u0000000000000000 no match [ 941.286376] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 941.299282] binder: 14858:14859 transaction failed 29189/-22, size 0-0 line 2852 [ 941.312227] XFS (loop6): SB sanity check failed [ 941.317068] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 941.328213] XFS (loop6): Unmount and run xfs_repair [ 941.333264] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 941.339977] 00000000f07ccc40: 58 46 53 42 00 00 10 00 00 00 f6 ff ff ff 10 00 XFSB............ [ 941.348862] 0000000033beaf5e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:55:59 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x5000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:55:59 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xffffff8d}, 0x0) [ 941.357749] 0000000002113457: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 941.366616] 00000000440511d8: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 941.375504] 00000000d3fa16e9: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 941.384390] 0000000095f9deaa: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 941.391987] binder: 14858:14887 BC_FREE_BUFFER u0000000000000000 no match [ 941.393270] 0000000002568a42: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... 08:55:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(0xffffffffffffffff, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:55:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x4000000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 941.409059] 000000008dc4dc70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 941.418178] XFS (loop6): SB validate failed with error -117. [ 941.424573] binder: 14858:14887 transaction failed 29189/-22, size 0-0 line 2852 [ 941.440158] binder: undelivered TRANSACTION_ERROR: 29189 [ 941.445758] binder: undelivered TRANSACTION_ERROR: 29189 08:55:59 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vga_arbiter\x00', 0x4000, 0x0) getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f00000002c0)=@assoc_value={0x0, 0x67d8c94e}, &(0x7f0000000300)=0x8) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000340)=ANY=[@ANYRES32=r2, @ANYBLOB="f3a73d32d8199b4941acc95b5db3ec0ad30726341c300197c4e525eaca1a8c67874f20325a4303b0571405b38cef85f3e93b38733888e33b07cdbfda6eb452f39f4a10c8d313584c13dccb8966ae14b27656d0d644"], &(0x7f00000003c0)=0x64) ioctl(r0, 0x8912, &(0x7f00000000c0)="025cc83d6d345f8f762070fe35706efc0373f8c6b7e51085f7e46ffc4f5fadcd3bd6b97f4c5c1b2d5b4610021df01b11c1c19fe31f698b") r3 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x200000) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000440)={{{@in6=@mcast1, @in6=@ipv4={[], [], @loopback}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@ipv4}}, &(0x7f0000000540)=0xe8) setuid(r5) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r3, 0xc0305302, &(0x7f0000000040)={0x4, 0x1, 0x3, 0xdd04, 0xf32, 0x5}) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x5}, &(0x7f0000000140)=0x8) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000200)={@remote={0xfe, 0x80, [], 0xbb}, @dev={0xfe, 0x80, [], 0x18}, @local={0xfe, 0x80, [], 0xaa}, 0x80, 0xfffffffffffffffb, 0x8, 0x400, 0x3, 0x4, r4}) creat(&(0x7f0000000580)='./file0\x00', 0x119) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000180)={0x3, 0x4, 0x0, 0x3, 0x8, 0x3ff, 0x7, 0x62, r6}, &(0x7f00000001c0)=0x20) r7 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0x11, 0xe, 0x4, &(0x7f0000000400)) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="1163484000000000000080000000000000020000b12f218a652f4b0000000000000000000000004049a88194a00f000000000000000000000000000000400000007bb83d08f66a2c10c9c1568cec02913356f2185fa131677eb28bcb5f0059fbdec11db0a74dd4103b39a12864cb6f2e556440be90b216e460ceaf4711c607d8f8679f192b5dd8a8e33a3c66ab21d811a052e4b2476bb6c3a96da2b0cba2530ff11732ff28f72958395a72c904db329dbc", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) [ 941.523814] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 941.570885] binder: 14904:14906 BC_FREE_BUFFER u0000000000000000 no match [ 941.573103] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 941.584481] binder: 14904:14906 transaction failed 29189/-22, size -7745724851540721664-4000 line 2852 [ 941.616277] binder: undelivered TRANSACTION_ERROR: 29189 08:56:00 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:00 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000030030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:00 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x800000000000000}, 0x0) 08:56:00 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x1100], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:00 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x74000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:00 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = dup2(r0, r0) fanotify_mark(r0, 0x0, 0x40000001, r1, &(0x7f0000000040)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x20000, 0x0) write$P9_RMKDIR(r0, &(0x7f00000000c0)={0x14, 0x49, 0x1, {0x4, 0x6, 0x5}}, 0x14) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x97, 0x0, &(0x7f0000000680)}) ioctl$KVM_SET_TSS_ADDR(r3, 0xae47, 0xd000) [ 942.264107] binder: 14922:14925 BC_FREE_BUFFER u0000000000000000 no match [ 942.276786] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 942.301156] binder: 14922:14925 transaction failed 29189/-22, size 0-0 line 2852 08:56:00 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) ioctl$EVIOCREVOKE(r1, 0x40044591, &(0x7f0000000080)) tkill(r0, 0x15) 08:56:00 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x0) 08:56:00 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xe80], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:00 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x1000000}, 0x0) [ 942.317457] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 942.345217] binder: 14922:14925 BC_FREE_BUFFER u0000000000000000 no match [ 942.358387] XFS (loop6): SB sanity check failed 08:56:00 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xa00000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 942.363235] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 942.374384] XFS (loop6): Unmount and run xfs_repair [ 942.379446] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 942.386159] 00000000a9d78995: 58 46 53 42 00 00 10 00 00 00 30 03 00 00 10 00 XFSB......0..... [ 942.389175] binder: 14922:14925 transaction failed 29189/-22, size 0-0 line 2852 [ 942.395038] 0000000078fa100b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0xf000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 942.395053] 00000000045b67f0: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 942.420369] 00000000f322ab9c: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 942.429261] 00000000f83ba8e1: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 942.438162] 000000002811e723: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 942.447076] 00000000f5951c1f: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 942.455963] 0000000093601d23: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:00 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3}, 0x0) [ 942.465172] XFS (loop6): SB validate failed with error -117. 08:56:00 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x0) 08:56:00 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = open(&(0x7f0000000b80)='./file0\x00', 0x204000, 0x40) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a00)={{{@in6=@ipv4={[], [], @multicast2}, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f00000006c0)=0xe8) ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r1, 0x800455d1, &(0x7f0000000500)) syz_mount_image$hfsplus(&(0x7f0000000200)='hfsplus\x00', &(0x7f0000000240)='./file0\x00', 0x8, 0x7, &(0x7f0000000940)=[{&(0x7f00000003c0)="2a80d031ebc60505877a8ee621ae87dcdb2e0dff9c9d8053f161bc79f9aacc7669bebd4c1fbfffbbaf727ec8c084ebb10143b8d4a3c00a1b0b33d0f320", 0x3d, 0x200}, {&(0x7f0000000400)="a82df7925d9ef6c89d571bb701c18670c73d1ca8cf258aa7edf780b506640be1eedca19ff0ac653a6ad63d4ca1682199fe332578bba3b53ebdb657e91fd531109e106472aa68a81a5a29f60185bdb2faa3b3c254a92403a5f6dd75a09d03bffab0d27e4986b71b03e2e3a6b9b63296e5511f04301fc03e259eeabd4a1c8910753fa4bcd7769ec724279bbbbe76ad08c2009b3bd5593b6912e050c1ab067ed91ae53cb9c263900a2f71f9d52631233e1baa8bf44dc3f04675be71b51236b7eb859c10639450506d2cf25f1b153b2023159d0e71bb4b24fb89d27a292fea2024319cc6787d4a9a17ecc2afa8a8", 0xec, 0x200}, {&(0x7f0000000580)="ab8d8104dfd7d72ec19281a95ea1be718deba8625e44060e4efa5d4fed7e507072cac18e1e859ced7e2a267ee07d970b62ee61a2cb6316f3f15d50f745513b439c27caa2d7b9a39f506ee4f06d9cc51f3beede82757cf549bb8b595c7bbe7bbf41ddc6cf133530a6d151883a6e7687d931c7eb87586726b8dfee0c17fb995d1f47b3b61a077ca3", 0x87, 0x3}, {&(0x7f0000000640)="eeca", 0x2, 0x3f}, {&(0x7f0000000680)="0a56c7e1e136c82b4e507d8de5", 0xd, 0x8}, {&(0x7f0000000740)="3666bad543c6af91d2006232b9ced4c1e503189a22620a599a89f97880e632b1a0f1880ba35e82f375d09d002b43a8f3ba884b085bf192b3217bfaae4494c80b085fb041ff2f72d238ec4a2386c947e754b99d8918cc4ed8e3abf578b27683e166dab7f334dcff7104e1f3ea3596b2a71666af1a492aa37c775d5b9c6e87df7fe52355f206cafe59eb7016fb60cafa7dc7c3fe346ff9c8dce70c6f42cdd5b13e7d0ff70101aec165e74e8e89bae7572512a4fb89a8f9ef2f0e609002ba373b4877018a7250d85e38a663272eec316757c250778b", 0xd4, 0x9}, {&(0x7f0000000840)="7ed81d2d1debcffaf49d394ecbaded20f145c844bf6be49c2f28668661aa84fa6b18102ddf87d780f29b3ad5b7f998e70eafba8939d6cfd9197d2aedeab236c8ddd8d257d293bb96d597e4a91a265d7d6da0313619c997f1118d3bc21fc01913ba5b4b47ccb868fa2d08dfd28f59d74816b56cbb42d0ce08faeb16586adbe4183d0bcf8c4820023af6564c7b5c590855a5cb9fe39ac1fc1166ab41f8cc45e6c253a8fd6b4e9e2db27612af9a7a11a86abd76b2aaa702958331c6ae51eefae2bdeb3f2a4bea1faf638977b1ba94dfc8aabc17ead45091b339", 0xd8, 0x200}], 0x2000000, &(0x7f0000000b00)={[{@part={'part', 0x3d, 0xfffffffffffffffb}, 0x2c}, {@decompose='decompose', 0x2c}, {@uid={'uid', 0x3d, r3}, 0x2c}]}) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001d80)={0x39, 0x0, &(0x7f0000000cc0)=ANY=[@ANYPTR64=&(0x7f0000000d40)=ANY=[@ANYRESHEX=r2, @ANYBLOB="b37dc9ac1d3e568bdac1113e50a1575cb4d53a8f300490b245deabb72f33b62c5cd04164f910f67c81b8c49adfdb4b30085c75da3bc866a20fae9a9fc259562f4f1c3e90011a31908f783788de3eb2c5ea3cdb474af6daa44e2e241bd519b856d5f7e302cd25b2d1953ab2851c090ac4eb411584c37eeba55f092679bad203414d9b8da318020b7ab6b06145c431f5202327e62de1710971323fd94ceda2440093778bbe236e8e6eb6b76c6b2d9820871f40245cb15bfc6a23903e7e8b8fe49eb35cf6ec0a141ef08916bcec5786a5e21c8f90dcc0498e16e92351d4d73d085e5e2c6dcd7c096b7e4c087cda174edea23b5de4dd4f947c3b3fc44758dae2ee36d083a0bcfc31989e14303b6ec58e46b9b459e1f0da0a70bee29d1289c96ff8561722aeb8684d31ae9d15d99f54688182d949f132a9c254b6e76554f3c24561acda8c56e1f34bf5462ae62e8d3afd2f0e29e8044c40bca36a665e525105082b9c782105b91f1d4ead3709c4f9b2b9c2d37d327550a2ff5bcb9a2d2bc41258cb29850555cfe00ec6b85dc70354819aa4939b24e4a35884bd4d4b84b95c31da8a60fc08402439b1fe5292357ad0a3391da0599ccc308ac251282fb2c8d2176f90eccd05037805aec64b095042b5913a295faf5cc6b363bcbfc6f21e9aeeb306d794dcff4d7b1cea9479359887db4b89f89c3d27d72ae567debb0f0041e01e9ffb1ae5a4240a420710f7140e358d12d518d3cf62f146530d3ac937ac95bb48a951e9d87b1fcab3f675cc4cb840e0985ff13eb7755dea4e355bbc1b802b25cf353ef619280fcbc78ddc075944b78ee909e7d6ec0786cd425618ae7f0e396cfa957ae28bf294228b96477e2c789ca3f25c64df72b3b135beb0d0938ce2c1f42c69e51ea3be976e61997bdc835fc70ba05d89d385fbdf909846b1d666f866c6add8caf4b0d9b4e5be8a144dc6820d979be3a0759cd84f8a1a13554c81b7504fe95b90f2983c9e9a553c93e762e238e5db21337c2ee289c6f6f05325542fcafd87957c76fb3cffdfb56f37757654635e20a926fbbbc32d2fec265cc7b90fe4757d8f898b14c8e6fa9873d594727c6c6e783f271a5b0a00d5653f713487538dc01cf673cc30c54ffb5b72fdc3e0f399ed42ee8b6e796858df13420d5ff09e8c171da0be4f6b2543d9f3b9b3a8c4985b4274add77954fd065e6044c91bcca09c9270d740b8598dc483ffdbf42cdfba7cfffb414e2e3c6ce26f2cfb542a1b3e016612ebb37c02206c1982ef5e6da96582165caeecbe6895f04031b64f6342d8538a5101096360dcdcd3dc8d8cdbbd9585a1c3dce6f3dcb426f5a261f47bac19d3129fc67f1996a2926fa869c08d5646b00308ab2e0d250d8c419ab1082e148ea64a3da74bb88184b26ad5bda9b1ed58844b982c28179bdfe0586373bd82fa2fb09439aa092303fbe766e0eb79effc33df87ae9b30e227e0f970bcea9b04473a4f83dd092bf4205f8205832c8a7a85ca081ffa46552328f678b2b81a38efe17be14cf31a82686ec6e475caa8bb43f77879d7a0153cfb77424f2840d274c3a9057979e16fc8bc1d78084965713bde2a022dae6789ab101a4ad3189039a52bd97576c5a84d2a27aa5b369666a2c8a1e25b1e99c503296bf25f0aba4edeab7aeed48b514b9ba405e77861b7ce0dbda9a7f9673c9439d8f66be7aa1f29f43b0be9f60280363dbf72e571d7b18beae021f449bcc66f04a6f1cc47d7501f78fd4c70173add6deecad2cbbc7ceedb158e8c8ddc9a46a8c67bd0b461144ab086930fa9541e31246220d8f150c59ee278c0840407c74c77da20a6fb5386027a3637faa64d82c8e33f8dc91fc67b4fad50d1fee77f1f2ba511865ad7aa2679f6d652deaa4fc890b477bd506027d62d22ef90af4345d901f61a153d2c9bf5d19b266f7552dcedf66729a151c45d3ce89b1566e73f1574f2b8098a24c71e4e6e88d7a6c231b7c24aa5db55dbd56a462f8a8dfd851f7262b9b333bca390033b4ad87301b93f6f733c3a835394913539fe74018670124916ffff2314f903edd6c2fb98288a49438cd713d5f131832f6aa9fa1e211bc665f6fdc1846cfcdec7e004ade014fc5ff5afcfb12380a91239615a3f7ee6a6b2f22d978b59ad3368bcfdada42b79d165e066eb48b22adbad9035f1d73c6150a42ff5e10e0a56fd8d18456700d7f46c9dd8196612f7f4b6488dc22e6b3ac38d4157518b74124db3d6ab081600b67fe68d8eca5dd2f0ca08de8914fb369f8840362f9b61bddd8f5830417f39a0df718adef4da13ac003d19391402d6bc14166ca832649c91970cc831bdcef9d2371aae228f9952fbe4feab844924d19b12522b8d39d7bd91fafe7dd24d1dff4ac27cdf0001bf56d3359c2a6a747805f294b6f931b8461352777fcad6e15e79d0e9c530768bc3f86fc8df32710b373c333776528c77f2f361bfe50c7c5747fae39f4afa903d2a9e4becab1758155e46a77581f7577e8f74d2db8e73081cf3b038ebf8d47a3d447932305f94acc973ccba62d420cacc1cfb2420a895c357b05ee513484a47a6af2b1fce7c3b6e64c9d151e1f8e8b55a9e896bb9e9c1fe20dee2a7698734a57c35be7a3fe5186f539ae32b8f420cc227d472244dc17e6af2d3c482caaf31945460bfc3ddb680a9f5df62b261637591a54151eecca6396cbf167c0df30fbdba2bfb48db1f602b8fad0d7b4aa335012d42ba3f63813ed555aac21ba8edf1fd7a56ca8b344e4b5fa5a87b3feeda71c024da02b571e973c8c65f45142b620908d61fafad3df3c8442713c9fa8f37d00446ea7d7c02faeda650bf7abf14d9f9a70a4fc297ceb79aba76c386d187e025696df3f6ded2078f3c1a936036b9a92fc166cabacaf8256f20a9421b67b2bf5b0b1e913d449c47296282828b6f65e3ec1d6456a430d016522bc42d00aa7d072e0fb03da470b08cca5b034f6877b166dd58de642950adec62fbfa607a1d608d0f3a26d313c01727734ed56d003e0ea560a7ed29131d244e296f0e9fe3ab01e41b536089366fca19db4399ee5ce039a7cd014eab0c5449e383efc72fee82b7d08150140bb7705b29d237d797c30d31c989c390f79f8d302d8a1d5f69a6f8bb302e282c16b78769c4a77ba025e21c1f5f6450b5feeeafb5af02acdcc836012942ceb13b3abb41454abcfa01f60d9b31aae5f294e03d796100a571f0759115d2670587e1e10c5392cd346c0894c2d09404c0266a2c49ca136e32f9b0929852ca70a26179adde0c4178f0460108bcec5177efd197e289ad0c7c799b6eb9bfbfa6db367995574a05efb523cf830c28e44ac702bf4ddbdbef5c5ca32271619510ed335d34d66ed9fc2c3c5f6b18ee10b30958628a786b4c46f177bb1f174939bba0e2c62b730a25373ecde4edc6bffdc9be492f62fa10b5563d46554aa862bfadc13190825ced35780d32a4820fa51195eb3e0527cd49c931af4041428a717aef9d74d64cea646ac4dbf2abf40f322e29c36a62c27c8dd57a651f4550718087957e82d5f6f6f650dd7c5ce86f6bf34443f538ff89dd36829761a6764ba80f71573f67ac13354e1fa0fba0d6fa1bb2903a03c36480ddac6d41a1dd2cda1484d3b0aa05c5e4016de1bbb48736f859f6a6c4b4d4787880295b1c000abc185acb024b23217c36bc155f8ba7f923ca5be979d399a08340c857ee19bc8a6f9a9209ddb0c470316fb244b9adf7ec98beb5d1984fb91cf4c4ff9038d2219c5c09ad3356c2726564811bb6afe98d1bda3ea2a3b89e9e8d002b82173bf54e90f8a91bc7697bd1ed59dfa09e8065e207a2589911da71149e896ee7853de264702d9fe28ac37122fb792cfae00ae158238e16af8ab08995fd1bc376fd828e120561ba93f3dd2f0ddebec34cb3fd9f944162de3ecd60c13c4b8423a1024a9ac0ff4bb09f5976fb147789139494a6ddc034dd4de26b1da320c92b3c0bd5db4fce85bd3564c2ab4b6b31eb91969534d6054859ccfff7a0f2100f567ae3ef1d976ab63312c08ff7cf068386b3b33c6aa067bc04be0e676734f609141016f98ec08c4d6a133fedfe4b3a9e286522d5ab80e6f1f6782e54da71b585969c9cfc0ecd1b29e648514d2363bf5b7d6e72de9d7a4a12e35e116920a73a6237fb63a563bc6507b649f861635f7ad5069582cc1d2bab71607cb543abb443d3ada6ba7b8eddc1862a13ba2f21c7a472d360dcc0816a1ec4db468df33dcdca8485f1974727fb591443a65fe846506b5b288fce9b35c15bf7f2277991bd9c793c41b8d3020a3ae6e98b0b40fe7b22f3cccee010d67b57cc65825a56b0ee623a199e565d5ec6561e027667bf5d5bba18f61515a17599b6427a79cd6892eb6eb5cdf4681e6b0f9af64a98ca4c868c1e75e6054c7134cd99f353269e0605d2ed08050c63ea35d4cc47dd07adcd80bea79ca31c495e359a8a60634886c5d027020f9f1e061190164c5e13cb0bfc010585777a6a980a7eb7c2545221403ff812d83738d4fe97cdfb9e84062a3d2913b543c9b698f311c2310bb588d112327235fc00fd16cfed70e5d9b51b0bf28692f4702574435fea742985ca5a45e0e4527fdae39936d3f11593a3067bcd8979e3b6af322e05a1a74730b5163353e54a1887e5de6c86aba70990835154a00defe30c8e8ad31ce1575468ed428842251c1a6f8fc07d3ab5664eb8dfc8fa0465e51a22115db345993767401f79ad1926f26fe7f0b834ba8c132404acbba3350cc145c2f84d7490411c1b0ba4db5928d798ad48c86afa0aa64fbbce8d993f03c5f87c00e7649219a1f890139500242aea19ea24de70c7df271f3a85690f1e98ac48711b9334fb30b49b45671b95b8e0cb039df41695cdf54d88271521798765e2d036c7185cbdec873b026e625a89c438a49147ac4dddc6aeeda083be58209c11ff31be709a286338a499f1cccbac9339476004a9f5bc10df5cf94145aeb1a3962d08b53f356107a9b18e8fddb5e9d9def3998bf011692a69470b0396bccd7c4c47ad7801bae4020877c4343bf4b1d155509a984f623779d75de63229746c9cfd553de2130194dd1776e7b8d7a4a340915822e7ed96e3a5dce05e639933bc54790f39c0534be1c3882749e560a3aecbaf9e7ee23b358e2c63442656f18e676469d513cf3b9539da1b7dca139bf21b9a5976e7de3b0003e977ffbfe63298778cea4874a43cd586dd819db8f1c7e389eb003f33e0d16028634f20abe05d662e832c528fbc69fd9a1a668255c10974a0266be7a324d01e6921d6bd0fcfb53f623692b86338e44f692724e4882ae421a0a762e12733cd0fb92e74c9bae550df97b88f3b4de67b245f541b5d13bc9598d0f1e28e40e1ed780a5f9f76ad2d13e4df2703f2a8dd54a6aa5d3c2c7816b91e8edfaebe7caa79ffd0b4f0795d9eea5600a457e7450bbdc4a597644b866bfc84b94c814fd418c5ad3867ce2c0a8bbf52712dba750fd11a1c9c854c2311147acc87a29e92961e9ebfd28c6a92b8cc37b443bbba93aa0d6d0f516f84b7ac149879d18c808444a390b8d0ef406936aadb95f7807f7499f83cef459d20de40de5fe0b29d7f592f655d708f12f0a5a164ad6b1996ac46022c2d45f16a806b2b4fbbb68f051bda9a5826630741692250e35a4878661fe8e88a8963380b1a66d1a5cfda6a4d4f7cdc42a8ab2f91475e69f13a02ba4defd3fdba67c93f6ecaba30d67b09bf62bb2c2f637b4919addc427235351dfdb2c21956583eaa64919ba2e50f879da818cb943a552b316d584bdcaf376edabba0df", @ANYRES32=r0, @ANYRESHEX=r2, @ANYRES16=r3, @ANYRESDEC=0x0], @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="0000000000de0000"], 0x220, 0x0, &(0x7f0000000680)}) r4 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x1, 0x8002) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000700)={0x6001, &(0x7f0000000540), 0x2, r4, 0x4}) prctl$void(0x20) ioctl$EVIOCGABS3F(r4, 0x8018457f, &(0x7f00000002c0)=""/236) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) syz_open_dev$binder(&(0x7f0000000b40)='/dev/binder#\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r4, &(0x7f00000001c0)={0xb, 0x10, 0xfa00, {&(0x7f00000000c0), r5, 0x1f}}, 0x18) [ 942.599540] attempt to access beyond end of device [ 942.604609] loop0: rw=2048, want=3, limit=2 [ 942.613668] hfsplus: unable to find HFS+ superblock [ 942.625448] binder: 14978:14980 unknown command 536874304 [ 942.631192] binder: 14978:14980 ioctl c0306201 20001d80 returned -22 [ 942.652500] attempt to access beyond end of device [ 942.657551] loop0: rw=2048, want=3, limit=2 [ 942.662449] hfsplus: unable to find HFS+ superblock [ 942.676229] binder: 14978:14985 unknown command 536874304 [ 942.681885] binder: 14978:14985 ioctl c0306201 20001d80 returned -22 08:56:01 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:01 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x6c000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x500000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:01 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x4000000000000000}, 0x0) 08:56:01 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x0) 08:56:01 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000bc000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:01 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000dcc000)='/dev/snd/seq\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCDELRT(r1, 0x890c, &(0x7f0000000180)={0x5c0c, {0x2, 0x4e23}, {0x2, 0x4e23, @rand_addr=0x8}, {0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, 0xa0, 0x10000, 0x9, 0x80000000, 0x5, &(0x7f0000000000)='tunl0\x00', 0x71, 0x80000000, 0x11}) setsockopt$packet_int(r3, 0x107, 0x10000000000014, &(0x7f0000000080), 0x4) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r1, 0xc0a85352, &(0x7f00000000c0)={{}, 'port1\x00'}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r4 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:01 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x13) 08:56:01 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x500000000000000}, 0x0) 08:56:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x40030000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:01 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xffffff87], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 943.386282] XFS (loop6): SB sanity check failed [ 943.391126] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 943.402273] XFS (loop6): Unmount and run xfs_repair [ 943.407337] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 943.414057] 00000000f70580b8: 58 46 53 42 00 00 10 00 00 00 bc 00 00 00 10 00 XFSB............ [ 943.422931] 000000004f831134: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:01 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x5c, 0x0, &(0x7f0000000140)=[@clear_death={0x400c630f, 0x4, 0x3}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x31, 0x0, &(0x7f0000000100)="4ac18ddd7f5160e9be153ced7453d6e65a4152971eb6d72c06dd8c641470b4e25fc0ac91fee87375a22ba4e1468f93bca5"}) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x800, 0x0) ioctl$EVIOCSKEYCODE_V2(r2, 0x40284504, &(0x7f0000000040)={0x0, 0x14, 0x5, 0x4d22c72f, "ead43bd02fcd1ea49559913cd30694580f811d8207124afcfed0d7d2126fbc08"}) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000001c0)={0x0, 0x0, 0x10}, &(0x7f0000000200)=0xc) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000240)={r3, 0x7}, 0x8) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f00000000c0)={0x100000000, 0x2, 0x1ff, 0xff, 0x1}) 08:56:01 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8004020000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:01 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xfe800000}, 0x0) [ 943.431804] 00000000bd247797: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 943.440691] 0000000001a6c0c7: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 943.449581] 00000000ec028497: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 943.458473] 00000000bad30f47: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 943.467354] 0000000061346919: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 943.476246] 0000000015569255: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:01 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(0xffffffffffffffff, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x20000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 943.485212] XFS (loop6): SB validate failed with error -117. [ 943.506838] binder: 15038:15046 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 943.538776] binder: 15038:15046 transaction failed 29189/-22, size 0-0 line 2852 [ 943.550376] binder: 15038:15046 ioctl 801c581f 200000c0 returned -22 [ 943.561372] binder: 15038:15046 BC_CLEAR_DEATH_NOTIFICATION invalid ref 4 [ 943.588149] binder: 15038:15046 transaction failed 29189/-22, size 0-0 line 2852 [ 943.608996] binder: 15038:15055 ioctl 801c581f 200000c0 returned -22 [ 943.639561] binder: undelivered TRANSACTION_ERROR: 29189 [ 943.645687] binder: undelivered TRANSACTION_ERROR: 29189 08:56:02 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:02 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x3c], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:02 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xf5ffffff}, 0x0) 08:56:02 executing program 3 (fault-call:15 fault-nth:0): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:02 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000007a100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x43000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:02 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x80) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000040)=0x6, 0x2) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="ef620201", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) setsockopt$inet_sctp_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000140), 0x1) ioctl$KDMKTONE(r1, 0x4b30, 0x4) epoll_create1(0x80000) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f00000000c0), &(0x7f0000000100)=0x4) [ 944.297196] binder: 15072:15085 unknown command 16933615 [ 944.311492] FAULT_INJECTION: forcing a failure. [ 944.311492] name failslab, interval 1, probability 0, space 0, times 0 [ 944.313817] binder: 15072:15085 ioctl c0306201 20000700 returned -22 [ 944.322855] CPU: 0 PID: 15077 Comm: syz-executor3 Not tainted 4.18.0-rc4-next-20180711+ #4 [ 944.337714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 944.347088] Call Trace: [ 944.349163] binder: 15072:15085 unknown command 16933615 [ 944.349700] dump_stack+0x1c9/0x2b4 [ 944.355331] binder: 15072:15085 ioctl c0306201 20000700 returned -22 [ 944.358770] ? dump_stack_print_info.cold.2+0x52/0x52 [ 944.358791] ? trace_hardirqs_on+0x10/0x10 [ 944.358808] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 944.358830] should_fail.cold.4+0xa/0x11 [ 944.384314] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 944.389441] ? find_get_entries_tag+0x1410/0x1410 [ 944.394303] ? trace_hardirqs_on+0x10/0x10 [ 944.398536] ? mntput_no_expire+0x18e/0xbc0 [ 944.402855] ? do_raw_spin_lock+0xc1/0x200 [ 944.407086] ? mnt_get_count+0x150/0x150 [ 944.411155] ? lock_acquire+0x1e4/0x540 [ 944.415124] ? fs_reclaim_acquire+0x20/0x20 [ 944.419430] ? lock_downgrade+0x8f0/0x8f0 [ 944.423566] ? __fdget_pos+0x1bb/0x200 [ 944.427439] ? check_same_owner+0x340/0x340 [ 944.431748] ? rcu_note_context_switch+0x730/0x730 [ 944.436666] __should_failslab+0x124/0x180 [ 944.440891] should_failslab+0x9/0x14 [ 944.444680] kmem_cache_alloc_trace+0x2cb/0x780 [ 944.449335] ? _parse_integer+0x190/0x190 [ 944.453470] alloc_pipe_info+0x175/0x5a0 [ 944.457515] ? pipe_read+0x940/0x940 [ 944.461218] ? ksys_dup3+0x690/0x690 [ 944.464924] ? lock_release+0xa30/0xa30 [ 944.468884] ? pid_task+0x115/0x200 [ 944.472497] splice_direct_to_actor+0x6fc/0x8f0 [ 944.477155] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 944.482681] ? pipe_to_sendpage+0x400/0x400 [ 944.487126] ? do_splice_to+0x190/0x190 [ 944.491087] ? security_file_permission+0x1c2/0x230 [ 944.496095] ? rw_verify_area+0x118/0x360 [ 944.500237] do_splice_direct+0x2d4/0x420 [ 944.504374] ? splice_direct_to_actor+0x8f0/0x8f0 [ 944.509203] ? rw_verify_area+0x118/0x360 [ 944.513338] do_sendfile+0x62a/0xe20 [ 944.517047] ? do_compat_pwritev64+0x1c0/0x1c0 [ 944.521624] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 944.527147] ? _copy_from_user+0xdf/0x150 [ 944.531280] __x64_sys_sendfile64+0x15d/0x250 [ 944.535761] ? __ia32_sys_sendfile+0x2a0/0x2a0 [ 944.540334] do_syscall_64+0x1b9/0x820 [ 944.544208] ? finish_task_switch+0x1d3/0x870 [ 944.548691] ? syscall_return_slowpath+0x5e0/0x5e0 [ 944.553610] ? syscall_return_slowpath+0x31d/0x5e0 [ 944.558526] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 944.563528] ? prepare_exit_to_usermode+0x291/0x3b0 [ 944.568528] ? perf_trace_sys_enter+0xb10/0xb10 [ 944.573187] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 944.578024] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 944.583197] RIP: 0033:0x455e29 [ 944.586392] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 944.605571] RSP: 002b:00007f66589c6c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 944.613265] RAX: ffffffffffffffda RBX: 00007f66589c76d4 RCX: 0000000000455e29 [ 944.620520] RDX: 0000000020d83ff8 RSI: 0000000000000017 RDI: 0000000000000015 [ 944.627776] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 944.635034] R10: 00008000fffffffe R11: 0000000000000246 R12: 0000000000000018 08:56:02 executing program 7: r0 = fcntl$getown(0xffffffffffffff9c, 0x9) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @tid=r0}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x28, 0x11001) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f0000000340)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) fstat(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f0000000400)=0x1000, 0x4) r5 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r5, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x80000000000002, &(0x7f0000000000)=0x78, 0x4) bind$inet(r6, &(0x7f0000deb000)={0x2, 0x4e23, @multicast2=0xe0000002}, 0x10) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r6, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local={0xac, 0x14, 0x14, 0xaa}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000080)='bbr\x00', 0x3) shutdown(r6, 0x1) write$P9_RSTATu(r1, &(0x7f0000000280)={0x9e, 0x7d, 0x2, {{0x0, 0x75, 0x77f, 0xea10, {0x2}, 0x100000, 0x200, 0x712, 0x4, 0xd, '/dev/usbmon#\x00', 0x0, "", 0x1a, '.eth0!loem0vboxnet1em1em1j', 0x1b, "27766d6e6574312b6d696d655f74797065707070307d3a5bb09a5c"}, 0x14, '$%em0@\'+(}&system,[\'', r2, r3, r4}}, 0x9e) tkill(0x0, 0x15) dup(r1) 08:56:02 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xffffff8d], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:02 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:02 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x5}, 0x0) [ 944.642286] R13: 00000000004c1113 R14: 00000000004d1540 R15: 0000000000000000 08:56:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x3000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 944.719284] XFS (loop6): SB sanity check failed [ 944.721756] binder: 15102:15103 unknown command 0 [ 944.724142] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 944.740112] XFS (loop6): Unmount and run xfs_repair [ 944.745184] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 944.751370] binder: 15102:15103 ioctl c0306201 20000700 returned -22 [ 944.751892] 00000000bfd40d1a: 58 46 53 42 00 00 10 00 00 00 00 00 00 7a 10 00 XFSB.........z.. [ 944.767234] 000000005da24824: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 944.776124] 000000001c8918e0: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 944.785058] 0000000046cc4c94: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 944.793960] 00000000a728bed9: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 944.802843] 000000007a05f455: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 08:56:03 executing program 0: r0 = socket$inet6(0xa, 0x1000000000005, 0x10001) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:03 executing program 3 (fault-call:15 fault-nth:1): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:03 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x2}, 0x0) [ 944.811728] 000000008097e772: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 944.820621] 00000000a97135ec: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 944.831213] XFS (loop6): SB validate failed with error -117. [ 944.866228] FAULT_INJECTION: forcing a failure. [ 944.866228] name failslab, interval 1, probability 0, space 0, times 0 [ 944.877679] CPU: 1 PID: 15117 Comm: syz-executor3 Not tainted 4.18.0-rc4-next-20180711+ #4 [ 944.886095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 944.895442] Call Trace: [ 944.898029] dump_stack+0x1c9/0x2b4 [ 944.901648] ? dump_stack_print_info.cold.2+0x52/0x52 [ 944.906827] ? __kernel_text_address+0xd/0x40 [ 944.911373] should_fail.cold.4+0xa/0x11 [ 944.915424] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 944.920530] ? save_stack+0xa9/0xd0 [ 944.924143] ? save_stack+0x43/0xd0 [ 944.927761] ? kasan_kmalloc+0xc4/0xe0 [ 944.931635] ? kmem_cache_alloc_trace+0x152/0x780 [ 944.936464] ? alloc_pipe_info+0x175/0x5a0 [ 944.940689] ? splice_direct_to_actor+0x6fc/0x8f0 [ 944.945528] ? do_sendfile+0x62a/0xe20 [ 944.949401] ? __x64_sys_sendfile64+0x15d/0x250 [ 944.954059] ? do_syscall_64+0x1b9/0x820 [ 944.958111] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 944.963463] ? lock_acquire+0x1e4/0x540 [ 944.967423] ? percpu_ref_put_many+0x119/0x240 [ 944.971996] ? lock_downgrade+0x8f0/0x8f0 [ 944.976150] ? lock_acquire+0x1e4/0x540 [ 944.980115] ? fs_reclaim_acquire+0x20/0x20 [ 944.984422] ? lock_downgrade+0x8f0/0x8f0 [ 944.988558] ? lock_downgrade+0x8f0/0x8f0 [ 944.992700] ? check_same_owner+0x340/0x340 [ 944.997010] ? percpu_ref_put_many+0x131/0x240 [ 945.001594] ? rcu_note_context_switch+0x730/0x730 [ 945.006513] __should_failslab+0x124/0x180 [ 945.010738] should_failslab+0x9/0x14 [ 945.014528] __kmalloc+0x2c8/0x760 [ 945.018060] ? kmem_cache_alloc_trace+0x318/0x780 [ 945.022893] ? _parse_integer+0x190/0x190 [ 945.027035] ? alloc_pipe_info+0x2a8/0x5a0 [ 945.031257] alloc_pipe_info+0x2a8/0x5a0 [ 945.035308] ? pipe_read+0x940/0x940 [ 945.039014] ? ksys_dup3+0x690/0x690 [ 945.042721] ? lock_release+0xa30/0xa30 [ 945.046683] ? pid_task+0x115/0x200 [ 945.050300] splice_direct_to_actor+0x6fc/0x8f0 [ 945.054958] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 945.060483] ? pipe_to_sendpage+0x400/0x400 [ 945.064792] ? do_splice_to+0x190/0x190 [ 945.068752] ? security_file_permission+0x1c2/0x230 [ 945.073758] ? rw_verify_area+0x118/0x360 [ 945.077897] do_splice_direct+0x2d4/0x420 [ 945.082037] ? splice_direct_to_actor+0x8f0/0x8f0 [ 945.086871] ? rw_verify_area+0x118/0x360 [ 945.091007] do_sendfile+0x62a/0xe20 [ 945.094719] ? do_compat_pwritev64+0x1c0/0x1c0 [ 945.099289] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 945.104810] ? _copy_from_user+0xdf/0x150 [ 945.108947] __x64_sys_sendfile64+0x15d/0x250 [ 945.113430] ? __ia32_sys_sendfile+0x2a0/0x2a0 [ 945.118003] do_syscall_64+0x1b9/0x820 [ 945.121881] ? syscall_slow_exit_work+0x500/0x500 [ 945.126711] ? syscall_return_slowpath+0x5e0/0x5e0 [ 945.131630] ? syscall_return_slowpath+0x31d/0x5e0 [ 945.136549] ? prepare_exit_to_usermode+0x291/0x3b0 [ 945.141561] ? perf_trace_sys_enter+0xb10/0xb10 [ 945.146216] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 945.151053] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 945.156233] RIP: 0033:0x455e29 [ 945.159401] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 945.178585] RSP: 002b:00007f66589c6c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 945.186280] RAX: ffffffffffffffda RBX: 00007f66589c76d4 RCX: 0000000000455e29 [ 945.193535] RDX: 0000000020d83ff8 RSI: 0000000000000017 RDI: 0000000000000015 [ 945.200809] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 945.208068] R10: 00008000fffffffe R11: 0000000000000246 R12: 0000000000000018 [ 945.215321] R13: 00000000004c1113 R14: 00000000004d1540 R15: 0000000000000001 [ 945.237371] binder: 15125:15126 BC_FREE_BUFFER u0000000000000000 no match [ 945.259771] binder: 15125:15126 transaction failed 29189/-22, size 0-0 line 2852 [ 945.293307] binder: undelivered TRANSACTION_ERROR: 29189 08:56:03 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xf5ffffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:03 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xe}, 0x0) 08:56:03 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000003fc100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:03 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="8cae737c89960ca8"], 0x0, 0x0, &(0x7f0000000680)}) 08:56:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x3}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:03 executing program 7: r0 = gettid() r1 = syz_open_dev$sndpcmp(&(0x7f0000000040)='/dev/snd/pcmC#D#p\x00', 0xf91, 0x40b00) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f0000000080)) timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r2 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x2000000000000000, 0x40) read(r1, &(0x7f00000000c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:03 executing program 3 (fault-call:15 fault-nth:2): r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:03 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xa000000}, 0x0) [ 945.418642] binder: 15145:15151 BC_FREE_BUFFER u0000000000000000 no match [ 945.429261] validate_nla: 12 callbacks suppressed [ 945.429268] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 945.430703] binder: 15145:15151 transaction failed 29189/-22, size 0-0 line 2852 [ 945.457847] binder: undelivered TRANSACTION_ERROR: 29189 08:56:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x6000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 945.466274] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 945.472810] FAULT_INJECTION: forcing a failure. [ 945.472810] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 945.485588] CPU: 0 PID: 15159 Comm: syz-executor3 Not tainted 4.18.0-rc4-next-20180711+ #4 [ 945.494002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 945.504203] Call Trace: [ 945.506789] dump_stack+0x1c9/0x2b4 [ 945.510408] ? dump_stack_print_info.cold.2+0x52/0x52 [ 945.515590] should_fail.cold.4+0xa/0x11 [ 945.519637] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 945.524729] ? update_load_avg+0x2de/0x2590 [ 945.529045] ? rcu_is_watching+0x8c/0x150 [ 945.533183] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 945.538706] ? xas_start+0x23d/0x740 [ 945.542408] ? trace_hardirqs_on+0x10/0x10 [ 945.546632] ? lock_acquire+0x1e4/0x540 [ 945.550594] ? find_get_entry+0xa6d/0x1120 [ 945.554852] ? lock_downgrade+0x8f0/0x8f0 [ 945.558991] ? lock_acquire+0x1e4/0x540 [ 945.562957] ? fs_reclaim_acquire+0x20/0x20 [ 945.567288] ? lock_downgrade+0x8f0/0x8f0 [ 945.571427] ? check_same_owner+0x340/0x340 [ 945.575738] ? find_get_entry+0xa96/0x1120 [ 945.579959] ? rcu_note_context_switch+0x730/0x730 [ 945.584882] __alloc_pages_nodemask+0x36e/0xdb0 [ 945.589541] ? percpu_ref_put_many+0x119/0x240 [ 945.594112] ? __alloc_pages_slowpath+0x2d00/0x2d00 [ 945.599115] ? trace_hardirqs_on+0x10/0x10 [ 945.603343] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 945.608870] ? xas_start+0x23d/0x740 [ 945.612572] ? lock_acquire+0x1e4/0x540 [ 945.616532] ? xa_load+0x288/0x450 [ 945.620063] ? lock_downgrade+0x8f0/0x8f0 [ 945.624200] ? lock_release+0xa30/0xa30 [ 945.628167] ? __sanitizer_cov_trace_const_cmp2+0x18/0x20 [ 945.633693] alloc_pages_current+0x10c/0x210 [ 945.638095] __page_cache_alloc+0x398/0x5e0 [ 945.642402] ? xa_load+0x2b1/0x450 [ 945.645930] ? xa_clear_tag+0x40/0x40 [ 945.649720] ? filemap_range_has_page+0x4c0/0x4c0 [ 945.654551] ? unwind_get_return_address+0x61/0xa0 [ 945.659471] __do_page_cache_readahead+0x24e/0x690 [ 945.664422] ? read_pages+0x680/0x680 [ 945.668230] ? lock_acquire+0x1e4/0x540 [ 945.672192] ? page_cache_sync_readahead+0x2c8/0x6d0 [ 945.677281] ? lock_downgrade+0x8f0/0x8f0 [ 945.681416] ? lock_release+0xa30/0xa30 [ 945.685380] ondemand_readahead+0x550/0xc40 [ 945.689692] page_cache_sync_readahead+0x3a0/0x6d0 [ 945.694610] ? force_page_cache_readahead+0x360/0x360 [ 945.699787] ? lock_acquire+0x1e4/0x540 [ 945.703750] ? rcu_note_context_switch+0x730/0x730 [ 945.708667] ? check_same_owner+0x340/0x340 [ 945.712975] ? lock_release+0xa30/0xa30 [ 945.716942] generic_file_read_iter+0x1a87/0x2f10 [ 945.721778] ? filemap_write_and_wait_range+0xd0/0xd0 [ 945.726952] ? rcu_read_lock+0x70/0x70 [ 945.730828] ? __unlock_page_memcg+0x72/0x100 [ 945.735309] ? unlock_page_memcg+0x2c/0x40 [ 945.739529] ? page_add_file_rmap+0x781/0xe40 [ 945.744023] ? page_add_new_anon_rmap+0x870/0x870 [ 945.748856] ? trace_hardirqs_on+0x10/0x10 [ 945.753078] ? kasan_check_write+0x14/0x20 [ 945.757311] ? __init_rwsem+0x1cc/0x2a0 [ 945.761276] ? lock_acquire+0x1e4/0x540 [ 945.765238] ? trace_hardirqs_on+0x10/0x10 [ 945.769634] ? trace_hardirqs_on+0x10/0x10 [ 945.773861] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 945.778866] ? bpf_prog_kallsyms_find+0xde/0x4c0 [ 945.783608] ? lock_acquire+0x1e4/0x540 [ 945.787568] ? is_bpf_text_address+0xae/0x170 [ 945.792049] ? lock_downgrade+0x8f0/0x8f0 [ 945.796183] ? lock_release+0xa30/0xa30 [ 945.800145] ? kasan_check_read+0x11/0x20 [ 945.804281] ? rcu_is_watching+0x8c/0x150 [ 945.808418] ? rcu_cleanup_dead_rnp+0x200/0x200 [ 945.813077] ? is_bpf_text_address+0xd7/0x170 [ 945.817560] ? kernel_text_address+0x79/0xf0 [ 945.821954] ? __kernel_text_address+0xd/0x40 [ 945.826434] ? unwind_get_return_address+0x61/0xa0 [ 945.831351] ? __save_stack_trace+0x8d/0xf0 [ 945.835666] ? save_stack+0xa9/0xd0 [ 945.839278] ? save_stack+0x43/0xd0 [ 945.842891] ? kasan_kmalloc+0xc4/0xe0 [ 945.846762] ? __kmalloc+0x14e/0x760 [ 945.850463] ? alloc_pipe_info+0x2a8/0x5a0 [ 945.854688] ? splice_direct_to_actor+0x6fc/0x8f0 [ 945.859517] ? do_splice_direct+0x2d4/0x420 [ 945.863823] ? do_sendfile+0x62a/0xe20 [ 945.867696] ? __x64_sys_sendfile64+0x15d/0x250 [ 945.872356] ? do_syscall_64+0x1b9/0x820 [ 945.876404] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 945.881755] ? lock_acquire+0x1e4/0x540 [ 945.885727] ? percpu_ref_put_many+0x119/0x240 [ 945.890297] ? lock_downgrade+0x8f0/0x8f0 [ 945.894434] ? lock_release+0xa30/0xa30 [ 945.898395] ? memcg_kmem_get_cache+0x3a9/0x9d0 [ 945.903050] ? mem_cgroup_handle_over_high+0x130/0x130 [ 945.908310] ? fs_reclaim_acquire+0x20/0x20 [ 945.912624] ? lock_downgrade+0x8f0/0x8f0 [ 945.916763] ? lock_downgrade+0x8f0/0x8f0 [ 945.920898] ? __lockdep_init_map+0x105/0x590 [ 945.925379] ? lockdep_init_map+0x9/0x10 [ 945.929428] ? debug_mutex_init+0x2d/0x60 [ 945.933566] ? __mutex_init+0x1f7/0x290 [ 945.937524] ? mem_cgroup_id_get_online+0x310/0x310 [ 945.942525] ? __ia32_sys_membarrier+0x150/0x150 [ 945.947268] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 945.952794] ? fsnotify+0xbac/0x14e0 [ 945.956519] ext4_file_read_iter+0x18b/0x3c0 [ 945.960919] generic_file_splice_read+0x5a5/0x9a0 [ 945.965748] ? alloc_pipe_info+0x2a8/0x5a0 [ 945.969972] ? add_to_pipe+0x360/0x360 [ 945.973865] ? rw_verify_area+0x118/0x360 [ 945.978003] ? add_to_pipe+0x360/0x360 [ 945.981884] do_splice_to+0x12e/0x190 [ 945.985675] splice_direct_to_actor+0x270/0x8f0 [ 945.990330] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 945.995857] ? pipe_to_sendpage+0x400/0x400 [ 946.000169] ? do_splice_to+0x190/0x190 [ 946.004132] ? security_file_permission+0x1c2/0x230 [ 946.009137] ? rw_verify_area+0x118/0x360 [ 946.013283] do_splice_direct+0x2d4/0x420 [ 946.017423] ? splice_direct_to_actor+0x8f0/0x8f0 [ 946.022265] ? rw_verify_area+0x118/0x360 [ 946.026398] do_sendfile+0x62a/0xe20 [ 946.030101] ? do_compat_pwritev64+0x1c0/0x1c0 [ 946.034674] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 946.040198] ? _copy_from_user+0xdf/0x150 [ 946.044334] __x64_sys_sendfile64+0x15d/0x250 [ 946.048818] ? __ia32_sys_sendfile+0x2a0/0x2a0 [ 946.053390] do_syscall_64+0x1b9/0x820 [ 946.057263] ? finish_task_switch+0x1d3/0x870 [ 946.061764] ? syscall_return_slowpath+0x5e0/0x5e0 [ 946.066684] ? syscall_return_slowpath+0x31d/0x5e0 [ 946.071599] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 946.076604] ? prepare_exit_to_usermode+0x291/0x3b0 [ 946.081607] ? perf_trace_sys_enter+0xb10/0xb10 [ 946.086262] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 946.091097] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 946.096274] RIP: 0033:0x455e29 [ 946.099446] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 08:56:03 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0xfffffffffffffff8) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) ioctl$PIO_SCRNMAP(r1, 0x4b41, &(0x7f0000000040)="e1aebd63f5463f08ff5731fe3bc7173d04cca829bfdbae4a689ead8c34d1a036953e174ffe629eb13417ee836ac126268eda9699d6412b43c65692bc832fa760adead77d0edc9a832a669f359f797c049feee3e52ad098d6f99d10b7d8118fa0aed4aba7ff21448c6c665728e1428d5e46e839f95390") tkill(r0, 0x15) ioctl$SCSI_IOCTL_DOORLOCK(r1, 0x5380) 08:56:04 executing program 0: r0 = socket$inet6(0xa, 0x11000000000002, 0x1080ac5b82f) ioctl(r0, 0x8912, &(0x7f0000000000)="025cc83d6d345f8f76207053bbbfa5c2d057f58b8b10e5ffe856f9e93171396d376404ee6da81fc9dbb03a045ececd71e6c8ab3ce3234587daa93bd5ddf861f631436024a5b4a8af032c925856cf03a1fc8e23a7f2a7ecd024cac9181c919fc748dabdbdc07cb3e2d16b58d3b68fc62acdb29e8760") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="09cbb19bc3f2e0a623016676d5ec3c9f8112e9594f3bf7d286a2aa7c923896ae70b234d353", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x8dc944fb889835a7, 0x0) recvfrom$inet(r2, &(0x7f0000000100)=""/38, 0x26, 0x40000040, &(0x7f0000000140)={0x2, 0x4e21, @broadcast=0xffffffff}, 0x10) [ 946.118644] RSP: 002b:00007f66589c6c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 946.126338] RAX: ffffffffffffffda RBX: 00007f66589c76d4 RCX: 0000000000455e29 [ 946.133592] RDX: 0000000020d83ff8 RSI: 0000000000000017 RDI: 0000000000000015 [ 946.140863] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 946.148117] R10: 00008000fffffffe R11: 0000000000000246 R12: 0000000000000018 [ 946.155736] R13: 00000000004c1113 R14: 00000000004d1540 R15: 0000000000000002 08:56:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xfe80}, 0x0) [ 946.204450] binder: 15176:15177 unknown command -1682846967 [ 946.211899] XFS (loop6): SB sanity check failed [ 946.216694] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 946.221018] binder: 15176:15177 ioctl c0306201 20000700 returned -22 [ 946.227856] XFS (loop6): Unmount and run xfs_repair [ 946.239433] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 946.246163] 00000000d5fb1e21: 58 46 53 42 00 00 10 00 00 00 00 00 03 fc 10 00 XFSB............ [ 946.254670] binder: 15176:15177 unknown command -1682846967 [ 946.255057] 00000000544c48af: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 946.269669] 00000000c330a2e4: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 946.278587] 00000000d043f704: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 946.279246] binder: 15176:15177 ioctl c0306201 20000700 returned -22 [ 946.287489] 000000001654ddb5: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x103}, 0x0) 08:56:04 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xf0], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:04 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) [ 946.287501] 000000001ae90032: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 946.287512] 00000000448be68d: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 946.287528] 000000005c713743: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 946.330336] XFS (loop6): SB validate failed with error -117. 08:56:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x200000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:04 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") write$binfmt_misc(r0, &(0x7f0000000000)={'syz1'}, 0x4) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="000000ebffffff00"], 0x0, 0x0, &(0x7f0000000680)}) 08:56:04 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000035a100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:04 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x3c00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x20480}, 0x0) [ 946.444305] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 946.458861] binder: 15208:15210 BC_FREE_BUFFER u0000000000000000 no match [ 946.472581] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 946.474061] binder: 15208:15210 transaction failed 29189/-22, size 0-0 line 2852 08:56:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x5000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x8004020000000000}, 0x0) 08:56:04 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x88caffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x80040200}, 0x0) [ 946.556262] binder: 15208:15226 BC_FREE_BUFFER u0000000000000000 no match [ 946.569120] XFS (loop6): SB sanity check failed [ 946.573973] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 946.582048] binder: 15208:15226 transaction failed 29189/-22, size 0-0 line 2852 [ 946.585112] XFS (loop6): Unmount and run xfs_repair [ 946.585129] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 946.603017] binder: undelivered TRANSACTION_ERROR: 29189 [ 946.604404] 000000002251e97a: 58 46 53 42 00 00 10 00 00 00 00 00 03 5a 10 00 XFSB.........Z.. [ 946.609862] binder: undelivered TRANSACTION_ERROR: 29189 [ 946.618771] 0000000002914e8b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 946.618785] 00000000ab4b050f: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 946.641950] 000000005c5acf7d: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 946.650816] 000000003caee4ea: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 946.659686] 00000000ff037c01: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 946.668557] 000000009424c40e: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 946.677430] 00000000c5bf9cd3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 946.686345] XFS (loop6): SB validate failed with error -117. [ 946.709607] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 946.736659] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:05 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r1, 0x50, &(0x7f0000000040)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000100)=r2, 0x4) tkill(r0, 0x15) 08:56:05 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0xf, 0x7d4) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:05 executing program 0: r0 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0xb1, 0x80001) vmsplice(r0, &(0x7f0000000480)=[{&(0x7f0000000180)="a70de84aad9102d0646d8ca89265898b9441599c9f54154f4f847fd0dbb6d074b663e77898ada19c37b44768fd0554425f0e974ef67fd0b474daa4cb08cb453384097fc332bd0e6353736e0d00f174b8d26a6586b2afceb506d32d58a70f536c28720d158065bf1157633a14904c8a7c511ceefd0ccf54a1cd1089eb39c2a66ee491b8d1310ba4b027b98fbd552adc54824fc49992089949a9fcf043c2e0633652771acfb85625242009d8f27363c6100b7e46109a0cdc8cf740613c242fbf2d42661f9bfe61", 0xc6}, {&(0x7f0000000280)="ec150ef0637fbef67097483fefe7fa489725ec4ab042828c77fc36b7cfceea8c870d77f0a1e1292bde693cfd7c5037613179ba9ac210bd7cad3028ed014e417ec5acb81d6e21d8a260ac93b535423751ad6fae57a4a2931bb229930db5f3e3534d80982c0eb8eda15adde7b3af5f0dfc27881e73a0ca6d2c685c504757c2106c7766ba4aee0931bc0871451f4541a768b38f6b4194a29bf14b0b0014f765e4a208c804b1d5df7577f103a8988309f1d668d53e492cfd992a9f6777aa50a2e7a831b1ebf54fef69f46ca7bd9fd14022f224822b457184c5ff850d88", 0xdb}, {&(0x7f0000000380)="07ae09e26774b4940f1841c2d72b5e6bff8835a375f462ab98c05773f8bd30665282f32cb108ea745baf4cf7a6ee0a76d3d802664b9d6b5bd239637e26060b515fe7bb63fdef6bb7b5519af9c92431f97a779540d4cc3207aec01619973445370cb8541b7af5fd89cb875a842c9deaa8956099cff69383fa93251617e90cb485b027beb696759b1d597717f2a56d8b881cea818fb30a7a7dcdaa82376341ced06a1733e0628d6e41f9e816794790b5ae0ffe17d10f7f3ce2b8cfd9caf0bbf2b047110bd53f38fda71e2e3033a4a8a0680cb433278898e067a5532cdad87b404525a5288aaf3d3b4f813ff93836b56e2921565c83d57cf4c19522eefd", 0xfc}, {&(0x7f0000000040)}], 0x4, 0x1) r1 = socket$inet6(0xa, 0xffffffffffff, 0x1000) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="076308308a38196374a57099be77c3408b84b3439b63ec3fe955b876179fbac88838377f8dca6488ebdad4767f8a5e875c6a6ebaa487b66fc3116fffc11a66ca7e6d050f176d5227fb41aba8aab34dbcbb170d0000000000000000000000", @ANYRES64=0x0, @ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000000000000eefff7ffffffffff000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) r4 = dup(r1) setsockopt$RDS_CONG_MONITOR(r4, 0x114, 0x6, &(0x7f0000000580), 0x4) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000004c0)=0x0) r6 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000600)='/dev/sequencer\x00', 0x40, 0x0) kcmp$KCMP_EPOLL_TFD(r3, r5, 0x7, r2, &(0x7f0000000540)={r6, r1, 0x100}) 08:56:05 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x800e000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:05 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x900}, 0x0) 08:56:05 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000003780000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 947.087487] binder: 15265:15268 unknown command 805856007 [ 947.093825] binder: 15265:15268 ioctl c0306201 20000700 returned -22 [ 947.127282] binder: 15265:15278 unknown command 805856007 [ 947.133316] binder: 15265:15278 ioctl c0306201 20000700 returned -22 [ 947.142234] XFS (loop6): SB sanity check failed [ 947.147063] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 947.158201] XFS (loop6): Unmount and run xfs_repair [ 947.163264] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 947.169980] 00000000b36b51f1: 58 46 53 42 00 00 10 00 00 00 03 78 00 00 10 00 XFSB.......x.... [ 947.178866] 00000000cb8277ec: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 947.187751] 00000000506e1f4b: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 947.196633] 000000003c1b7e13: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 947.205525] 00000000601dd401: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 947.214406] 00000000eb614186: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 947.223294] 000000006e710e18: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... 08:56:05 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0xf00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:05 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x500000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:05 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x6}, 0x0) 08:56:05 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x28082, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r4, 0x5) r5 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000580)='status\x00') r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000700)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(md5-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000040), 0x0) setgroups(0xf0, &(0x7f0000000200)) r9 = accept4(r8, 0x0, &(0x7f0000000040), 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r9, 0x84, 0x4, &(0x7f0000000200), &(0x7f0000000240)=0x4) sendfile(r5, r7, &(0x7f0000000280), 0x1) ftruncate(r6, 0x2007fff) sendto$inet6(r5, &(0x7f00000002c0)="72706aa4733d50e3070d4622cf7ec0ff20c4f19fa675d4a34ad09aecab731f36c34eef90b7f5504113acab823fc7c05c250631c676dcdd560bc04941cd95dfde84f4d0e2add63b2a46e7990362f0908d109e964106bee0b83540509080d3568322f1b1ccdf0f124c3d887cfa979bf87bc7f39ee28c2799f4b1531c442fbd3f662a7dd82a68389badd7893cfdfa436b118b947c9c45a53404e33e264828c97a7364c83d4745a161c92460599c30d181fd8dcbfdece905bf3ffc81538879587fee87af53f61382daf131ad2dd810627bbddca3d95d92eeb4b82f3bc343cd88f5f30f1d5e5b9ee08d232771a3f406010a1926aa6146caf4341db96cd0b68816ca8c7088f73d01e54ffc6bdd3c43ed57175e987fc59216ceed4441e449a5c6e52da193aeebfcd5b440d3895953a63defe9cb49b251227fd3df9ac07c656f034beb77e9fa0f1c98eb007f7a6b81c8be55558ef23070e1a1e4332d0be2328cc0186155bb8291e6f8af31e1c0e960168331c8a1571a815f176b825b2d04b6187da3ee9c9c8933c7f44b6fbac25ec81c5209ac5b6b92c4e52e636ed57433583c842f1f4bad183e807e367f709715f7d58f5444ce82b4a5e183bd722f7765d397453222cb2ffd2521ba898e3040386f1259345af741bc94cd4e4a270e5b8b4ff2ae6e7e4a3bffd107998d1839d27a6e59d736f5f15d2155f1b1af2a511487b1a42adad3f75275174ba19aad75aa347115ddbe2661ec800d099eb3cf19811a124ba96ec4e8accf32be22ac19fc6d7f0a739dcf5f3922065cc56cdd66f4d40db6125d7cedeffb5d2dab935db9a46da185314d3d9dc884df603ffc6927653efa6c7ddca515c8ff5dd4e41ff1c83b3b5205010a81188119ad22385ccc537bb25bd50c89a3678cf047aa395567ad9508d887f6df3eff14a3ce50a9a3d2a27a7a0b9f95b231e7314f3b7472bb6a8eb5bc0e37bb2c15bd2fe94359443f5fefb5b1e7a578a8e6d767c0338085f1950aafb8f45f6a323eade9bfcedfb249537e40835d7d9ed0989b847519e7fc06e9f7ff9797884935197f09deb89c17acce92fb77f8c3962252a959ba9b689b9213784fb26d23e276abd760c35062015161d9aaf6febceb6d5dacad103f77218b79a500c6aef223ad252ba18c862cc4acd764483731c3d7fc92c26f578061fba6f9018e657801bc146795139a5da4f8a0c77b73103e580e4818c90e507b1d62254c6593427b3d5ad5f404ad47c5efebb20c350a1f84f7cbe73822ab2f05a9f8ed9da0dcd5060113fb726eb03e41692a0c34026e126e488a42cbb5e90fb2eae995a4511ce6fcd45eeb07c0da61bf1d1557ee979998ee9bf7d48d6a79b27b2a51f47041af9e12fd28a971872f81419398f073f138b46f0cdd0d21da4a73f296d4fdb90d409f4c7acfa77df4061639ff156075bf6c33f0d30c7955652d211c381b4d2b3e29106fcd52ea67202b0d5f7dec590542f0b4850468149877075de8721c8bdf911ae365111620c754ee6aa40dc56cb387008b16a1a1912c6f67a05e8dc552c41036c3a58a9a0df1842090ac7213aad04b1515171c2c97e75fe889b2a845924e3d26a7825335cd6e79b68e5e85bc16f465e6ad54c7e7c899ddb07c7a831297cb08a28a29f8949a477245b28ccb15d6549274ea8b195e8fe9626a0e6cedfd87c6d96f0f98a095c8df9339c970f2e752bc099017537ab00301d0bf3736a43c071f2ad3ec9df0a578ec0f8426d5b3871e47ecf30a741e87cb10fd78762c7be8009d09fa113b65ec1b0d367e18c49c39a6a034884c3ee12c008fae43428babba7fee2a7b7a6aacff2136844f707b61787a3ce1f011b5e77639c2cee05f8ee46e8163b5fbe414ef37a7c28236d63d9abb700a2014776004e2aebc4bca0851a113af63b21f971360d7bb11364e1f3d753993e5c0872f863cadecb64a3ebbf94704262320fd8338f993d76e482239ecb3f9a76cf83324646ec092791c8af505801135bbf42c95a078750cf43b6a37a93f30e9fc1440d34d01f4275db6c9c61487710fd7e2f7ecec482dc624fdfcc7b2648ec4033aeaae67a6e8ae91ede4b5e6d21733b8504b0c55ae4fa507ae1784272156493c2a4957e468d7de9b983e89d0cda124be24c2fa0c871af93ac13bb9e056881d020b1b6859c6a7b8d1f6453103ad31ddf8bd1b84209ccd34c169100360a102a91788c36a1561808d8caf37ca9acc56e8bbec7f020fde90e7c1f15022f226d5e1739b696bf1f1fd58820cf6296c1298747e4bbf60f130ac60a3c36204076602886ed0e50f6b20d92c203e586b5858c265d20fd0f6fdd927140de2589e38e5a10a6913d48387a10e2c4f76a60bab093fd93886db99367a8f88e768862f03cbedc4bdbc8043374109a17c5bdcc8c46f91f5f932d8e65ee80fe6ac7d4775382732415bedf70f0918df14250d86ae6ff8f7dc0129e26d019d745728487c433ba3e90b999efda0d33c76e983b82b910839b92251dfb4735079021e50e04acb54e6a4f5b6330e4e136a16045ca4d0a7a7ddde4ff6721bb308ef8e874b0bbfb523eb00eee689d46efed1a0ce0480a146a79ca822d3ea74605abbda6d9d10d60d7e22eb9ed5aef6f42196aaa1e439687c9edb2673ea6daca5d0dd0d0a8f0025bbc5a5b938a80697fe421e313b0ee606eeafc2e6f0b3e94a50bb6a4210b170aed3cdd0d2ff46c22086dd7313e9e2ee41e682a76704bf65f8e972bf48d0af854ce3a6667949f94dfe3c9d18294bd4b270d7d0167a5177dc5393a30efc1ad8cb7b193efe0277b581615f220bd5c530ea3941bd3d4d566158712f099df04e5d48467361689f63d5354e46dbc230ed74b33d82c44cd8a500c6349d1849496a24edefd4d03822b53792b3027445a160d519a75e53c6f67cd7ae20fa9640313b01586b830c35a1e189e020835af19d207430c0a6883a1fb83e3295291d4e76a77d1c05c867fee5e54d1c4259c932997505dc99a7da1f46aac297a9027b3b90e46320f348d326f8297f05d5056c7895df00d4312869f683b2f5c38bb79a1052f2a51fea668fb26bfd79765460b13cf8cec0e93a49a023b98debc6c42f656e5bd4db3310330d5888da9f28d0e9db7018cadca6aeb9f53edbf894b9aeef6d4a78cc0e37b6773ed39fe8215debbeb47c3b1d593036d4720164d58786785f39491fe2a7898871265f47b76936dbf9d117ca3fc40353f17ca041d8e9b1ce84c16a4a1756fae2404db111956180096bdf22ebc6c601b6b443622e1ce80f7811ea832b4ddd1c8fdf8586075169cfbd2a12765557488806da7c0411a30b6b4d2120ce48c668f174fc497145b8573bd269669337f960a9ae0d02212137c4019092d2cc50ea5650a7ee8d7f14fdddd1e5bc6d913fec8833c89a25b175ef9b9ab8def4faffe1eac089541369e4693bc9328a883bdf57734665920337d53fe7eed7ae1b8ba995de96f6b96b8bc18f3ce2bbe5c60f0f400d43b0af0e34cb73474ccea0c7e87aa7ca0161735faf7783ff2bb7f10e9e8587b31425663924c353d26bada729f68dec8d070303a54401ab97a70c55d24c3202d0e86f0b188e63061c621f4eb819e879c411e7f958f6ea3b25e7ee6c9deab61fc9c6d2b357c8028972b413ac7adc3dc391421af4b246dae49d496e9a1cc0495c37165d4d1dd3dc69aadbffc7c702c4b29f8ffb68431b67e7d859b229e451bbbc79a67338482216457f8bd9ebb3affe5ce7507e7f4625d658c9770404d7732c2504fdaefbb483fbecacfdcb7cfc9ecd4144f4b7d4cfc793ffcfbb1d13d0921b7412ab67128e3221229cd1f34fd8ffe35d73780ecd91e91d225c2a47a0e0b501af71783ed1d9b2368427e5e5362156f47260018b83d5075d4a791d513a195dc77b7bfc2aca6ae2616d478ae3520160912aa69e7ab418a5223dca26cc5fe322c44dd5c851a4275ed2ec715cd772c42e200d35e11c7d63a169032fec4bfabed0e4c52073cadd3833ee7ef5d4d75bb616b7c456803e1186f7b123e65d73c729b5f996f3c7168cf6171b616a15a9a7e43ba2f1e5c08884ac648b46a086d4d0df914289b6f381780985f35199a7de74942e6812b75be7c0ea59b878c588f7b80e9e76c55d9d04c2e27541be674288ef8802c0094294dd3481bcd565bb6a28def352f516c94bce33d8e16a9e6b1ddd3ee11958846586a7b183d4eb795e6f3b59e30ff84306218611eeb220e124ecbc196c31a057ff1966cb50eeb013550da252c861427da6289bb0354bf6f9e532fc4635183eb23c05503e344f4c9c377a146c8de1b804700b307eeceee5092ba1d5e8eb8db8a3e4cb81bd30e8ee0ece2c429d81d46e2e51e5912bb12f15b04ffe8d13e33978afc781e72a8cb0b7edaaacc5e6fa3c9d6ad97be677354a4a838f94059dbeb6a2869ef7cbbbd1f7c2b309776b7bf4173d73da54cba112106ba7a8bfd48ce9c70b079a9dedd96ef3c1193987147b5e4a4e32d88a0e3e89ede22a2cd93571944c6107077792b708bc59de08d6dda5afd15ff8209fe1fa085d267f40ba31efe1b70595a5c5b4124f40c943f81e47c18f9dd5d12ad8bfefd49a1a6a04375bee08e26cdf9384a0cd36c40aea5928f1948c9857a455ae141b4f4bda5d1120899ff195a287715efd6b77c84bc6b50345ccd8508d515da317df715671e86e2ac9ed6b703e2b7d7fd9c267091041347242b69ded3c291b229c5b70666d15f4b46364f47646cf2fdc6867320f798ecea138a670abb5f4abf14c520ced1dfe788effc7478b6744095430fe1d588715aa5bf4e8bf8204774fef9cf21aa3e43410e0e92faa15247355f6d12f437b139b93f4ba935dce8c2b7a657a250c5d72b6ed11e2cb91160ea4b2169b95353a11c988a0a15f268ee355cf1d0488ce241dc3f4b17ec1e152c244b8a8248e5f93a4c605148a10812341bb88263dbd97429262ead692dbf0f8af8d2d1299aa498d12e0f3fbf0698d7fa7c97d984783427783722de21879974da2993832e396d724b095c739ff7cf1e6ab6cd34091d64de267b6e4924226e531d5f2d704559bb45ccfcf57a983adfd64b4444d0491c77488ea352ef08caee73e443c4382eeed49207ac22296062cc536f3edf8cb8d9db228085fc0cae86ebfaf5df1f9fc3081a1588a54798dfa8da8ff8fd8503ad21ced0261b3b68043e0767725e843d1acccdb08b2b361527e6b0318437658e621835e582c639921079ecdd67d54ad628f06d6c44a1d63b2f8dc082f81e820998ed1df80bea05e8d3e5f16c915814c9ad9d58090d8273a602d72d81fc59d99834a369fcb3b4c86d9a174d88c2adb5875ffabb1585ccce9ff51f1253e2b87183c5022972cb83fba296d85b6ee86af410f504f3f9c568b480a87c74af645c2391a2decf4fda3f150f929e034f67b51318752e01716255fd52b54d1c3bb0300cb97f42936cec7d307b2988c8f694448c9eed1c78c7e72445e1f8519473fe29aeb589d3d38237d8ce3ac35f8c168be654bf5360566feefbd620697c1bf4c00ba9511dba1d71240f87e427a65fde62a0c5829fc3925fd439626f937e1cdb3a1400be02c1d33481da767c4b672e14ae87352c14d5392d8e7fb05d2c7774982ca2846fab49bf4f3c3c3ab62793f686f738a3c5097ab29669569fc5276fee21a406471e98df37964c5e8082490d787fd921b936bb28db2b267ce40416dff4265b7a541d39b0c09240e49decccae30734e3de9eb3d1865ca8f640e05c889413994356cd45981f745d5f4b3cc6cb68190d3bfd6b5da98c7f98c4a805db09aa0375b204776e45", 0x1000, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x5, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x1f}}}, 0x1c) ioctl$ASHMEM_SET_SIZE(r4, 0x40087703, 0x62de8547) setsockopt$netlink_NETLINK_NO_ENOBUFS(r6, 0x10e, 0x5, &(0x7f00000000c0)=0xa136, 0x4) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000001380)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}) 08:56:05 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x2400, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x20, &(0x7f0000000040)={@remote={0xac, 0x14, 0x14, 0xbb}, @broadcast=0xffffffff}, 0x8) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f00000000c0)={0x0, 0x80}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={r2, @in6={{0xa, 0x4e20, 0x2, @mcast2={0xff, 0x2, [], 0x1}, 0x5}}, 0xb0, 0x106, 0x200, 0xfffffffffffffff7}, 0x98) r3 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket(0x5, 0x4, 0x83) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:05 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xd00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:05 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x80fe}, 0x0) [ 947.232173] 00000000712356a1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 947.241496] XFS (loop6): SB validate failed with error -117. [ 947.248608] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 947.278128] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:05 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f00000000c0)={0x0, 0x17, "263b869093efcb73eb01b5ee10e5df1500f048df3bd5bf"}, &(0x7f0000000100)=0x1f) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000140)={r6, 0x8}, 0x8) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:05 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000007a0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 947.378983] binder: 15301:15306 BC_FREE_BUFFER u0000000000000000 no match [ 947.390792] binder: 15301:15306 transaction failed 29189/-22, size 0-0 line 2852 [ 947.421427] binder: 15301:15323 BC_FREE_BUFFER u0000000000000000 no match [ 947.431664] binder: 15301:15323 transaction failed 29189/-22, size 0-0 line 2852 [ 947.457521] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.463667] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.480779] XFS (loop6): SB sanity check failed [ 947.485624] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 947.496767] XFS (loop6): Unmount and run xfs_repair [ 947.502570] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 947.509293] 00000000febb24cc: 58 46 53 42 00 00 10 00 00 00 00 7a 00 00 10 00 XFSB.......z.... [ 947.518158] 00000000d0189df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 947.527032] 000000001dded9a7: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 947.535898] 000000003624d5e5: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 947.544753] 000000006739d2f2: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 947.553608] 0000000008d412ff: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 947.562487] 00000000efa3ebe4: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 947.571365] 000000006c15e6cc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 947.580261] XFS (loop6): SB validate failed with error -117. 08:56:06 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x240) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) sendto(r1, &(0x7f0000000040)="8f9be0d8df6f0452a20602c07fddce8ce8054f03c4ed07ec4647a08536c2f4f5ba0201acd067365c8a006356c8bd984078aa7dcbb865618552a0186d8aafce2b12923079f12a7bfc6d9f5c2dca786626c881bb809a09d634318ce8c8e890b2c4696e5518bbcfa6f6fa16963f1dfb93a4375b8eb8e245b3467ceb8731e0c4db7e83b9d8c2e2d3e78523fbffe86c7fa5b321834ea32c4e3c01af0b34877a2c611fe9dbac7612114b2d6da05fcb06a1815bd38e03a9443ccc1195a15363c566b8eca3bbd095f555cd50711a4f0c61b9def480fc", 0xd2, 0x40041, 0x0, 0x0) 08:56:06 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8100], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x4000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:06 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3e8}, 0x0) 08:56:06 executing program 3: r0 = socket$inet6(0xa, 0x7, 0x2001) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) getsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f00000000c0), &(0x7f0000000100)=0x10) r3 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x400, 0x20000) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, &(0x7f00000001c0)={{0x8, 0xfffffffffffffe00}, 'port0\x00', 0x80, 0x0, 0x6, 0x6d27, 0x81, 0x2, 0x6, 0x0, 0x4, 0x9}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4, 0x12, r0, 0x0) r5 = dup(r4) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r2, 0x40505331, &(0x7f00000002c0)={{0x5, 0xfffffffffffff001}, {0x9, 0x20c0fb47}, 0x1484, 0x1, 0xd3}) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x58, &(0x7f0000000340)=[@in6={0xa, 0x4e21, 0x2, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0x6c31}, @in={0x2, 0x4e22, @multicast1=0xe0000001}, @in6={0xa, 0x4e23, 0x5, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, @in={0x2, 0x4e22, @multicast2=0xe0000002}]}, &(0x7f0000000400)=0x10) ioctl$ASHMEM_SET_NAME(r3, 0x41007701, &(0x7f0000000500)='vboxnet0\x00') setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x6, &(0x7f0000000440)={r6, @in6={{0xa, 0x4e21, 0x6fb, @ipv4={[], [0xff, 0xff], @multicast2=0xe0000002}, 0x484ca4a1}}}, 0x84) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ftruncate(r2, 0xbde8) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000000580)='./bus\x00', 0x400003, 0xffffffffffffffff) r8 = add_key(&(0x7f0000000540)='id_resolver\x00', &(0x7f00000005c0)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000600)="d9361d79a92bd698f05201ffd1159b451fb9fae062a3facd93b33fa73edbd9a19412ff21f4839015fa4bcd19c76f42d59f34e1", 0x33, 0xfffffffffffffff8) keyctl$setperm(0x5, r8, 0x2) ftruncate(r7, 0x2007fff) sendfile(r4, r7, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:06 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000002c0)={{{@in=@broadcast, @in=@remote}}, {{@in6=@local}, 0x0, @in=@broadcast}}, &(0x7f0000000000)=0xe8) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x10001, 0x0, 0xa65a, 0xe0000000000000}, 0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYRESOCT=r0, @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0xf8012e6969216a77, 0x0, &(0x7f0000000680)}) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000200)={{0xa, 0x4e24, 0xffffffff, @local={0xfe, 0x80, [], 0xaa}, 0x80000000}, {0xa, 0x4e23, 0x6, @loopback={0x0, 0x1}, 0x2}, 0x5, [0xfffffffffa4d30f9, 0x6, 0x7, 0x0, 0x10db3592, 0x101, 0x6, 0x6]}, 0x5c) [ 947.967991] binder: 15350:15351 BC_FREE_BUFFER u0000000000000000 no match [ 947.975089] binder: 15350:15351 unknown command 808464432 [ 947.981419] binder: 15350:15351 ioctl c0306201 20000700 returned -22 [ 947.991975] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 948.004690] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 948.012537] binder: 15350:15351 BC_FREE_BUFFER u0000000000000000 no match [ 948.019561] binder: 15350:15351 unknown command 808464432 [ 948.028353] binder: 15350:15351 ioctl c0306201 20000700 returned -22 08:56:06 executing program 4: sendto$inet(0xffffffffffffffff, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r0 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:06 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000d4030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:06 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x11], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:06 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x11000000}, 0x0) 08:56:06 executing program 3: r0 = socket$inet6(0xa, 0x1000000010002, 0x0) ioctl(r0, 0x800008912, &(0x7f0000000240)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={r0, 0x50, &(0x7f00000000c0)}, 0x10) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x400300}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:06 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000000)=0x7fff, 0x510d27ea3e071fca) 08:56:06 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xfeffffff}, 0x0) [ 948.116954] binder: 15369:15371 BC_FREE_BUFFER u0000000000000000 no match [ 948.140415] binder: 15369:15371 transaction failed 29189/-22, size 0-0 line 2852 08:56:06 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x88a8ffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x4000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 948.168450] binder: 15369:15371 BC_FREE_BUFFER u0000000000000000 no match [ 948.193259] binder: 15369:15371 transaction failed 29189/-22, size 0-0 line 2852 [ 948.209273] XFS (loop6): SB sanity check failed [ 948.214092] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 948.225225] XFS (loop6): Unmount and run xfs_repair [ 948.230141] binder: undelivered TRANSACTION_ERROR: 29189 [ 948.230266] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 948.242400] 00000000d824da4c: 58 46 53 42 00 00 10 00 00 00 d4 03 00 00 10 00 XFSB............ [ 948.251365] 00000000c260a1ef: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 948.260232] 0000000082e48558: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 948.267450] binder: undelivered TRANSACTION_ERROR: 29189 [ 948.269095] 0000000022bf8383: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 948.269106] 0000000052e202c8: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 948.269115] 0000000074214e9d: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 948.269130] 00000000093dfbca: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 948.310000] 00000000af0479b8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 948.319198] XFS (loop6): SB validate failed with error -117. 08:56:07 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0xfffffffffffffffe) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000000c0)={0xffffffffffffffff}, 0x13f, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @in={0x2, 0x4e22, @loopback=0x7f000001}}}, 0x90) r2 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:07 executing program 4: sendto$inet(0xffffffffffffffff, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r0 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:07 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3000000}, 0x0) 08:56:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:07 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000000)={0x5, 0x3, 0x457b, 0x9}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0800d550", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ce4a7d4e81630414f4affd8659b3c7d44df45216e276556aa8020d9bd07a19e85172c8ef0aab6387f2647abcc5ce14d01a9e8980d90998b1393ba14f10e00a197fd2428fadab991b8af13515fd551b056654e202acad23f15df65b6b96d96ecbc5f27109af6462ff319d2b8f94634e841bc92577421daaf314e80a30d8bd7dfd5279c20d69a4900189a12c196db67cdd5ad0e0a89fb4f7575a5501bd5a7e83fd6ffcd1ea3c00b7278f334cd21734e56a9622693b8b6ef5", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0xf0ffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:07 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000f000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:07 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000340)={{{@in6=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}}}, &(0x7f0000001480)=0xe8) getgroups(0x1, &(0x7f00000014c0)=[0x0]) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001500)={0x0, 0x0}, &(0x7f0000001540)=0xc) lstat(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000001640)={{{@in6, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000001740)=0xe8) lstat(&(0x7f0000001780)='./file0\x00', &(0x7f00000017c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = getuid() fstat(r1, &(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000002cc0)='./file0\x00', &(0x7f0000002d00)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002d80)={0x0, 0x0, 0x0}, &(0x7f0000002dc0)=0xc) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000002e00)={{{@in=@rand_addr, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast1}}, &(0x7f0000002f00)=0xe8) r13 = getgid() getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000002f40)={{{@in=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000003040)=0xe8) getresgid(&(0x7f0000003080), &(0x7f00000030c0), &(0x7f0000003100)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000004300)={0x0, 0x0}, &(0x7f0000004340)=0xc) getgroups(0x5, &(0x7f0000004380)=[0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xee01]) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000004700)={{{@in6, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000004800)=0xe8) r19 = getegid() lstat(&(0x7f0000004840)='./file0\x00', &(0x7f0000004880)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000004900)={0x0, 0x0, 0x0}, &(0x7f0000004940)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000004980)={{{@in=@rand_addr, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4}}, &(0x7f0000004a80)=0xe8) r23 = getegid() getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000004f00)={{{@in6, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast2}}, &(0x7f0000005000)=0xe8) getresgid(&(0x7f0000005040), &(0x7f0000005080), &(0x7f00000050c0)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000052c0)={0x0, 0x0}, &(0x7f0000005300)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000005340)={0x0, 0x0, 0x0}, &(0x7f0000005380)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000053c0)={{{@in=@dev, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f00000054c0)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000005500)={0x0, 0x0, 0x0}, &(0x7f0000005540)=0xc) stat(&(0x7f0000005580)='./file0\x00', &(0x7f00000055c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r31 = getegid() r32 = getuid() r33 = getegid() stat(&(0x7f0000005640)='./file0\x00', &(0x7f0000005680)={0x0, 0x0, 0x0, 0x0, 0x0}) r35 = getgid() stat(&(0x7f0000005700)='./file0\x00', &(0x7f0000005740)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f00000057c0)='./file0\x00', &(0x7f0000005800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r1, &(0x7f0000005980)=[{&(0x7f0000000040)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000000180)=[{&(0x7f00000000c0)="5e6f8ccd9b3aa7d364e8ef657ad38fa65ac611f204316ba5417337f659bbf9bbef691a7209286e7f5a4b56364a681c3a29c030bf6aa0e8be0db8cec49bf7e69ab9db8d54a271fb73e72076860824e18ab56f391f3da3393e503a5392ce6dbb3d447a7ebbff6a9a8b373b752c92d65787b70082da25", 0x75}, {&(0x7f0000000240)="7ba48bcdd49d86f321960a10afb938c381a4e818413ef16cd6d7b15d4b66e1301be42b6ee6e2d2e2cb0fab1dac4caca74f637c6c03fd7d3ab970df3e502acfd21762aa6ce27ea68cbd4ba827eb77f6a240a5cd80f6e9908c1f7e2a1f75b2b00f932e651e25222d31894b03e3f7b11c38666d9d6c9041d6fe2c3cd7f2a334ad043f85f854544af097097be6222f8050fc7f407fb7d9173fa21f246bbf74ac61a967781365095b7172fc8fb770fa607b7dd98c706df1acae9ad947632c3f291d488efc5327de56ccd87be317c5df46a263100fbffdd0b123acb92955bc663412764d16ed", 0xe3}, {&(0x7f0000000140)}, {&(0x7f0000000480)="f26d73babe3de42aaa258598dad8c89061b0f8477b2b8b66a0f715379eccf54f6e98ff627d4e928bdd68cd44a33a5f4d551f34283a89a1e3b3c0ef4445460bb758929e596ddde66fb8654d701437cf7384a6347d0136671c529e4a7912ab20f910dff0cc6ef7326f8318944e329dc343820a410481e9cd4ade2763a1cd6963683540410178c3a201ec11423999a59f4f8e507226af5a09c26865d30dfd3797e25859ffcadb9ce7707916d4264cb81ab1a884ad37b6b824d61e4cf15acfc43bd11e969f20a26ae350ac285bcd9dbc4147acbe0874d9ec84f13d7345fb6cb883729349eaa80a7afc7f68478fc0095795928f867a8a1ce38fe2e91dc7cad4a4389f990a29b62257a1dbe5da3605539d0a958c4c3384adc36f4fd0ec99bd8f3493c24c511913ba8554f9e5fb426c6ee934118998593022e7ef7b4aeb219b083f3246e70efac17dddfb9c579ae066ca4e6aed420d01d878aa811fae089fa003e2a58ab1c920b23900a102a78ad9bfa6a4827881c8df73a6947316eb27a46122cf24b764181551b43a2191cc82107ce20b5ad03f0df29e4ddea5d31cd03db11f7c77821a9efc90d3fc07b112cce23f10fbb4d29bc9393e1a056cba88dcc14009ca5ea76ff42dd4222eafc616c41a7151b854c7f19cc0bf96541af3e3db8e79f3bfe973d0f8c1ec6c8a09bc58aa11b18cad8e819fcf21dd4b3e2701beed40e41554472d9c0b6d9cb99d338c62299d7fa4ece4dabfbe76e82acfb94a435eed9c0fae0e7d921b04a47f0d3eed285c5d06ae3be22e9c94b44552e3a29c88e24f694bc5b60c8c6cb01e10688a528b5aab1e6bb963dfff1164b628b1ef71ea6d88039dd1345d5ab5c7c0165dd52c4433a17a78cc72063aa9119cddc46742fabdc2788b9bf3f110802a5cc23920517eb96c489c821c79d6984150db551ed551bcc655c2eec2b363de665f7b334e5d39694151e9eff0fc284e1bfdc73b185a4f5c45f4eb30f4c5b18c95a7354d75efd31c2af3decc0ee1b2b0f8afbef0788dee7a65e7dab5218a07329d3983395506052614271f930e77c4431e7147754c72222bb70ee92490e7db9f99fc7933afa11793148c9c3005f0b249422354de7352d953836c43dfbd02705ede18520e2065739e2c8a5850f6bb3b9b90dd9103ff7c606e57c9bf31ae7577863cbfc04f620be417a258c1e057459307f7cd02a04b737053247fc3a459fce929c7870ec98dd54b2173dba1a867c0aa8e39758486aca519ddf030ae0c8ebf5854bccb2131be4d3e3c2a3062c0ad7d8a69b14d44b1b46a3c9f557487cfc80488d15abe2dd6f27570322291a42ddb04c064b7df09fc52fc66d80944338e79a1c6480155fe683ec0e4291beb996ea9758e91003b3ca9636017787e4dc3038373fac702adeae0814510fff647f335856197f9d0eb18280c72d742d834a497152915c0d3f26d4e265e3e046bc70a9ef72cb014ddb401e6ee377dd8d41d57fbd775e4e01e655104a58a16f3c5d52597a6ae9e311e756c6d02044102171f4a41c4c7b4fd88fc679abf57267120e4774db34d44996487fde85021f825fbb8ac090ef35000a3b16a362cae9c0dd3c86ca77e18ba5f11f256c714d03338be8289b025f9dcae32b982c373d50176e49f6b913b2a530c990eaec4ce472f8da675f518cd3aea3a88c1b6ce0340c5e8bec12eeaaec815ec8882701d47dde3f836c063d88a36b98825cd3ddf28973007528210a695b44ad7e5df1a65aa387da6a1a7878d5fb9f6b8eec2755cfae11a83c01acfdf7d5a0b3b17dd0208b5d302d655b936b5e9e83ffe594c1f668645db1893c22394943d7831be9a2d85a876bb84f857f8ff64a8b846bc120176d5c153a7cbb3ea65dc8926dd8fdc55ca9194047bdba08a4621aee13c6aa1aec273072b552937b358b9880ad26ecf72b40de182de80090907358eecde95ddbbac8968b40cb198e8b2fac03d9324f88fde880501207916a829a9ee7799786400762d886e5fc216d2806b60956c8cc3bc813fd4445940a3d11906b3b18fcb595e10cfb35ed1e668564d5e6041e1078a6101427393e968816587e798f1dd73964bfdf292fe56d3d768ca9834c5f3fda954ea8441742137018f9f66ed0806a20611d9b2e875a8d70368340ae923a806337329c737816ff847e997e4062b66fa45b4f57e25062468f9e612baa94df6de63497163ec1ee55dc7509c355a867987bc026b458c9fd76f92c5a174f23ab982f8bb65d7ed39d1f58eb66dd8d651288a79bcd710a193fbc3cfd60fa7b9a8b22783cabb354b490389cecec882cf49ddc5db1d98134ce6eea58aa70034e6a3c99397c3a9e30640892a0893bf28dfa05bf876fc34689ff9c7f59eae4fd84720950ee4d1027a6e8a867f0c5897471f5e1d69f45e7bd86545643eb7f184674b4c1517c941ae32c7d85a8993726440af61e59271c08eafdf8166b2d429e39fa2f802d0ca5e60cd26cbbcd85d878dc375e3f8ac806dc8c086b859c1a392cacab9f9a11551cae020e1761b1dcc1c356ff523ac69bc0277698c1f403126329760faf2b3e86a62fbd2611d3ce5cbd27148743173c41b42720994f471686d6ee5507f326b58a121ada3c333417ff71f245b6bab287bf754b647f171f9ecc46e34c7e41268068d8271ab1278e9b4f985bff8e7b801fe46e951001163ddc5ac626206fa010778f260c60eced0df459e890ba9ed2c5fdc940d996b37ae0c3c146e70494ebc30374e418ec86c1ad56780e5d0fdba838b37bca7450aa5c3b4bd3265111f51f2ccecdca96c5d5b43c66d47bf2612532ae1f3d375cb16e6d48af271456c257e4285de224f4993b1fffa7d5afed2d2173b7067d1408be83c858dd3abddf3ee59e270bc6901ac9c04dff8fc92bd997d7b49c5fb736299937fb35c84741a7a95b1d62b36cbbd44ebfd7688c296ad1a2f51d8664a3467558ed1b8f1144e956ba50e682f1d1905c6b47db62c72f70dd4d25986d572697ad396186b0a44e72c290e7f13b15bef201ceec9616941d55c533af34a0cadba820097b137e1e29b0b3f6845de966448b84d3e1ff6c0a4164997bd8d7388c37b5da653aea540710b40fefee3a6ae5898fae487a408a39bf38246469a7647aaf426512f5c67dea43d8f8d89a66cab0e0278dc9053a94d828cfbe7e1682fb7a70a74bcb9444ae9501547f30cb61dbd78b77c58d1576fff9286316e4cc6d93bfbdb57b8e88d79f5992ca9d619f3ad4a5538d3bbfa73c2059a2b4224134c764b641be5da12e1681eb0ee1624e5c991608e3d2294616cda3ceff6d95b29f796699cf7596d236c64285ceb7a4dbc2754a830a894357c598d904e9cdb59e0890614af8ae1c54d6cd677d005c2d78dccfb9c263d4a9ab50c3489d7611c9b1f312b7d6d5d668aa80d099290746dbc4d2da7337710b65562b5ee1dacb40c54b49ab8a3b2a7bbc1e232905f2e12fc9a17f0f9cc29e528016986ef243790309c69a90b22a5ad4e41d6f99ef4680a274a2b59027dd42c66d264a7451cd729fd887441a86bf1f85378edf3316ffae4ef01e2e26fa7aa08d1838a89238f88d921f0e03915f9528651e78f8063ac1300f67abc09f710893c6920240362e0757ffca7909d7ee407fc7edd61be278037003d6275061963280e87423656a8d665701429770fab85330408397b36f7ccae3563fed96c7c758bec41ed1f2367e2825abd4c64f897bb7971347d7102e7613c2c8fcab3c2f9c27eb1367dca2c65d3098d9e4053d792f71088d6dd1a6869b9fdf1dcb24cf55d62482ba252881e95cb293d8e9d0e2694f167df6644261ba7026b421fb2621ccad6bcb86e6f3f985f03573be7cff39ec56c36a4b9bf1ad591340b63ba3e1b7d5a6711c6c93c0b3762e0cac55d623d7566b037572dfd839c8828b7e36965cd53d80cb3aa469198e4b4d585447cad8f566a332208ae243230ca949bc8d81fd487e76d914c6bd88c9824ff9f95473d153350a104b08e987c8be1071e050c864dfd488de77fd90e310a0ba90d32e81fcaa5bdc16e9cca4086803ff8ebad6421df95cd243cb05cda91eb358953e0a3afc5b2a77850e3a4297a9818000e2c31d73f1242edf44d2d2ef03407818d7f50a3172a0e5edd638c495f324a15c120b1840ae5382134331d384af4a559afd64c05a9e35ff95aa198c5beed47f2b7a38b4bc462cec499fc14e29eb4acf69e479c003b69317a609d7dbbdc160f2f081913759bee3beca9803f6ecc4e5e689528ffd97046fac8c47851724a14caf2553881ab8fe4a8ddc1eead90b372b935ddc4371d0086f68ab46e6c28c42844e2e882de949d882294194b0918ab21540224cb6442c9dfa98d1ae08e42d12a8d8c09c7e0729618b025ce6a82f340c2a8b9301b8d81c8f5683a853af8c702627a068efc34ca013a4c68c93f2055caaa10c8d20d9d445bf58e1fab8d98ec5af497498a495b5fb8bcc231b5ba03c92ddd798e7f0bd3c274bef649e9722b8eec17b53e82cbe1c6a9318d366c65a5c29f0708b085d6492993b56a6b253d6c986e41c1548e13d425722659eae69b8eb8e825d0c94c75f0f0435c1d4836cd7a86e48516e8222e1250c2342baf2b971b48e841e918bca759674c2ee54b75805e59d735075b5971da4ccfcda843f367cada91e0e0f330e3d590d123d510bc2833d4ab5a752478fc769a39ca5cb34222deacc0232b9b1ed051d23263f45938d20a23ed3c556066df0980bf2346ba53e41d9979340b585167291de8fdc9e87dfb68068fc9ea5f9c99815bd4a0021ce4cbcc90acb738004a0aa9c3206c6e6f7078645285953eab90aa2c71cc4263206c166624857ff436dfd2877093095ec7e144527f550ee497948c9121bfbc4bdec9c3805d99f8c1c2716aeaac6c67f2fcd337a62c42defff45de9f829bf60daa61c8218fe83a3cb143532c29ad7199ea9cd8bc509500126def67e4c30028549129663fc6bbaec07a36773d1297ad1930912b7e07a7a3257ab396e2b644c844f1a7e92b8a94d7d8eb731a67784302ec702e48c2c88c7d8d29796bb2e9af2a0e86f0cd10ad1895750146b15fdb1036a44bd51c0ddbbc2cf5234b53245edc16d4f9ed97741d6724ba4eb8865b879c6baec0b33a55668ae44276090d312b80290da8ad62b8b1b7848ffc723d4b782e1ca2bb68b51f391b9f0992182299e474c430087ba7a910f74da976376f5ecf65175d07d00fb58384f120bfdfdbf451d89432e2c3264379341fdc815b3210d591628f6d119c18b83bf13fe4fbfa535ece7b8cfbc3cf48c70d752a6d202fb2e531e4d808534b46f73f21aed565e90927b579a4b5464d154f2e6c990a6e9c940c1eef9cf3384c1f1e883702a896e493a7b5b0808ff6fb8797f8283e3dd828298be1ab6f07458eb2a27ea0fd11dcb06cbeaaa8919ad9e734415ae97a21f0d86ab72f710e91e3d8757ef579f4072427d65c0e62e1970546c08c5fcace80fdb0f99911ba7b9c41e37d0180c7aa7fe5c63b287476ffddf72fd7fe7488f3758446563e4dcd8a197b209ff3776ee6d77c4996ef04c3e7d6ed869feb3b4e48cb8f1d4fbd1aa419c385ac49d7e4cca3bfd428075ac19983023621e95d26c5a6a5d6426dc2d1a522bac279a6ac65d2b5c64ae357de1fa1944db9ce551383af814495a6968565855274034a047120515fd377c2e6dfb96816eed9c9ad8f4f2e651cc28e5012584b5622d98b750a901ca6124327aea007d3ad798f7051e8be144329cf458f5a6e24d04db3715e5bc5e827840c77bac571ff45d0cf670e9adcbb623064f8da1a30348", 0x1000}], 0x4, &(0x7f00000018c0)=[@cred={0x20, 0x1, 0x2, r0, r2, r3}, @cred={0x20, 0x1, 0x2, r0, r4, r5}, @cred={0x20, 0x1, 0x2, r0, r6, r7}, @rights={0x30, 0x1, 0x1, [r1, r1, r1, r1, r1, r1, r1, r1]}, @rights={0x38, 0x1, 0x1, [r1, r1, r1, r1, r1, r1, r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r0, r8, r9}], 0xe8, 0x44000}, {&(0x7f00000019c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000002c40)=[{&(0x7f0000001a40)="3fd40128740bf0598288de9fe093f1412945dc5fb20940d0c386bc0e05547a3cf6cecba5a07a91c165e3dcc8b80c8297e109f83e4f9c97b88e55635ea77a6062de1aa5a7c674a6417321758206e8b1f1209002e79979a7e4a2b56907db32daa416c58d9c06df1a2381fecb2e67b8fddf70be916ccfbc1056afb534df623b3454bfe5f6666ee28435c0ad3328ce394456f28131a07402513b387b216d6b17f45084c8dd63f8bdfead80b4a78b72ef1227158341ac64e51761499fcfd24decfe60955bbbb75f8d8f0cd6ea2cd17bd4b71aa756049d2994a9382b442bf0b48d0a6b6dca5af6359237a75844fc85289abbf4a3153e57a18a618d7dc73f81725b4876689b1edd935f092ffc95a7be032e8e4ac320ce1b6c50a8d6abbac3d7b329ed5aaa7f9d3286f23ee117d68cd10c3dd0a9a9f1654d138d162b9a5ad5c31a84356799068eaea17c354e0838562ebfccacdb4cde98e07e5f6cab60ff03b9b5a2dd0ae7c67250ec75b1bdc95e14ec7f1cf955506ee481f913d68a0d2fca82526d078b8014c2daa0b6f574d344cc0955fad98e0b6edc3788ee65bd27d388926c771f59fed212abd8a02b8622bb7376c58c95fac36ade48253114d58e9f4942bd4b94e60ef8394f1e4750b6e8905feaf91b00715febe07fff0df54de75f79f3d45461786518b19699f8c35f5decc73309f678412c2a0a53d5ab42d242680fed3becfdb7eedf7b44fb05531a13c1ddd33c6d8cbf56475913b99636bde6e0a404b18467f40122ccf4eb3b7d384db6e397f04a9be60b5f19f60f69ac0491d3c3294a806b39ce6862cc4d82760bfec162d3a8690fa36a246e4190350e04999bdf200ed412ecaf4e070deb6fb9ef343f9ee34da7e4074fc42525592c457443856c1a40f959ef241c1385fb8ad43c6eeaf7828fd405e99479521177386e83c937a27484b65cb8a9b115a3ac2f30d8df9c568f7b1e683fe900b9ac258084cd3c8cc24fa8a030acbf5006e5283f5495d45acdb1fbba2b05a4a065080b2f9d006c1d70c2262e70bf5656524f628342b6fa1b88482c18ab54f997b82698eb33fbdb7f59334afd46fc09098e0311d459c386eaf482dd4d13133a2f8ce02a13679cbae2942bbf3acd221b11feb8a049a20ca812b220d9689e0e4b05bff6889474a97d79a69824fbb509b165564f88471004498e59ecc406740e4e0dbf0356ae0ff4d23d43d42ff0e0773e890102a09a650a994159e34e9d1fd50c7e69735d934664aaf716520d3b028e87edf7ac17980e5d4bcf56785711a302e08a69261212b66e9643ad1106c53b9eef2227f48eac8777bc206562403191a9974191940218db90d8e3560b31582950065c50a522d63d4d2b5078426ca1f6811aa4d200f8ffca62c49edd1f1f0246ab1a677a06be00a371443826c5bdffbc7c2e338dda3ec741698983adf5bf4b72a9260c4291c6c37156b74ef51fc0e0f80966e752b33426a9e863d02db1cd7233220c747eaa277aca4f2d1acd8e47bfac2d0dfc91fdc596968a6c210586743ae10327fc9b59ee4cf4d29545acb08e9c3ce134bbb92cfacb1a536d597c94d8c2bd63eeca51bb09aac923b5b0118042bcb036be989cba99d6574beb3e460a67b69121f8d97354afdbcc931b8d8f069ca9220deea0e40716c49ca0300ff9a1f9c24a716b4356b6a9881db530f817557b1668a6c25e64b7299cb021129b417437531d40f79e4f7d03bc070fd076c6a4b2155f79152c81aad2674b80d2986ab93cc5911b9d2e2ace8bcd3b384cbc206cf324ebda256d79f23e2d846da8e7acab7b19b7652e43d63a0a6ea02106df122813288b5caae0b967114b91aee37a9e9dbff18cb85a6dcc7af389bb7e433081286cf878d8c3717c8ad9c57b366c9ddcf3bcb87f02835f4cf481074d91a5f56a329f208fdb9adf2334442247cf52ef78f7add49945ebc2bfcb00548ea13e61db59e1ecd5f8927aaa7bcf704783064adbd0bb0fdecc48bd513d043be3005e9d5e1f7305c4dd26b8cffce924844a0cc226b30151b2d47344ef6d4e26c8e52e8afbbda76dd1997e2b46ad65b87ceff374cd47465c8da72fc36104518fa74a626b7e8f11562929bf6112ac114920b107e6c8d3e0b5a4e6660cd89842e1c596502911c2cadfc871a506543ce0423cd27cface27322fc3dbfd4c61079fc6a4418e0e49eddc0dc34ea7c0d7d952e5ff79045ceb44813c7892b8fb86db3e4f99bcff5cbc0a3fb672a65c2d6dc579beec801c2050a02bb2a492403e783b8b7d37c06e936399f37935ad36113a8abcc371d61452ea297e11c9b5e8dd70eaf8b679fe1e470e39d7a5de002d3e76f3f1a93cf1716b13a8cc150fe26c1125d2f699c0749dd3d92390673decc8d9bb16d49bc550226423d3595509ebdac212be48def71a8fb972b4503d33e7902c70e938687a363eab1fd47f65d1c063d0e750582edc329f04f40f03f7924c3fcc7efadba9db9289a976e646a377210232b5c288dddd3c3f96ed657c02c292874a13ee5cdf81f6a549cb0b85155133b5fcbdfec5fdf76dcb94504a3e9ad6853a61048ba350e7b6dccf828040f94dbbedf63ddb955af5cff0cb019e59e1b58dbe39a5584389cf6c556a15f8d0d0d110d586fbf893b5f6383c3d8d44c5178dc9ffb930b66810eadfa81b3fdfb3abde64f10c4b44f95de477b6267bfd52096e7495a145823589655d78bce5ce2a645d396dfab96a7dad287f22f3947fa144eed254e89bff9872cf2d1279c796dc106ac14c15ce3d1e212c6a458c96c3f3e930a3cbfdf756e08fad490908b12089ea831fa94ff7703ec709b897190400c0555d633a0e4cb6c19fb2e27d7bd5b01fe2c4da0a900a8336bfaa392fe7c8eaeb0a809ed9d22e9fe60d28eaff654aefb72fd635d776b7611525c4b080a107737856aed05efba923b742eceae298db97a6cb4206499b66561a4b9a4a225b5f93d769230d1cffa24f25b60cfcb6b99ee153fec81b9996d2e83a08202096672cdfd8984277162ac3dc3acf8772330a65bf7488f28a1660c0cf7d0c5178edf1081bec76fa8524c9e69e2af9d6e9d4a16bfc3aca9b266f1b7d83d1cf4664b935c725859c0bba67dbbf3328692d45a07394bf3146d62e10cc24267ccf333ec17513ba0f12bea0d2869f8a0090f840bd30b614d4bd9e18813ce7ef0d5a8ecb91184188c568eab05e2043e91a7ab97b23abc2d116d037ca755fe1434f81144fb5569f65175cce8cb4c5a7de1efb0fcc9d53ba223ff4f65a61eb90767dde27b7a4711a9b2ceb1666624860f0ca8f5b035b9f7586d84a1611a0454c015193758ceed7a8de8f381882d2c8964100f5dd23f39941a5364f8a263fd2c12b2d02f34c93a31e1be315914f66ad852fc7bbfec66a6172b1f42acbf773d42889d9323d52068455a35a4a0e2cec1aec641f64c32d486f7249153a32e77b62a47cf81fc9c6b4d53fc5deef5859601574c00da13b9bcece2e97f656ace04163d353e81ea26a822db759d7be0fd6e741828c3667afdb5a0055c665ee76afad1ecb99e7e507ae67392e081e423134bac6be1d7873b7078876e66cec23a157aa178ac09643fadc6fb82a641504a38bb3105e7ab61fae26c97ced7b76821d1aa18203c6ff4a6655593416ae0b7098c258594271062b2731c05592a385b00ac0b65ab89eb7d447f31d60a036db36ad5120edfc0da10375f208c487c7c053132313dd4bcc01aa2f0d0bbb842dafb6ee64f86e71a83855edf2b1de92d54bba4b68c51e0e9b558c6c7f6771d4eb08a3fa2af31df7dfcbc61c1febe21bfb6f9c5158c8527106afbaaee589a7024ab239474ee61eb1ca33051c7f7f53b793c3a60bf2f033fdaec92dc2d103fbae063039cec30a053f0e227091d575e8ed2be2ca492637a811ff9987e09ccd631c413d5f739b7894bcf592becedc50d23568d3ba69a150374a90ecbed7703c509c6b09f7dd0933694ab22ac4889b4f03785caaec33b457d737db49e95e709cdc37fc8d3422f0a0410d0356f78b23860f48eb6ba9881afe404850cb95f7b84902dd570c6f6068e0f943d319704f6b9edf31b706130022b102314b8eb5532a49a72a9e248fe0c8e9babb69c81076cd60c6dec422a6114f4f89e5ef865f0d9164cc79bfc06121aeb1250ed92ab18fc71edcf8ac351fb59b703f1f497240530bf693c1ab34881f24205f9371fc8ddea27fca4c39993d5f8720a749dfcd2651b0229d6e9ba954f5719f7663c56ac7f32c3276aca330fc304198328e194060c2985aca8c4776f0f73541230d31645cb5280c3fac317b6f47effd1d10b5155b8483b1909713572c14cab6c5f85731285aa63f6be792c2b6d71f6c06bc32d1cc2f0bc9075d4f1bb9c21af5da636d43f9c4b871f1a39dea04e4d00e6cdbf5e85ea6f35cb418672e9dde43e0bd5dc1c3839d7f2f306eca7badc70a806bbada16144cbf23c94346bbaa9eb333107ce76b3ddc1ca73623a02142a9824bec81bbb32e66d0017774e934bb6869a892faeb1aad90cde6f670ff6fcb22d7086ac4c5ad72a5ac28bf13d4e3e370d5886c4cc04de7325bcf7d5b81fe48ab32016b2b941c2c9aea5e03f8fbf087a158f592508234ba19038eb573b955f4bdbb8fae11b851d6465b9e0761b5462b26245f8f1159df5d7fae7a76c5fbe4c748bf87b22abdec13423ecf0f895e6ac3be2d0eafe744ba31db04d669235bba621e05fdb474c185f4fa5ea1ee7218cb907ae224ab15dfa363a2a5f3b6323f1964e0fac307dafcf52396911b8d32e0fd5e9f5d64cb616eb3b73af7c6921ceb21983e2e7b2b4d4a809af4dacfcb9c77c258b6fb74ca1de49f9eaf9bc39c26ed33ef5ef68a6aebc6d0c9ad78f9df33b1d544324ac458efd7b33f52ecdf4a62e093bdd567a9f1e2c6811166dacfc44e7c6fcf3403d14c3dde35fddd448c59761ae7e30621d7b9b8db76a0127c02f91c7f10de1094ecbcd5f3a593f9fbb03cc71aa201d7f1e1da81d6e1414b7dcf0874341b77a36fe09d873c69e19e653896b497d4fbc697647ed9849a336976413b21fa8303eb691e1b24264acbb5c1091b48239bca4adfd5588eb46a0be1fda24404ccb0afd4be7b6079de8979202dd44d91a214fcd21214b2c4564065fbfc6f7ffea930109a211dd0383f59ab4ba2d1c7bfae50444e9c7a758177ca383aec875da674183662f5f473827f72da403345b75d5e2e9a78230231fdefb1cfaa78a220eb41a7f60a54d1eed82ebf95821e6a9c7c1db5ba1441b69f4ed8365a32afa1f8b2917d7100b62407b2a54a1e91960a3e8fc92a37dab56e8b2754f282bc010dd0a032c48597393154a0231952bdbab2269a3dc1ba615b816d7789220c63fa722425fbd50b6b7f83dcc69c84720e32743f07e4003d4eabd9a56334ae0e8dc6244b6a977a45d14e03b13f266bcd8e38f39dbd1f422f35edd54ab04053e5b513c5021739aa3d223f7125dac36f840f70b215fe59c16e6a646d8d18cbb5d0d4bf343503d8ce3a2032a2260ca4b3bf147672357be37179d022d3488d25529bea1bb25b262a720f725c4c62b93ba8a53c1055abb960d7373b5fa9683508736d38e121b7cf28efa87c9cce1711a05253749d2fd56005a687f0cd5babebcd5255279dac9d7d797c5417780d180d02907151f842bee3d429bca07be1725132403ef86161a6b65122e1324f7f8c6fc7f3a21e7f9d33bed321237c22a41d1a71edc7cbb699e5d76f81f40425b470452bc874f94245d505b8b8aa72157165a247adeb4cdef6c2bb77b435401ff8178398318c521a1f9b66527b8066a9", 0x1000}, {&(0x7f0000002a40)="8db6c67e499132101ccefe52c322a9aa3d56d34ce0654f8d1cb93b822e041af3fcbc04ba01de78274a19d164dd4b02f4c982ac53350d56e8cdd7d494d185b17baaa7d81c3656b2942ffee75de2ee3df76fd8f0075df436fb7ec1f4bcee48b4db1723478aa3de555a786910abf5b7c02346bf81949a0c2fb35ae425c2ba914f936d51064e50e41d2e7f911541a80e9d94ea44799df8f8656b4bcdbdcaf192ed8e8fd83aca5dd956e832fc0a8bb194ef64f1c40d81723d19bf05e4ec", 0xbb}, {&(0x7f0000002b00)="34807d7b", 0x4}, {&(0x7f0000002b40)="9d1bc0a0897565c92b774d117c4bda066fe6355315038c2a9635bac403497c85fa239a3af767832ab961961d230bec663e81571d868ce5ae8eeaafab1f6b761bee8d60eac0cd2ad812ba98fda9dfa6098438fcb7cd4ede885fae4490213460623647538a7589f2c5a601b1e0e08f802e13ed761d800b4a571f10b6f1652978913a1a5a58c17f471da5e2d536f0a1157466552af36fb4", 0x96}, {&(0x7f0000002c00)="1d4ab839ee37c2bda61b22f64e3429ff17fc5f6e8f9e86a856fa56f453b439d77a106344d9eefc8f5653ce4233", 0x2d}], 0x5, &(0x7f0000003140)=[@rights={0x30, 0x1, 0x1, [r1, r1, r1, r1, r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r0, r10, r11}, @cred={0x20, 0x1, 0x2, r0, r12, r13}, @cred={0x20, 0x1, 0x2, r0, r14, r15}, @rights={0x18, 0x1, 0x1, [r1, r1]}, @rights={0x28, 0x1, 0x1, [r1, r1, r1, r1, r1, r1]}], 0xd0, 0x40000}, {&(0x7f0000003240)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000042c0)=[{&(0x7f00000032c0)="8c29902e429d37bc721783283c6b7bf2e438d9f7c07f983f08cd74fe5b04e3553af5bf13fbc8844feb91c3a76894bef8883a0f3eb3c4f13ff46277440a0e9e0c6bb012086fab2d1c17526a4ba341a935737d3e6d859eb5c512580e5b9b4fc563a9b70f0b5fbcf0cba5d86103103e477176574997f84eedd5a173c503aa443d57efa6d24d8a7acb78db190ccb11c22055300dfd7959b529fdab7e43e3edf9cb5393474fcd0db747f98666b9e3251cc4ef58781692a35d96c89668e341c33b282672fe1e9e4d4ad2d4fcd162aa40a54bb0494e8b1bd51bf15f23a6fa3463ce9d9cb9a103b7c348cb155ee7b73b7efc34f90fb4090e5d1ac5a246db01f2223b53098de7e51b676608484966ff52d1f7f8f6b484901358fbfecdda9623708e7bedd20f6ac5bfa54f6947ea2839eb194a91443ffac2e9eb0e831c4d94716ab0ecccbaaf5589edc7137236d01697d7a74156f296e03904cd16addefcf8e1eb7ab62e2053f38989c4a5ae6bb7778186ecd6691fbc6a365728059fc601967a777877947164e60bbac51699a50e8fab87c05060604d3ddafc4ca2772ae66bb7927368bd774a84c13751d4c58c42846d3f72444d9a95c6d377eb52aca4b0e39fdbf440e18708f18a079d89c0131ec222202127f4d37afe94dc7b7d710fc9a49b9a28b780ff355997954e1b064c5b48125f66a9323191a289f8442c7f9e61f00685b089387f90104226fb1713999b43269f225048e5dc5e7665fca8754b1b1c6cd93fa8ea5d4fd3502053233040d649ed709bed1bcfd0e2417386862cd3830510980452b8bcd8e88eb1373f43e2d265af3dd784279e9c3e9259c05498d5eca66293ab03bae31b270e7ba204d320f680201e57f6a912592ceb49085de4b7392b75dd8bd02ba3157b7d3220ac548a57c53de20b376f1cac7325be7fb6558d0885d4b6965e5ccb10604649a77abe8e7d50b65bd31c9e30f488f147d5069ad7e450e0098e37a7f651a5d13234dc1e517c12e7b01a3bb157df518883568a5e6287e4c5cd655f7ee4794d4b1e5746f54d28d56fad5d490db10c32d2f14a7718b2cb9f2b005832fcc579e16f96b08b2606051ad32ba2747890f8a6a2e68392dfaa017f84eadb4a76bae4fafcc3afce7d721c7ec7ac7e8b5834acdaee263c448253e7d07d503e388ad471d49a05bc519b8bbb3a418e95384cc770e2f6ebccfce18abdd458d2792a8eb586815af9c0c89de13cebf9348ba3fa6e67ac3a6777a0d2adb71af0af9944c8b87c1eec919872a4cfe072178e271d146b9ed8656940a3c9a21fc82fedcfd8f11f723561ecd1f1ed26a39f5c7bf7ec50f3ab4a6513605559bb875f3b3112023df1247e12b6ec8472514e66d7cddff857646188fdfa38d3a220e7f6895f28aead163eea0c4d99ef306df1326c861ec5c0cb22534998c1cf70dbb8e068e2151ac05736ce6923c510045b3738de9e44a5cc928c4c585be95d2fd7e9a4f6c76c83fc808182ae3f7044a5fe6c249fa611d01df1b978d7774121de4716b718ef63ff8a8d8d446f3c414391de9cf92fe3fa706a1c76fbcdde323ceffc7bc2c0f117cdb8dcd8b308f203e0957dcde3747a22c1106a13fde656a23613b8fea8c539dd76014942b7cd8d8ba7e1a8f6a48a8b9db514999bbe917217c54628d5f00b1ce0e0daed532c8a9ca984859c07cf060771f7778d5e048f214169c7d9cd0633087fb2cf6c1abac5071733754f3ba77d9327bb14961e0fc81b13d03cab7dc444639d0b9c6cdfdfba1da68c5efae525d9959697cb598963a98b04ef7d38f2c6e903e57b91d02c689df1127f5eee2c6f3b3cffb44ab5e027153f2a5fe7e9ab17426dd6eb9c1e385d7f8d3707aeace9d15511031edadbd20a0504cacfa62ce332f105068fb4973e04972ebd366f071c8664753871b197c06035bab45af65d7ec8f98815f736e4fde6927d695842f4174eee62668f5eb0837a998c84e38a97fc52cd4fc5987cf4650fc196251fa93036c55544c436aaad2430dd09d20efbc87874f5c9c42889856d35c44dc4b3510262177ea0552da84bcf491856998b0e437160a17f3100acfe0eb8fd4feade4b04c5c63bbeac7921371855223da7eae02d692b5717d7f07391b40ba0618db8a01d1e94526c80b2763a444548fbc1702f7ec31512a86e88b73d8feb507a7df11520d84f42e1ef366f3d1b917cfd466b3be54d68a04d3e3ca56f33f2de02c49cb0365083e421662e4ffda63557b761da2896a273307dc0b13419c6df579ff3fa3c985f4fb810cbc65bd6eb879d58fe2e1228e785687a90f9c9e7652a84fbcab9b52d955c663e2ee28ac23056417cda99302c990e165ae56310e03231ba09d12ae2f7bb9cf9df1fe389356c3c8702b70366c0e74fb4b9444ec338f2946c1f4d64ec97c1a858f03a2f4400813a13f789b3afccc42208956e0d0980fed83b1b362f08dc26e5dac341426abffbf50f9f86fd9749ac8bff1835adc363efe6e2ade48892d7d1f4b7f5cceb890e50457db826d4e0750d29b0334d5a9fca66cee2f17f460d364ec91c849fe61515411e0d91e445cae3270c57c193bfa289f7e0989431bcbb768dcafbc80953d2c47efc0ef2d201472dfa95e6822d029a2fdc6153fe44bfd40ebc7c09c7158b0bbe7c6f6b5b8e70332f5e48529e8b5c97873f8879b0d85c1c3e9723c1672edaaea90f7b6aae5bb2a26145d7ca3d2acb00c220b0e3798389451afdee1f1a78c03fe2ea383585d87856c529ada1ff6fd47ac83a036b4538260a83464cc5ed2af5e58498274f217a43c16a5fbb316de8701342e613b87d50cca8c71bb2856f25ccbd8dfb9765c0ffc0c7042ff435a05cbe37cfcfbd8b34bf2f2dce0f02cfc44ee05be793cdf0b5bbe0510b4bc6bd7b1d5671f7431493416b77d6438c8cc90560f5a56f137f257c7c8e897e97f0494e844ce424cd3f6ef770304990a962ca043bb4f7bbdf1a1e407e11e925a2e4e1d2b87de486cf1f5d9baa731e66c24d016635a33cdf74255c146f733e9823ce257750ccc99aa9cceae94ca4910c7ea12942d4fa99b219bb86c01b13416aa6387100a3d44ae29cee7e2f4a0be8f3e52af9306b7ac9a6f878684453ac20e88e2e6bdfcbacd905c241d7297f1410b614e2be6cc6cbab654fd85c69744b4ef209aec755e6f3dd4baf1d2319da307157c7c6f9604f72334498288f931680f941d6310d6ad335acefbfb6a136eae1b883a028d45583e6f4a30c57bf423726ef151ec4bb141212184d7c00ec3d19a87712b4a3b7f8ab6157f331570c1df51b449b66952137126a76a3484f9b5bab846bb06471b48a91ef0ce019dcdff4f5087af61ba97a00b1fe18e6a1c1c702c910e9bb1959d9aebe428b35cc4dd884708be92b8f73814fc1d56da3ae5616dc5a7caa8d614053c45d65e10bb9b75ecf2e1787b818d662bd0277849193b14fb87cd78ace34a1017b537698c9deaae051309239e388cbad273206a9a6074b77ac0428badc6497f6806bd76b56752d9d6699b3436ffe67804ac85e53eaeec88835c59189e616ca16f630959dedc719cb7ecb7d91b72f9104232b503554f47ca1131c5c9af630f54c862a12189728f53b79af41a6e13142284329feae2ea7779df86942a93662e3b1e50af796b175cb226681da13d7cee6119f69bea33e06e9d45ce99ee35f4eeb054704cff8713bae109a1c73899aa599121149c8bfdc9da4119f2323d789f8eb6dc9e00de6abb3927783e31a1b3582d7d5f6043039cf4a608f43fb47ce76b85878e24466448122d3d2926ae4fa417dab8fd811428aaf4a27aecfff78a8311ae2da9d71f93364abb1f2cdc966fc2cb31674b9f838fd68e83b468ac44ef8fc318a32e2ca6fe51ecb645fe62043c0ddab890f464c347114236016e90a2bbfc21028a9554462106ca67588a44807fb2f1f87cbbaca7a773adb4548168ab47077e129c26f9df5f62ecc5cc1f4bf3c4428259bd518330418dad9ff1ebb8ec0f7bbc4efaeef0ed564fe0704e01143b834b3e4293998d9e84346ce99e5fc97f332da9ec84661119c023c66967cebdce2dfb9915b55d87cb0bfb727dce5fa7cd4f629c379ef95f73d6ccc335de748c51338f54db40080dbf85b62aca0cf902b5b2dd0d939d080585c236b27567d845f40e2340bda908b4cba0a8dd0bd2f7e17d5945eb3323520c71d22a48c2a1ba3d7796fc4da95e38c9b8ae0d52573b4bbdeb32216858cc433fc846dcab5c0bfb616ad7a876fb3d9f4b738139475e240ba62cbd0221efe4e6cac2e402acb822f450192e3d79973e5acccc9f3a41ef62d057bd2d52fd120031e30634456e5bc9679a8c398f9438e50f576479bfe794309c61d7919a9c01b1c41ef9e5a8e087666b86ed230f6224539774d61bf52c78f39a6a2cd9f4a7efb1f692e76d50a5f9a17b17a29aa616ca2ec72b147f0f6b907a9994777d90faedde180eb9448e7ad6256943c23b6276bebbc1893a66c1343d056518b6f499ad8ff990a7872aad12ece07516b3e32fbb6ead8393efc9a2a54fbb2672242a0301f1121945b452c463be0584cf2a06f39f8c6437ee887f9c0499dc93ec6ae0367af485ec399823694679df697d5f9e8a4ee5b83c9643554b72a4404bbfde42332e0e8951e5afcba35674874aa9e5c0d4ecdadd65faf37de8a517a512fbda9c3feba731156a6002d9f5610c3f76c77ff884646dafb562ecb2c922c465ac8a1bfca8475701b645b666662d9292a09de57c432cf62697560b37eee1e6070e32d94411ecc9a7eda5ecd66c8503382ad9dfdbed249b5eae4a6b1b14fa8b0a165eba08b8a2f118a67a875bd537afc69d68ba0feab84f51584046e21e7cb1de45434de7a171adbcaeef7a4731824e19a09bf222ec4129872f2bbb8796a13cb9e459d19d0c3fc4cead6413800c0d1e68f4902fb318c75ea9d451bfd532221dbd421e8ca32b3e75b3bbb54532c1d31e68e51ffa4511bb0c83abcf5e4e234372d21f202c9c1ddbedbdb2587a17b0ea8c963fce0192f0d7074e2d965898bf397c78c8032bbc18003cd9e7cd1db6ab56d1e29a92c6d9e939d00ace187d553120acba1aa8e8e85150b7ad77fc4f881ed51e35d0842292f7d5e69275378f0db48a3938cf5d90075c3813c0e97b68b7e001e636103c7042eb403796748cd02eb5cf656ae5583cdcfdfd567e64d28fc966de6215965fee4e31ada2487d103a7ef005c4019e3ef35601ac7c5e4b3df9276974d848cb7842a01c05092282cae4a6b0251cb8467a80aa029e37bc7e9c8c6181381c445c7effe8673af6ffe32c638f1076a6b2e062312aa0f6ef5d5318d03aab678b518f7d810361e6f00efe1286897fd738271fe9b9a7d51b5ba40ad66c612b13c88996025fe80acb5f71ad8bfb2f576c00feca69c1138402e04cf2706abc56c4ce3b92def6cb387c382b626769125087eabe4d7ad941de7f2609a2e171b3cf008a2a19b92337ce098d4de0cd37c23c5f20de1412b750a17127dc4240ead5823bd4d31e80328ce239ae1eb457541ddf9514e210bc6c5bfa1c55a1f67766d58fc20edc226540c1315b9d1be1419558ec2b440e9fb25c869598bf589e3376a0ac82a864af83ab4682f7c313b45665d8195f7be68b94bc549ce5ace6c86fa1413bc36d378216466dde9dfcd5f6d9b7915c0c4232a31677b89b5843ad7a7a8848b6c04d441b9a622be2e05837adaa0afea75d35d0a4cd6522750fa3aeee7859b80bbdf0e8b3120c95e8fea28adfc66e030267cdace3679f6c17df8a0ce5b10c073c75d4f59eea1cd9ead2bcb49eb2459cd", 0x1000}], 0x1, &(0x7f00000043c0)=[@rights={0x30, 0x1, 0x1, [r1, r1, r1, r1, r1, r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r0, r16, r17}], 0x50, 0x40000}, {&(0x7f0000004440)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000046c0)=[{&(0x7f00000044c0)="c7c19851b4d9211e909050830d9a43e0a611492c245445c7c3b24901d413b3ad5cb67c24f9b077e96b8bc8f1d1e55e9ff959c12fbe7a7a4c47c2163a89e5710912e529fcef3445b351c51b886a32e7fce21d8828164a9564d90c0bda4e9784e8ad1eb7", 0x63}, {&(0x7f0000004540)="073c86f4ea375a6c174638fa60148f77d81277e322679c32f19dd2866375333cc1f2410ab11275c27ef4b2eac2a2bd35ff6971ecf7d2949302c8dd328b567d014cdd0ca301fdd7eece10469c6018ddb22d418f9ad3e0667311a022d8610b987ef9506688f0da835626ab8cfcb78abaa1e500c632d54cba18a3c54bdb7afca5d3939cb17f5b1b5dd57306edd3a477bdd1574c6b54a75fd44e46e874f5fc53a4e2964c4bbd3ca153c179ba8805685d2b8431b9baf36e9d23ff316035ee875375a22f6c584488d658af2c3771fb8d9f7f4cc7d311ca56d13e32aedeb0ee1a6488f47d1b40a766298ca7e2e291f6d40b7d", 0xef}, {&(0x7f0000004640)="49ff", 0x2}, {&(0x7f0000004680)="da34ddf9f59b3dcc18adf17fa4205962", 0x10}], 0x4, &(0x7f0000004ac0)=[@cred={0x20, 0x1, 0x2, r0, r18, r19}, @cred={0x20, 0x1, 0x2, r0, r20, r21}, @rights={0x18, 0x1, 0x1, [r1]}, @cred={0x20, 0x1, 0x2, r0, r22, r23}], 0x78, 0x4000001}, {&(0x7f0000004b40)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000004e80)=[{&(0x7f0000004bc0)="67caee04b16362f86600315d7a8c6b239b35699e737140c77cc94640b6a35a4e0ed8466fe0f0f22f", 0x28}, {&(0x7f0000004c00)="b2d977fd9cd881f3e0cfa39264fb78dacbb44d12ecd9b29b0cc37f956b752fedd54b728afcef8cf848add025a9f84c9bb284f1501b22bbc8f24344f49ac44a2813f31f28f8f52be568dded4ddabdb2e20d66562745a9538f26c0572921da90d593e7cf20da9bad86f93d02374667d3a364c457f806bc66eb1c0fa25c40a24580210182168da698b991d8dacf0dee2f5d893347", 0x93}, {&(0x7f0000004cc0)="bfb9cffb740ee0cdfc972af289dfd6d422d55d3d0a54ce238efbb79fed129e071cea69a53404dc456fccc77747b5cd123f44b83625c74352615e3125ed579fc754e2a697cfed541e92eba1aaaebf", 0x4e}, {&(0x7f0000004d40)="36eb098724031ad54ff03995c56042699eaff1b26aeb507ee4c87aa0350fc6eaf7af26b6f89d22808d024af926ea171f75398d8c5ec8f3f8", 0x38}, {&(0x7f0000004d80)="525d21dbf89ee8913d56aea87f5b9e4b7ba8eeef38d5d869899e1b406cd6295368f887f8f83eefc63386c39b9060ef6ca9fd613a089deef17e8a4a743a9897f95335cfdf11af4b12b0baaaf110e314482ef993183056c82200fb9b6c6e8f8aefaafb13f18e69014a056a68d7756d0bf917be54af60c67cc1fd428656f60fb45559ea311529b34594c54d037758e0520c715fd082d47211eeee0b2e89f9ef7cf1ebfbe446724d7614015b8b8c3a95fd9ffc653035620c09a15d188be66eb098b10892d73205736d53678131e997262dfd0a4e9a86ff100e4bdf13c0e3b80880138eb3aee5cf0f1b13f4ee512a", 0xec}], 0x5, &(0x7f0000005100)=[@rights={0x20, 0x1, 0x1, [r1, r1, r1, r1]}, @cred={0x20, 0x1, 0x2, r0, r24, r25}], 0x40, 0x4004000}, {&(0x7f0000005140)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000005280)=[{&(0x7f00000051c0)="4cc80ca267b48dbfcb821f83745ed6e01fe1d24d2eddd8361071c50883e1cceb62e61f74393f5d8612021d7a6b1d151fe3c16aaeccc11666dc26a12fed640db024ca3c49af5d", 0x46}, {&(0x7f0000005240)="b8340c0ade7da756f16129da30d330b3c29762c041585ad306d4ba85a42d983270279f592ef15c701f97e72c0d65cf60c32055b052dc4d2fb361", 0x3a}], 0x2, &(0x7f0000005880)=[@cred={0x20, 0x1, 0x2, r0, r26, r27}, @cred={0x20, 0x1, 0x2, r0, r28, r29}, @cred={0x20, 0x1, 0x2, r0, r30, r31}, @cred={0x20, 0x1, 0x2, r0, r32, r33}, @rights={0x10, 0x1, 0x1}, @cred={0x20, 0x1, 0x2, r0, r34, r35}, @cred={0x20, 0x1, 0x2, r0, r36, r37}, @rights={0x18, 0x1, 0x1, [r1]}], 0xe8, 0x8880}], 0x6, 0x20044881) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x2000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:07 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x600}, 0x0) [ 948.856263] binder: 15414:15415 unknown command 1356136456 [ 948.894779] binder: 15414:15415 ioctl c0306201 20000700 returned -22 08:56:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x11000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 948.940156] XFS (loop6): SB sanity check failed [ 948.945103] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 948.956262] XFS (loop6): Unmount and run xfs_repair [ 948.958813] binder: 15414:15443 unknown command 1356136456 [ 948.961306] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 948.961322] 00000000c5202039: 58 46 53 42 00 00 10 00 00 00 0f 00 00 00 10 00 XFSB............ [ 948.961332] 00000000c2d954bc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 948.961341] 000000001b379ba9: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 948.961359] 00000000cfe84a2c: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 949.002714] binder: 15414:15443 ioctl c0306201 20000700 returned -22 [ 949.009108] 000000004c394032: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 949.009120] 00000000ab5132a7: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 08:56:07 executing program 4: sendto$inet(0xffffffffffffffff, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r0 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r1 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r2 = dup(r1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r2, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:07 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r4) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x4b8, 0x0, 0x270, 0x140, 0x3d0, 0x3d0, 0x3d0, 0x4, &(0x7f0000000100), {[{{@arp={@empty, @remote={0xac, 0x14, 0x14, 0xbb}, 0xffffffff, 0xff, @empty, {[0x0, 0xff, 0xff, 0x0, 0xff, 0xff]}, @empty, {[0x0, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x8001, 0x5, 0xffff, 0x401, 0x3, 0x100, '\x00', 'bcsf0\x00', {0xff}, {0xff}, 0x0, 0xa}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @multicast2=0xe0000002, @remote={0xac, 0x14, 0x14, 0xbb}, 0xf}}}, {{@arp={@remote={0xac, 0x14, 0x14, 0xbb}, @rand_addr=0xfa2b, 0xff, 0x0, @mac=@dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xf}, {[0xff, 0x0, 0xff]}, @mac=@remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, {[0xff, 0x0, 0x0, 0xff]}, 0x1, 0xca5f, 0x9, 0x9, 0x0, 0x34fdc29a, 'vlan0\x00', 'syzkaller0\x00', {0xff}, {0xff}, 0x0, 0x10}, 0xf0, 0x130}, @unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x1, 0x4, 0x376}}}, {{@uncond, 0xf0, 0x160}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0xee, 0x1, 0xde, 0x0, 0x0, "8a1fc6d595fc5cbf1880b3eea537b3742e20ef28ea0012724f1fdef1b6d46239146543d72ac337ce7e5b1f98ad0c0661fe32f0596502311bf9fed758a7230d54"}}}], {{[], 0xc0, 0xe8}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x508) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e21, 0x2, @loopback={0x0, 0x1}, 0x81}, 0x1c) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x400, @loopback={0x0, 0x1}, 0xfff}, 0xffffffffffffff71) ioctl$SCSI_IOCTL_STOP_UNIT(r4, 0x6) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x3580], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x5}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 949.009130] 00000000de1346dc: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 949.009145] 000000007dcbf3c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 949.051115] XFS (loop6): SB validate failed with error -117. 08:56:07 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x1100}, 0x0) 08:56:07 executing program 4: r0 = socket$inet_sctp(0x2, 0x0, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:07 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in={{0x2, 0x4e22, @loopback=0x7f000001}}, 0x1, 0x0, 0x8001, 0x3ff, 0x50}, &(0x7f0000000040)=0x98) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(r0, 0x84, 0x78, &(0x7f0000000200)=r2, 0x4) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @multicast1=0xe0000001}}, 0x3, 0xe5, 0x7, 0x4, 0x80}, &(0x7f0000000000)=0x98) getsockopt$inet_sctp6_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f00000001c0)=@assoc_id=r3, &(0x7f0000000180)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="000000000049460056039ea6a707ad6cf50000c2"], 0x0, 0x0, &(0x7f0000000680)}) 08:56:07 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:07 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000002b4100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x80ffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:07 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x10}, 0x0) [ 949.199421] binder: 15476:15478 BC_FREE_BUFFER u0000000000000000 no match [ 949.260788] binder: 15476:15478 transaction failed 29189/-22, size 0-0 line 2852 [ 949.315805] binder: undelivered TRANSACTION_ERROR: 29189 [ 949.335269] XFS (loop6): SB sanity check failed [ 949.340151] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 949.351285] XFS (loop6): Unmount and run xfs_repair [ 949.356341] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 949.363061] 00000000de7ef0fe: 58 46 53 42 00 00 10 00 00 00 00 00 02 b4 10 00 XFSB............ [ 949.371940] 000000008ace338e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 949.380825] 00000000e3ec1b36: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 949.389703] 00000000af3d4e40: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 949.398595] 00000000a49f7693: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 949.407465] 0000000011637852: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 949.416351] 000000006d563a46: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 949.425243] 000000000a5c7863: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 949.434298] XFS (loop6): SB validate failed with error -117. 08:56:08 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$EVIOCSABS20(r1, 0x401845e0, &(0x7f0000000040)={0x3, 0x93ab, 0x6, 0x3, 0x6, 0x7c}) getsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280), &(0x7f00000002c0)=0xb) ioctl(r0, 0x8914, &(0x7f00000000c0)="025cc83d6d345f8f76207056010eba8d2e80f385b956cf49b0aa06080c5b7c5881b701ddf0619657babf546e49a01e0cae2df19c8085eb4efebd90eff2128e79de45406ce219ff806ac68c6f0a75848a966855f0a7089570f9c8bc919cd5bf875cb4a38b10e1d56a49bc1534a2de926f672d6598519a9cf6c2031ee92e60637b6c2c5534227f18c34dbb5840a4554571d07e20f6b9749c86e2e6b7b81054a8295f903bdf68cb93a02602bda2e771deee7111d7a52a98121fe1540082df9be7f3b4d5b6b5360eb4ae3c90fc80bf6bd8e7d0802f0d3658e1434fbb0612bb750ec25a75389948e1d6d08c8ebf366b8a6efc4523cec84510dfdd6984260ca2691bf480c33d92e3f2b757825ede14f98b24d680f4a3b301add43d787978dc89ac806b5e8def8fde0046321b0c8045f5bba0104c8bb9b378c120e271c8d0030d93d752c1914495272158efde6eedf46cc64bc5f44c6c4460d9c33a508bc0f345e791b5c6a8564bd18b601be9f1c6bdb2abc362cb0b9439bb70b0db8714b387ab30498ddd931387b74a") syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1, 0x10402) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="f11fd96d79ffffff"], 0x0, 0x0, &(0x7f0000000680)}) 08:56:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x34000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) fcntl$getownex(r1, 0x10, &(0x7f0000001440)={0x0, 0x0}) stat(&(0x7f0000001480)='./bus\x00', &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000001540)='./bus\x00', &(0x7f0000001580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = gettid() fstat(r3, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x6, &(0x7f0000001680)=[0xee00, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff]) sendmsg$netlink(r4, &(0x7f0000001700)={&(0x7f0000000240)=@kern={0x10, 0x0, 0x0, 0x84004000}, 0xc, &(0x7f0000001400)=[{&(0x7f00000012c0)={0x130, 0x33, 0x230, 0x70bd25, 0x25dfdbfe, "", [@generic="3c1cb6ad78738d75f52077bd13ced8398cca1a3a1eb9843426406e67aecae9efd03f7c293a258b7e9efd7d3091ad9758e9fee81aea72e8f8ef14d1b921fa6c2eaecce26813f56d957d04512a54f024bc896150420c8ee9763e078d9debbb81249756b95304bd26c9940e07277e0e7753fea18567eed5079de0a7a87f3e12c5e4b54e792ea3aada3cbfaa982b417a45bb55a76f77ce40cf2e7160f32a200d34c55573c73eecf5636eb91cd62dc664a5d78be5fdb35bdbc9745ce6cc2a4edea455f04017459d8190d4b64ccdb8c24dc596", @generic="127d057e79126a129d624024171b221cc8", @generic="5b8c73c02f6522067439846e27cc5ab5dcfa6cb194a16860f42b91015fded1414f13123384da312aa85adad4eaa817fa0fc1a163ff4470146139a0fd8e"]}, 0x130}], 0x1, &(0x7f00000016c0)=[@cred={0x20, 0x1, 0x2, r5, r6, r7}, @cred={0x20, 0x1, 0x2, r8, r9, r10}], 0x40, 0x44}, 0x20004000) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r11 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) r12 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140)='/dev/uinput\x00', 0x0, 0x0) ioctl$sock_ifreq(r12, 0x891a, &(0x7f0000000200)={'bridge0\x00', @ifru_data=&(0x7f00000001c0)="68a8bede88a92db4eca9178e5e5e2b63f141520cddd29aafb46cbb5bda93e604"}) ftruncate(r11, 0x2007fff) sendfile(r3, r11, &(0x7f0000d83ff8), 0x8000fffffffe) rseq(&(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x5, 0x7f, 0x4, 0x60}}, 0x20, 0x0, 0x0) recvfrom$llc(r4, &(0x7f00000002c0)=""/4096, 0x1000, 0x2001, 0x0, 0x0) 08:56:08 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4400000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:08 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x59}, 0x0) 08:56:08 executing program 4: r0 = socket$inet_sctp(0x2, 0x0, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:08 executing program 7: r0 = gettid() r1 = syz_open_dev$usbmon(&(0x7f0000001840)='/dev/usbmon#\x00', 0x9, 0x0) read(r1, &(0x7f00000017c0)=""/105, 0x3ff) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x7ed) recvmsg$kcm(r1, &(0x7f0000001700)={&(0x7f0000000080)=@hci={0x0, 0x0}, 0x80, &(0x7f0000001640)=[{&(0x7f0000000240)=""/213, 0xd5}, {&(0x7f0000000480)=""/4096, 0x1000}, {&(0x7f0000000100)=""/173, 0xad}, {&(0x7f0000000340)=""/13, 0xd}, {&(0x7f0000001480)=""/202, 0xca}, {&(0x7f0000000380)=""/5, 0x5}, {&(0x7f0000001580)=""/140, 0x8c}, {&(0x7f00000003c0)=""/106, 0x6a}], 0x8, &(0x7f00000016c0)=""/58, 0x3a, 0x9}, 0x141) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000001740)={@empty, @mcast1={0xff, 0x1, [], 0x1}, @local={0xfe, 0x80, [], 0xaa}, 0x0, 0xdc2, 0x8, 0x100, 0x20, 0x2000000, r2}) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}}, &(0x7f0000000000)) tkill(r0, 0x15) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) getpriority(0x1, r0) capget(&(0x7f00000001c0)={0x0, r3}, &(0x7f0000000200)={0xffffffff, 0x5, 0x4f6, 0x6b9125a8, 0xfff, 0x100000000}) 08:56:08 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000006c0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 949.847556] XFS (loop6): SB sanity check failed [ 949.852413] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 949.863574] XFS (loop6): Unmount and run xfs_repair [ 949.868638] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 949.872616] binder: 15528:15529 BC_FREE_BUFFER u0000000000000000 no match [ 949.875358] 00000000d5472071: 58 46 53 42 00 00 10 00 00 00 00 6c 00 00 10 00 XFSB.......l.... 08:56:08 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x1000000000000000}, 0x0) 08:56:08 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x689], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x2000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) r3 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x81, 0x202000) ioctl$SNDRV_TIMER_IOCTL_STATUS(r3, 0x80605414, &(0x7f00000001c0)=""/162) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) [ 949.891157] 0000000002bbbfc2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 949.892838] binder: 15528:15529 transaction failed 29189/-22, size 0-0 line 2852 [ 949.900064] 000000006ce685b7: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 949.916561] 000000008942eac0: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 949.925462] 00000000a223059f: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 949.934353] 00000000474b0e88: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 949.943238] 000000000089ae8f: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 949.952272] 000000004e2e52d8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 949.963084] XFS (loop6): SB validate failed with error -117. 08:56:08 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xaa00000000000000}, 0x0) 08:56:08 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0xa, 0x3, 0x10) setsockopt$netlink_NETLINK_RX_RING(r1, 0x29, 0x22, &(0x7f0000000000)={0x1, 0x20000, 0x1}, 0x10) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013eb934cf5a7fecc767480eaa7fdb4d7f5248990c714ad9a32355019f8a96c4542db48b8e340979d242d2242c83934a5b095b4032aa2ad46b7ac466f64c3cb5dbbd", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) r3 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x6, 0x34000) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000200)={0x0, 0x21, "3784113bb1f65509627a522e786aa403f217a57cca8cfeff48dfbb510c9f49ef01"}, &(0x7f0000000240)=0x29) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, &(0x7f00000002c0)={r4, 0x5}, &(0x7f0000000300)=0x8) 08:56:08 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000074000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:08 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x543], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 950.026779] binder: undelivered TRANSACTION_ERROR: 29189 08:56:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000100)='./bus\x00', 0x0, 0x5) r6 = getpid() getpgid(r6) ftruncate(r5, 0x2007fff) getsockopt$bt_BT_SECURITY(r4, 0x112, 0x4, &(0x7f00000000c0), 0x2) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:08 executing program 4: r0 = socket$inet_sctp(0x2, 0x0, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:08 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xaaaaaafeffaaaaa8}, 0x0) 08:56:08 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x6c00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 950.111408] binder: 15571:15572 BC_FREE_BUFFER u0000000000000000 no match [ 950.137153] binder: 15571:15572 transaction failed 29189/-22, size 0-72057594037927936 line 2852 08:56:08 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) ioctl$KVM_GET_DEBUGREGS(r1, 0x8080aea1, &(0x7f0000000100)) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) ioctl$RNDCLEARPOOL(r4, 0x5206, &(0x7f00000000c0)=0x100) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 950.191603] XFS (loop6): SB sanity check failed [ 950.196461] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 950.207658] XFS (loop6): Unmount and run xfs_repair [ 950.212736] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 950.219469] 00000000be739084: 58 46 53 42 00 00 10 00 00 00 74 00 00 00 10 00 XFSB......t..... [ 950.228366] 00000000581fe353: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 950.237273] 000000004480e027: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 950.246177] 0000000071a48682: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 950.255077] 00000000488a0bcb: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 950.263973] 0000000091d17fcc: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 950.272878] 000000001c56608e: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 950.273214] binder: undelivered TRANSACTION_ERROR: 29189 [ 950.281748] 0000000092688496: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 950.296586] XFS (loop6): SB validate failed with error -117. 08:56:11 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) io_setup(0x40, &(0x7f0000000080)=0x0) io_cancel(r2, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x7, 0x3, r1, &(0x7f00000000c0)="38fb23f0e53aa5ee678353bb5eaabbb36901e90c5fd33b8eafbd0ab43cd127ded0b8a6d76874115b32d58a8b8d452ea02172753014f66f84c6294240d95195f0e28db4afff9e0feabdd6688ffcd8a4fc6e2bcf1242329bc795800b9ec6486a86b2824aac706aaa96a3a02665c783985ad090a23369bf0ac5bd9aa8d31ed66ab8c524a6436ac5226244883a41e88dc19f5f0b54314a67dfe6e54bd23d28ebc2df0a5a03cc9321ba09c8d349803fd00cb35aa58330437706974684bd98dcef9c159f1ac6ee6fab08c26ab6e7bbb4ba55703f504000adeae76e8e68cb9ff8854b430d479b74cc51bc6b2979", 0xea, 0x8, 0x0, 0x0, r1}, &(0x7f0000000280)) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) rt_sigqueueinfo(r0, 0xf, &(0x7f0000000040)={0x20, 0x6, 0x8000, 0x2}) rt_sigqueueinfo(r0, 0x10, &(0x7f00000002c0)={0x1c, 0x8, 0x100000001, 0x3}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4c}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:11 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x28000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:11 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x6000000}, 0x0) 08:56:11 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") ioctl$sock_inet6_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000000)) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00000015", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:11 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(0xffffffffffffffff, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:11 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$EVIOCRMFF(r4, 0x40044581, &(0x7f00000000c0)=0x5) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:11 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000000f100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:11 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x89060000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:11 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x700000000000000}, 0x0) [ 952.849354] binder: 15622:15624 unknown command 352321536 [ 952.885077] binder: 15622:15624 ioctl c0306201 20000700 returned -22 08:56:11 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) getresgid(&(0x7f0000000140), &(0x7f00000001c0), &(0x7f0000000200)=0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x50410, &(0x7f00000002c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r5, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB=',fscache,access=user,mmap,dfltgid=', @ANYRESHEX=r6, @ANYBLOB=',access=client,uname=,afid=0x000000000000008e,noejtend,noextend,\x00']) 08:56:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4300000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 952.920000] binder: 15622:15647 unknown command 352321536 [ 952.929930] binder: 15622:15647 ioctl c0306201 20000700 returned -22 [ 952.966207] XFS (loop6): SB sanity check failed [ 952.971248] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 952.982395] XFS (loop6): Unmount and run xfs_repair [ 952.987452] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 952.994186] 00000000e708bebf: 58 46 53 42 00 00 10 00 00 00 00 00 00 0f 10 00 XFSB............ [ 953.003061] 000000009248bddf: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:11 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4010000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:11 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x1100000000000000}, 0x0) 08:56:11 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) [ 953.011939] 00000000baf2404d: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 953.020826] 0000000038970cc3: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 953.029705] 00000000e98a5960: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 953.038673] 00000000f161b69e: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 953.047548] 000000001c1d09a1: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 953.056428] 000000009c153634: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:11 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x80040200], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 953.065537] XFS (loop6): SB validate failed with error -117. [ 953.073629] validate_nla: 8 callbacks suppressed [ 953.073637] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 953.120394] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 953.141647] binder: 15671:15672 BC_FREE_BUFFER u0000000000000000 no match [ 953.159652] binder: 15671:15672 transaction failed 29189/-22, size 0-0 line 2852 [ 953.182856] binder: 15671:15681 BC_FREE_BUFFER u0000000000000000 no match [ 953.193705] binder: 15671:15681 transaction failed 29189/-22, size 0-0 line 2852 [ 953.205293] binder: undelivered TRANSACTION_ERROR: 29189 [ 953.212524] binder: undelivered TRANSACTION_ERROR: 29189 08:56:12 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$TCXONC(r1, 0x540a, 0x2085) read(r1, &(0x7f00000001c0)=""/105, 0x69) ptrace$getenv(0x4201, r0, 0x5, &(0x7f0000000040)) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) tkill(r0, 0x15) 08:56:12 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x8dffffff00000000}, 0x0) 08:56:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000180)={&(0x7f0000000140)='./bus\x00', 0x0, 0x8}, 0x10) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) ioctl$KVM_S390_INTERRUPT_CPU(r4, 0x4010ae94, &(0x7f00000000c0)={0x400, 0xfffffffffffffffd, 0x3ff}) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000100)="73797a5f74756e000000008000", 0xffffffffffffff0b) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f00000002c0)={{{@in=@dev, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}}}, &(0x7f00000001c0)=0xe8) ioprio_set$uid(0x3, r6, 0x1) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x500000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:12 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000050000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:12 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8864], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:12 executing program 0: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x240, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:12 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(0xffffffffffffffff, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:12 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x608], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:12 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xc0ffffff}, 0x0) [ 953.818323] binder: 15696:15698 BC_FREE_BUFFER u0000000000000000 no match [ 953.828625] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 953.851624] binder: 15696:15698 transaction failed 29189/-22, size 0-0 line 2852 [ 953.875714] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 953.883428] binder: 15696:15698 BC_FREE_BUFFER u0000000000000000 no match [ 953.883668] binder: undelivered TRANSACTION_ERROR: 29189 [ 953.893370] binder: 15696:15698 transaction failed 29189/-22, size 0-0 line 2852 [ 953.930995] binder: undelivered TRANSACTION_ERROR: 29189 [ 953.954448] XFS (loop6): SB sanity check failed [ 953.959277] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 953.970424] XFS (loop6): Unmount and run xfs_repair [ 953.975506] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 953.982241] 0000000030f744f2: 58 46 53 42 00 00 10 00 00 00 00 05 00 00 10 00 XFSB............ [ 953.991119] 000000002b312f6c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 954.000020] 000000000179cbfd: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 954.008942] 000000000f5de689: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 954.017889] 00000000e097921f: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:12 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x300000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:12 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xe8030000}, 0x0) 08:56:12 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$usbmon(&(0x7f0000000180)='/dev/usbmon#\x00', 0x6, 0x0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="36de618eee0df329748a1609d7553fcd", 0x10) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="116348400000000000bc000000000000000104000000000000000000000011f9de5000000000000000000000000000003c4cab97b18de34eb333c78f0322551d82f529d3bd9a64e40130f3e8153c39bea2e29f2b41d4555094955faebd6060a3036330357e04c0202b5184210facddc753e282da082b2ea863", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x400000, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000040)={0x0}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000100)={r4, 0xff}, &(0x7f0000000140)=0x8) 08:56:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4c000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='veth0_to_team\x00', 0x10) r1 = socket$inet6(0xa, 0x80003, 0xffffffffffffffe4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f00000000c0)={0x10, 0x0, 0x8000, 0x200040}, 0xc) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r0) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0xfffffffffffffeb3) getsockopt$IP_VS_SO_GET_SERVICES(r3, 0x0, 0x482, &(0x7f0000000380)=""/106, &(0x7f0000000400)=0x6a) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f0000000200)=0x6) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000140)={0xffffffffffffffff}, 0x117, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r4, &(0x7f00000002c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000100), 0x1, r5, 0x10, 0x1, @in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}}}, 0xa0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) [ 954.026774] 000000008767b095: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 954.035679] 00000000fb57beb3: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 954.044561] 000000007cfeaf4b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 954.053535] XFS (loop6): SB validate failed with error -117. [ 954.077181] IPVS: length: 106 != 8 [ 954.084395] binder: 15738:15740 BC_FREE_BUFFER u0000000000000000 no match [ 954.110625] binder: 15738:15740 transaction failed 29189/-22, size 0--7517831332383162368 line 2852 [ 954.172245] binder: 15738:15740 BC_FREE_BUFFER u0000000000000000 no match [ 954.179349] binder: 15738:15740 transaction failed 29189/-22, size 0--7517831332383162368 line 2852 [ 954.190654] binder: undelivered TRANSACTION_ERROR: 29189 [ 954.196272] binder: undelivered TRANSACTION_ERROR: 29189 08:56:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:12 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8100000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:12 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) setsockopt$inet_buf(r1, 0x0, 0x3b, &(0x7f0000000040)="601496b89f27248f30f28f0ab4b8aca869cd0a16cf022269383f0c9f8003b1640ead76eca960952968be4166d76c7b53198cc54b41b8388e85d1bed69ce90e691a8ab7ea0cb471b09d6c5a1b272b482fa774622cb7972d06c721f1036c6f411a5f708bbd226a5aba3d9d1b55e51c5cc7e762012ba9baf23f74c0be625d5a07b236ddc297f11dc320b649311cdec285c2247f03f1f7c049e3e21e024fc7c5f0f82378980a0ec14efe8f6ac28d41e0fc0afcc7f9c328aeccda534772f1b49afdc36dc141a44984fd100a76b2e27a43411dbdd97de856078b", 0xd7) read(r1, &(0x7f00000001c0)=""/105, 0x69) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r2) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:12 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x1f4}, 0x0) 08:56:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) r5 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x8, 0x10000) syncfs(r0) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r5, &(0x7f00000002c0)="0b77d6c8a9b2c445786fe19edf6e9d4d6314f7da87397c871ca47009a7a9dc5fa9aefac461a3d8d4bdaf8f2d0db34c0ec078c11c985c608c91f6ebc9104a722eb6c5f71ff02c1cbe84ee9b27d7cfe54afa9016ec5dff9b888e6093f25991b6843c96e511d904461a465a00000000000000000000000000", 0x77, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @local={0xfe, 0x80, [], 0xaa}, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000000200)='./bus/file0\x00', 0x10000000141042, 0x200080) ftruncate(r6, 0x2007fff) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x2, 0x4) r7 = gettid() ioctl$TIOCGSID(r6, 0x5429, &(0x7f00000000c0)=0x0) kcmp(r7, r8, 0x4, r6, r6) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:12 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000100)={0x0, 'vlan0\x00', 0x4}, 0x18) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x194, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x8, 0x20000) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f00000002c0)={r0, r2, 0xce5, 0x7f, &(0x7f0000000140)="a9b0f12f38c6aed100574037463c6d653f0dafbf6dc1a98e9779ee54b5341754be150b94beeaa62cca4f55d4dd2a9a8c914c5e3a1389d57044a315ded08ecbb496bd3f363c9865c351e55c3dce9ffb2fd7cb44e3c04eb04631ae49aa097255c12d77a3adece2d723de5ec72d9092745452467c264f159aaf3019246bb128b79be008", 0x1026, 0xd55, 0xfffffffffffff6da, 0x3f, 0x0, 0x6, 0x40, "cd33e4c20b73369de9b098f953ecc56fc056d79cf7ac2c88effd6fa5b6e1438026ab34456fc6e718560f2bcd3fcb6657e403afd575a2fdcb19b325fd1db72821f8b2adc3dff21b5ddd01867325f72593c19b7c2333f1f9119620a333e8169096085bd704d182f8854f7c18c0206ff9b3208a4ae9a2adf82ddaeb09682443dced765e705d94c0cb81cb2ea906ada511da56f66886a5f163db3d54d1cf426fad2ba6df3784016d8d47c0a7e0ff8419058da0"}) accept$inet(r2, &(0x7f0000000040)={0x0, 0x0, @multicast2}, &(0x7f00000000c0)=0x10) 08:56:12 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(0xffffffffffffffff, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:12 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000040e0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 954.759957] binder: 15761:15764 BC_FREE_BUFFER u0000000000000000 no match 08:56:13 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x806], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:13 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x300000000000000}, 0x0) 08:56:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0x8e0d688412ac9e8a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) dup(r3) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) 08:56:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xfffffff0}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 954.802738] binder: 15761:15764 transaction failed 29189/-22, size 0-0 line 2852 [ 954.835652] binder: 15761:15764 ioctl 400448c8 200002c0 returned -22 [ 954.842945] XFS (loop6): SB sanity check failed [ 954.847735] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 954.858068] binder: 15761:15793 BC_FREE_BUFFER u0000000000000000 no match [ 954.858963] XFS (loop6): Unmount and run xfs_repair [ 954.870867] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 954.877573] 0000000020ac6279: 58 46 53 42 00 00 10 00 00 00 04 0e 00 00 10 00 XFSB............ [ 954.886445] 00000000d3f2eade: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:13 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x88640000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 954.895335] 00000000d6e8887a: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 954.904213] 00000000bf0911df: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 954.913088] 00000000b9d2c4fc: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 954.921970] 0000000085d16537: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 954.930857] 00000000eaadb95b: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 954.935086] binder: 15761:15793 transaction failed 29189/-22, size 0-0 line 2852 08:56:13 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3100000000000000}, 0x0) 08:56:13 executing program 3: r0 = socket$inet6(0xa, 0x801, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) stat(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x8, &(0x7f00000001c0)=[0xee01, 0xee00, 0xee00, 0x0, 0xee01, 0x0, 0xffffffffffffffff, 0xee01]) write$P9_RGETATTR(r4, &(0x7f00000002c0)={0xa0, 0x19, 0x2, {0x10e, {0x0, 0x3, 0x1}, 0x20, r5, r6, 0x6, 0x8000, 0x8001, 0x3, 0x2, 0x6, 0x9, 0x1, 0x800, 0x6, 0x0, 0x3, 0x1ff, 0x3, 0x4}}, 0xa0) r7 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_ADD(r4, 0x4c80, r7) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r8, 0x2007fff) sendfile(r3, r8, &(0x7f0000d83ff8), 0x8000fffffffe) getsockopt$IP6T_SO_GET_INFO(r8, 0x29, 0x40, &(0x7f0000000440)={'mangle\x00'}, &(0x7f00000004c0)=0x54) 08:56:13 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x900000000000000}, 0x0) [ 954.939741] 00000000ed76c94e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 954.956901] XFS (loop6): SB validate failed with error -117. 08:56:13 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000004c000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x60}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 955.064265] binder: 15761:15823 ioctl 400448c8 200002c0 returned -22 [ 955.099317] binder: undelivered TRANSACTION_ERROR: 29189 [ 955.104969] binder: undelivered TRANSACTION_ERROR: 29189 [ 955.130210] XFS (loop6): SB sanity check failed [ 955.135017] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 955.146166] XFS (loop6): Unmount and run xfs_repair [ 955.151246] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 955.157949] 000000007d4016c0: 58 46 53 42 00 00 10 00 00 00 4c 00 00 00 10 00 XFSB......L..... [ 955.166845] 0000000080b48e1a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 955.175737] 000000000c8dd984: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 955.184626] 0000000015c4947a: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 955.193489] 00000000751d6a3c: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 955.202348] 0000000088b9d973: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 955.211213] 00000000112497c6: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 955.220099] 00000000dc558d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 955.229025] XFS (loop6): SB validate failed with error -117. 08:56:13 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$KVM_PPC_GET_SMMU_INFO(r1, 0x8250aea6, &(0x7f0000000040)=""/107) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:13 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x20480], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0xffffffff, 0x80) futimesat(r3, &(0x7f0000000100)='./bus\x00', &(0x7f0000000140)={{0x77359400}, {0x0, 0x2710}}) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r1, &(0x7f00000001c0), 0xfffffffffffffeb4, 0x4000, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @mcast1={0xff, 0x1, [], 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:13 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x100000}, 0x0) 08:56:13 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000000)={{&(0x7f0000ffb000/0x3000)=nil, 0x3000}, 0x1}) r2 = syz_open_dev$adsp(&(0x7f0000000040)='/dev/adsp#\x00', 0x8, 0x280600) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000180)={0xffffffffffffffff}, 0x111, 0xc}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r2, &(0x7f0000000200)={0xb, 0x10, 0xfa00, {&(0x7f00000000c0), r3, 0x81b}}, 0x18) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="116348400000000000000000000000000000000000000000000000000000000000000000000000000000009710d2a69f67a3e200", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x20000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:13 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000006c100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:13 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x3000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:13 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xffffff7f}, 0x0) 08:56:13 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xfffff000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) write$P9_RCLUNK(r4, &(0x7f0000000200)={0x7, 0x79, 0x1}, 0x7) ioctl$KVM_S390_INTERRUPT_CPU(r4, 0x4010ae94, &(0x7f00000001c0)={0x4, 0x6, 0x2}) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f0000000140)={0x10203, 0x0, &(0x7f0000ffa000/0x4000)=nil}) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) accept$inet6(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0, @local}, &(0x7f0000000100)=0x1c) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 955.698837] binder: 15851:15853 BC_FREE_BUFFER u0000000000000000 no match [ 955.726326] binder: 15851:15853 transaction failed 29189/-22, size -7566047373982433280-63793010192077328 line 2852 [ 955.789784] XFS (loop6): SB sanity check failed [ 955.794612] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 955.805785] XFS (loop6): Unmount and run xfs_repair [ 955.810847] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 955.817585] 000000006c3c418a: 58 46 53 42 00 00 10 00 00 00 00 00 00 6c 10 00 XFSB.........l.. [ 955.826469] 00000000b7830772: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:14 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xf0ffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 955.835356] 00000000f23ec904: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 955.844251] 00000000da9c07ea: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 955.853139] 0000000033639cc0: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 955.862055] 0000000076acd213: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 955.870933] 00000000a6f5cfe2: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 955.876670] binder: undelivered TRANSACTION_ERROR: 29189 08:56:14 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$inet_dccp(0x2, 0x6, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000180)={0x2, 0x7, 0x4, 0x0, 0x0, [{r0, 0x0, 0x2}, {r0, 0x0, 0xffffffff}, {r0, 0x0, 0x4ee5}, {r0, 0x0, 0x9}]}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet6_buf(r0, 0x29, 0xd3, &(0x7f00000000c0)=""/129, &(0x7f0000000000)=0x81) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:14 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000000c0)={0x0, 0x8}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000140)={r5, 0x1ff, 0x0, 0x80000000, 0x3, 0xbac53b5}, 0x14) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) 08:56:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x40000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 955.879816] 00000000a6ad3a88: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 955.894413] XFS (loop6): SB validate failed with error -117. [ 955.959210] binder: 15898:15899 BC_FREE_BUFFER u0000000000000000 no match [ 955.988482] binder: 15898:15899 transaction failed 29189/-22, size 0-0 line 2852 [ 956.026612] binder: 15898:15909 BC_FREE_BUFFER u0000000000000000 no match [ 956.042106] binder: 15898:15909 transaction failed 29189/-22, size 0-0 line 2852 [ 956.051239] binder: undelivered TRANSACTION_ERROR: 29189 [ 956.056861] binder: undelivered TRANSACTION_ERROR: 29189 08:56:14 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) epoll_create(0xfff) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:14 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x80350000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:14 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x5900}, 0x0) 08:56:14 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000034100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:14 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x3e, 0x22500) write$sndseq(r1, &(0x7f00000002c0)=[{0x7, 0x100000000, 0x3, 0xffff, @tick=0x81, {0x3, 0x1}, {0xe3, 0x9}, @quote={{0x3f, 0x100}, 0x8000, &(0x7f0000000200)={0x9, 0xa822, 0x2, 0x7fff, @time={0x0, 0x1c9c380}, {0x4}, {0x1, 0x7}, @raw32={[0x3, 0xf65d, 0x8001]}}}}, {0x0, 0x7, 0x6, 0xaea3, @time, {0x522d, 0x3}, {0x2, 0x5}, @connect={{0x1, 0x8}, {0x99, 0x1}}}, {0x1, 0x3, 0x1, 0x5, @tick=0x1f, {0x2, 0x5c}, {0x265, 0x41701278}, @raw8={"b6f7a3c12713dfa2394f34a3"}}, {0x8001, 0x3, 0x64, 0x3, @time, {0xc01, 0x8}, {0x4, 0x2}, @result={0x678, 0x6}}], 0xc0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000380)=@assoc_value={0x0}, &(0x7f00000003c0)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000000440)=@assoc_value={r6, 0x3ff}, 0x8) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) ioctl$RTC_IRQP_READ(r5, 0x8008700b, &(0x7f0000000240)) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) getsockopt$inet6_buf(r5, 0x29, 0xff, &(0x7f00000000c0)=""/65, &(0x7f0000000140)=0x41) sendfile(r4, r7, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:14 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000000)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000040)={0x8}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:14 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:14 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8035], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 956.624765] binder: 15921:15928 BC_FREE_BUFFER u0000000000000000 no match 08:56:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x3}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:14 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x11}, 0x0) 08:56:14 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r4, 0x80045700, &(0x7f00000000c0)) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 956.673675] binder: 15921:15928 transaction failed 29189/-22, size 0-0 line 2852 [ 956.689734] XFS (loop6): SB sanity check failed [ 956.694577] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 956.705780] XFS (loop6): Unmount and run xfs_repair [ 956.709843] binder: undelivered TRANSACTION_ERROR: 29189 [ 956.710841] XFS (loop6): First 128 bytes of corrupted metadata buffer: 08:56:14 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x1b9, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @free_buffer={0x40086303, r2}], 0xffffffffffffffa6, 0x0, &(0x7f0000000680)}) [ 956.722996] 00000000bf9f4e13: 58 46 53 42 00 00 10 00 00 00 00 00 00 34 10 00 XFSB.........4.. [ 956.731912] 00000000865af2b2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 956.740833] 000000006fed9069: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 956.749735] 00000000587ac564: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 956.758633] 0000000085adc51a: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:15 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8906], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 956.767537] 000000001ba4eba8: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 956.776421] 00000000aebb633a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 956.785342] 000000002aeb7c2b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 956.794489] XFS (loop6): SB validate failed with error -117. [ 956.811649] binder: 15952:15958 BC_FREE_BUFFER u0000000000000000 no match 08:56:15 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x31}, 0x0) 08:56:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6c00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 956.848118] binder: 15952:15958 BC_FREE_BUFFER u0000000000000000 no match [ 956.855276] binder: 15952:15958 unknown command 0 [ 956.879995] binder: 15952:15958 ioctl c0306201 20000000 returned -22 [ 956.902530] binder: 15952:15970 BC_FREE_BUFFER u0000000000000000 no match [ 956.911527] binder: 15952:15970 BC_FREE_BUFFER u0000000000000000 no match [ 956.918583] binder: 15952:15970 unknown command 0 [ 956.925783] binder: 15952:15970 ioctl c0306201 20000000 returned -22 08:56:15 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000000c0)="0281c83d6d345f8f76207030f9987d65770e1130d457d166bcc71b5e4817e718518bb586a5f5e3ca0ce393e6803054a3587d7de6086bdd2ffe628d8afc7b7bdcb89987ff5f16173621617ba02a6738ce2ddcc2b11994ddc70a85ac19283b8effddcf7656a8c219fd6953a955122ee90d268907804123895fdb4389a12e00000000000000000000000000000000c3786cb8c6c1a2dbd24519b7706e83d76d22563ef00916103381f63ac790e2414f31bed9e0263b6e7a9db315fc15e671d0591770d8d503e6372199ef1143de37e02100000000000000000000000000000000") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\a\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:15 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x44], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:15 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:15 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x10000000000}, 0x0) 08:56:15 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000140)=0x9, 0x4) r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r5, 0x0, 0x489, &(0x7f00000000c0)={{0x0, @multicast1=0xe0000001, 0x4e20, 0x2, 'nq\x00', 0x1, 0x1f, 0x65}, {@empty, 0x4e23, 0x0, 0x200, 0x2, 0x5}}, 0x44) ioctl$TCSBRK(r4, 0x5409, 0xeb) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) socket$inet6(0xa, 0x7, 0x1) 08:56:15 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000003fa100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x48}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:15 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:15 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x600000000000000}, 0x0) 08:56:15 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x43}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 957.544497] binder: 15994:15997 BC_FREE_BUFFER u0000000000000000 no match [ 957.582226] binder: 15994:15997 transaction failed 29189/-22, size 0-0 line 2852 [ 957.606550] binder: undelivered TRANSACTION_ERROR: 29189 [ 957.608425] XFS (loop6): SB sanity check failed [ 957.616960] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 957.628098] XFS (loop6): Unmount and run xfs_repair [ 957.633160] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 957.639876] 000000002556d81c: 58 46 53 42 00 00 10 00 00 00 00 00 03 fa 10 00 XFSB............ [ 957.648789] 000000001fcf0cfe: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 957.657669] 00000000b2a60838: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 957.666596] 0000000094f58004: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 957.675501] 00000000be48c857: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 957.684390] 00000000f93b1190: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 957.693287] 00000000e4c6675a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... 08:56:15 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="0005000010000000"], 0x0, 0x0, &(0x7f0000000680)}) 08:56:15 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x9], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:15 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='syz_tun\x00', 0xffffffffffffff9c}, 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x2c, &(0x7f0000000140)=[@in6={0xa, 0x4e24, 0x10000, @mcast2={0xff, 0x2, [], 0x1}, 0x1f}, @in={0x2, 0x4e21, @rand_addr=0x20}]}, &(0x7f0000000200)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000240)={0x4, 0xfffffffffffffff9, 0x0, 0x3ff, 0x800, 0x4, 0x8, 0x8, r4}, 0x20) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) syncfs(r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r5, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:15 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x5000000}, 0x0) 08:56:15 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x200000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 957.702176] 000000004e125b5d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 957.711156] XFS (loop6): SB validate failed with error -117. [ 957.726634] binder: 16023:16025 BC_FREE_BUFFER u0000000000000000 no match 08:56:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x74}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:16 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e21, 0x0, @dev={0xfe, 0x80, [], 0x1a}, 0x1}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 957.772554] binder: 16023:16025 transaction failed 29189/-22, size 0-0 line 2852 08:56:16 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xf401}, 0x0) [ 957.837460] binder: undelivered TRANSACTION_ERROR: 29189 08:56:16 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r1) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000100)={&(0x7f0000000240)=""/244, 0x20000, 0x800, 0x800}, 0x18) read(r1, &(0x7f00000001c0)=""/105, 0x2e7) exit(0x9) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000040)={{0xfff, 0xfffffffffffffe00, 0xdf1b, 0x200, 0x20, 0xffffffffffff0000}, 0x9, 0x6, 0xdd69, 0x1, 0x3, "fdd48bb6047180e715a9b0da063dc1b413f76453e77bdcfd27aa1766c3a7cd474dfee7e2dd0253ca186529ed296d40a696e0715d942d6aa3d69f0e06fdc9bbc587ae909d387ff8bd1d15b5359b00e6e34ff2c9750953ffa912cd428de7f16a55618ec8a652259754b98d28664f80d9ebba932e1696a80dc824dfbf3cda23e070"}) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:16 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000180100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:16 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xe803], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:16 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="116348400100000000000000f57097232670ba572e7800000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6800000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:16 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = getpgrp(0x0) waitid(0x1, r4, &(0x7f0000000400), 0x0, 0x0) r5 = dup(r3) syncfs(r3) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, &(0x7f00000002c0)="6bcc6cb3063fc5d61ec383215af8fd520db9d6ecda1f9386a9e1f4451fc39075ab99dd1ceac7666450220761c7dcc451c2f9d73007c22b28f80393f539afdc6c77c9ae3dd1e2e9e0c6486c449ba910f62ceb55eb16cebf24207d0d02823d7a463e3832aa4e0f0fb7fd374bc4e10e766a604b72e142797f6f4d37d761eac3f1bec5d3529ba3767cf29f49f3eb13356a90aa897dbc3cd613450a96f03b54ea0017d5e3733145e85beaca58b8aed06a3904f1293f050190eb47ae8093b8c505261c6823b064e2a6c5cc59e715d6294e19168d12e8d27e0bdb0699fd2e2c") ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000000c0)=0x0) ptrace$cont(0x9, r6, 0x6, 0x40) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) ftruncate(r0, 0x2007e00) sendfile(r3, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x8000fffffffe) clone(0x40000, &(0x7f00000001c0)="dea3806ec236dad67459169198a3a53b3eb8d1c7638bbcfd5c7e4e8c849281fe4380b250e14fd5585f33e347617c71b6b0f621682c534929858618429981b8f71e4897eb11cdd3818142d5d32cbbd796a7cf96ecc81d888bca969a76912e6244935d4cbe4a35ca11aa881c19d835acc5f78d61c56d0b432a3de44cc3dfb04e1f08dccfdbda352d6136f3", &(0x7f0000000100), &(0x7f0000000140), &(0x7f00000003c0)="1b17e81a1925b144ab44df46851073ba32a72d8f9a7395df971eda36525466592790156f2a9479d13467f54a26f97b347852") 08:56:16 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3100}, 0x0) 08:56:16 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) [ 958.478436] binder: 16073:16074 BC_FREE_BUFFER u0000000000000000 no match [ 958.485483] binder: 16073:16074 got transaction to invalid handle [ 958.491783] binder: 16073:16074 transaction failed 29201/-22, size 0-0 line 2852 [ 958.501361] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:16 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8848], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:16 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xfffffffe}, 0x0) [ 958.525054] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 958.555075] binder: undelivered TRANSACTION_ERROR: 29201 08:56:16 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xf401], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:16 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:16 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) [ 958.601517] XFS (loop6): SB sanity check failed [ 958.606365] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 958.617679] XFS (loop6): Unmount and run xfs_repair [ 958.622753] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 958.629742] 000000000846a190: 58 46 53 42 00 00 10 00 00 00 00 00 01 80 10 00 XFSB............ [ 958.638637] 00000000a036895d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:16 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0xf, 0xee9) fchdir(r1) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r1) syncfs(r3) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e22, 0x4, @mcast2={0xff, 0x2, [], 0x1}}, @in={0x2, 0x4e21, @remote={0xac, 0x14, 0x14, 0xbb}}, @in6={0xa, 0x4e20, 0xc0, @empty, 0xffffffff}], 0x48) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) sendfile(r0, r0, &(0x7f0000000140), 0x3) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) signalfd(r1, &(0x7f0000000200)={0x1}, 0x8) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='\x00\x00\x00\x00\x00\x00+\f\x00', 0x336) setsockopt$RDS_GET_MR_FOR_DEST(r4, 0x114, 0x7, &(0x7f0000000380)={@pppol2tpv3in6={0x18, 0x1, {0x0, r4, 0x1, 0x2, 0x0, 0x1, {0xa, 0x4e23, 0x2, @ipv4={[], [0xff, 0xff], @remote={0xac, 0x14, 0x14, 0xbb}}}}}, {&(0x7f00000002c0)=""/156, 0x9c}, &(0x7f0000000240), 0x40}, 0xa0) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) socketpair$inet6_dccp(0xa, 0x6, 0x0, &(0x7f0000000180)) [ 958.647527] 00000000f9811553: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 958.656427] 000000001f7898d0: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 958.665335] 00000000976310f2: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 958.673453] binder: 16107:16109 BC_FREE_BUFFER u0000000000000000 no match [ 958.674214] 00000000705eb6a5: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 958.674232] 00000000b6b87a3e: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... 08:56:16 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xfffffff5}, 0x0) 08:56:16 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x4400], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 958.698926] 0000000017af60f9: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 958.709523] XFS (loop6): SB validate failed with error -117. [ 958.735151] binder: 16107:16109 transaction failed 29189/-22, size 0-0 line 2852 [ 958.764151] binder: undelivered TRANSACTION_ERROR: 29189 08:56:17 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4300}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:17 executing program 0: r0 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x9, 0x10100) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000040), &(0x7f00000000c0)=0x4) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000180), 0xffffffd5, 0x0, &(0x7f0000000680)}) 08:56:17 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x103000000000000}, 0x0) 08:56:17 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) mbind(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8000, &(0x7f0000000040)=0xc4ed, 0x8, 0x2) tkill(r0, 0x15) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x1, 0x3}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000000c0)={r2, 0x2, 0x8ca}, 0x8) 08:56:17 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x86ddffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:17 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000035a0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:17 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:17 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0xfffffffe, &(0x7f00000000c0)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ashmem\x00', 0x0, 0x0) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:17 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xd000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:17 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x100000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:17 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="0400000000004f00"], 0x0, 0x0, &(0x7f0000000680)}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x100, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r2, &(0x7f00000002c0)={0x16, 0x98, 0xfa00, {&(0x7f0000000240)={0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0x10, 0x0, @ib={0x1b, 0x7, 0x5, {"6fd14f1aeb826fba2f7d340da1f2fc2f"}, 0x5, 0x7fff, 0x101}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000380)={0x11, 0x10, 0xfa00, {&(0x7f0000000200), r3}}, 0x18) r4 = getpgid(0xffffffffffffffff) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f00000000c0)={{0x4, 0x1, 0x81, 0x4, '\x00', 0x1}, 0x2, 0x3, 0xb80, r4, 0x2, 0xffffffffffffff30, 'syz1\x00', &(0x7f0000000040)=['\\\x00', 'vboxnet0::posix_acl_access\x00'], 0x1d, [], [0x3c70, 0xe2b, 0x80000000, 0xffffffffffff5daf]}) 08:56:17 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xffffffff00000000}, 0x0) 08:56:17 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) accept$inet6(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0, @local}, &(0x7f0000000100)=0x1c) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:17 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 959.700213] XFS (loop6): SB sanity check failed [ 959.705011] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 959.716223] XFS (loop6): Unmount and run xfs_repair [ 959.721283] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 959.721881] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 959.727986] 00000000a5734b2c: 58 46 53 42 00 00 10 00 00 00 03 5a 00 00 10 00 XFSB.......Z.... [ 959.727997] 000000008afbf477: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 959.728017] 00000000dad6e051: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 959.761569] binder: 16176:16177 BC_FREE_BUFFER u0000000000000000 no match [ 959.761954] 0000000025f3fd1e: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 959.777745] 000000007727ed74: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 959.785339] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:18 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8864000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 959.786617] 00000000d1dc953f: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 959.786629] 00000000b7b535e7: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 959.786641] 00000000701ac92c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 959.813783] XFS (loop6): SB validate failed with error -117. [ 959.826636] binder: 16176:16177 transaction failed 29189/-22, size 0-0 line 2852 08:56:18 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xfeffffff00000000}, 0x0) 08:56:18 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xfffff000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:18 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e20, 0x3, @mcast1={0xff, 0x1, [], 0x1}, 0x30}, 0x1c) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) getsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@loopback}}, &(0x7f00000000c0)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000100)={@loopback={0x0, 0x1}, r6}, 0x14) [ 959.855678] binder: 16176:16192 BC_FREE_BUFFER u0000000000000000 no match [ 959.873326] binder: 16176:16192 transaction failed 29189/-22, size 0-0 line 2852 08:56:18 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x700000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 959.901142] binder: undelivered TRANSACTION_ERROR: 29189 [ 959.906688] binder: undelivered TRANSACTION_ERROR: 29189 08:56:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x400300}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:20 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80000, 0x0) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000040)={@local={0xac, 0x14, 0x14, 0xaa}, @broadcast=0xffffffff, 0x1, 0x2, [@loopback=0x7f000001, @local={0xac, 0x14, 0x14, 0xaa}]}, 0x18) 08:56:20 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) ioctl$sock_proto_private(r1, 0x89e2, &(0x7f0000000040)="367568afc1") tkill(r0, 0x9) 08:56:20 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xffffff7f00000000}, 0x0) 08:56:20 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000006c000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:20 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$TCSBRKP(r4, 0x5425, 0x5) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$FIBMAP(r3, 0x1, &(0x7f00000000c0)=0x7) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000100)=0x1) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:20 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:20 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x2800], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:20 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xffffca88], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:20 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x400000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 962.649778] binder: 16226:16230 BC_FREE_BUFFER u0000000000000000 no match [ 962.676319] binder: 16226:16230 transaction failed 29189/-22, size 0-0 line 2852 08:56:20 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x10000000}, 0x0) 08:56:20 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r4, 0x4018aee3, &(0x7f0000000100)={0x0, 0x4, 0x47, &(0x7f00000000c0)=0x4}) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 962.715753] binder: 16226:16230 BC_FREE_BUFFER u0000000000000000 no match [ 962.746212] XFS (loop6): SB sanity check failed [ 962.751034] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff 08:56:21 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x7000000}, 0x0) [ 962.762261] XFS (loop6): Unmount and run xfs_repair [ 962.767331] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 962.774054] 00000000087f3723: 58 46 53 42 00 00 10 00 00 00 6c 00 00 00 10 00 XFSB......l..... [ 962.782926] 0000000007620160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 962.788164] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 962.791800] 0000000061f87aeb: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 962.791811] 0000000077fa79df: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 962.791822] 00000000cb116185: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 962.791831] 000000007e8084a3: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 962.791847] 00000000eb4ed452: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 962.822350] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 962.825846] 000000008da09a53: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 962.825911] XFS (loop6): SB validate failed with error -117. 08:56:21 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x88caffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 962.837363] binder: 16226:16230 transaction failed 29189/-22, size 0-0 line 2852 [ 962.886786] binder: undelivered TRANSACTION_ERROR: 29189 08:56:21 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xffffffc0}, 0x0) 08:56:21 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x400000001) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:21 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000031f0c100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:21 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r0, 0x11) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) setsockopt$bt_rfcomm_RFCOMM_LM(r4, 0x12, 0x3, &(0x7f0000000100)=0x28, 0x4) mkdir(&(0x7f00000000c0)='./bus\x00', 0x50) [ 962.920413] binder: undelivered TRANSACTION_ERROR: 29189 [ 963.034771] binder: 16272:16274 BC_FREE_BUFFER u0000000000000000 no match [ 963.044297] binder: 16272:16274 transaction failed 29189/-22, size 288230376151711744-0 line 2852 [ 963.074199] binder: undelivered TRANSACTION_ERROR: 29189 [ 963.082754] XFS (loop6): SB sanity check failed [ 963.087569] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 963.098734] XFS (loop6): Unmount and run xfs_repair [ 963.103795] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 963.110533] 00000000d97e2fd9: 58 46 53 42 00 00 10 00 00 00 00 03 1f 0c 10 00 XFSB............ [ 963.119421] 00000000cab1a643: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 963.128358] 00000000f345b1c5: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 963.137224] 00000000329aadf7: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 963.146091] 00000000cf4162db: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 963.154963] 000000000c0f03f8: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 963.163839] 00000000268a5d89: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 963.172702] 00000000b7a36cfb: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 963.181821] XFS (loop6): SB validate failed with error -117. 08:56:21 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xa8aaaafffeaaaaaa}, 0x0) 08:56:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7400000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:21 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4, 0x102010, r1, 0x5d) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x3d) 08:56:21 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8848000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:21 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0), 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:21 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x4) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) ioctl$int_out(r2, 0x5460, &(0x7f00000000c0)) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:21 executing program 0: r0 = socket$inet6(0xa, 0x1000000000000, 0xfffffffffffffffb) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet6_dccp_int(r0, 0x21, 0x1, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:21 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000324100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:21 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x8906000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:21 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x100000000000000}, 0x0) 08:56:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7400}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 963.536705] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 963.560575] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:21 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3f000000}, 0x0) 08:56:21 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x10000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:21 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x68}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 963.635099] binder: 16329:16331 BC_FREE_BUFFER u0000000000000000 no match [ 963.665132] binder: 16329:16331 transaction failed 29189/-22, size 0-0 line 2852 08:56:21 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000000c0)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:21 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x500}, 0x0) [ 963.708135] binder: 16329:16352 BC_FREE_BUFFER u0000000000000000 no match [ 963.736232] binder: 16329:16352 transaction failed 29189/-22, size 0-0 line 2852 [ 963.745753] XFS (loop6): SB sanity check failed 08:56:22 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x81000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 963.750569] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 963.761724] XFS (loop6): Unmount and run xfs_repair [ 963.766789] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 963.773525] 0000000078482f34: 58 46 53 42 00 00 10 00 00 00 00 00 03 24 10 00 XFSB.........$.. [ 963.782408] 00000000ebb65027: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 963.791311] 00000000bcddf82c: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. 08:56:22 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x2000000}, 0x0) [ 963.800220] 000000009df77f2e: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 963.807597] binder: undelivered TRANSACTION_ERROR: 29189 [ 963.809114] 000000000cf641ac: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 963.809124] 000000005c955551: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 963.809134] 0000000020985dce: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 963.809144] 00000000a8a0746d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 963.850562] XFS (loop6): SB validate failed with error -117. [ 963.911462] binder: undelivered TRANSACTION_ERROR: 29189 08:56:22 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x2c) 08:56:22 executing program 0: r0 = syz_open_dev$mouse(&(0x7f0000000180)='/dev/input/mouse#\x00', 0x1, 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200)=0x1c) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0xb, 0x4, &(0x7f0000000240)=@raw=[@map={0x18, 0x5, 0x1, 0x0, 0xffffffffffffff9c}, @initr0={0x18, 0x0, 0x0, 0x0, 0xc00a, 0x0, 0x0, 0x0, 0x1}], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xc2, &(0x7f0000000300)=""/194, 0x0, 0x1, [], 0x0, 0xd}, 0x48) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000480)={r1, r2}) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer\x00', 0x100, 0x0) ioctl$TIOCSSOFTCAR(r4, 0x541a, &(0x7f0000000140)=0x1ff) ioctl(r3, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r5 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) r6 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x0, 0x220800) getpeername$packet(r6, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000000c0)=0x14) sendmsg$xdp(r0, &(0x7f00000008c0)={&(0x7f00000004c0)={0x2c, 0x2, r7, 0x1a}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000580)="8eb4af9e9a8c6ba5bd57473fd14ab14f136857ba2caf3c4ae2a46291cf333ee868ba37d2e4963ae62c6f85448c4ef36dbbd2dce0955c3a9ecec8ad3559b9427f6c82c45c2405e94c3d4436f2630c2dcb9b0fcf994ad6cacd9a726a0b08bdae3da5210a5e02d8acf9c9e3928ccc8c74f6d140dc56982f09c26e6075f9e04c25561c1e17511b3fc3daaa4e7d4e6a4310c5d5b48eee63b7669a4a355f1bed10d92bd7cfd848597998f84a6dce59448d35e14e88ddd91c905bddc0895a5c846ee449c62366e523b8427e4d034a8c58c64d02c4ad86de44f5c1554587ad8beb6e1df29b705d4977d5325238656c384994828a", 0xf0}, {&(0x7f0000000680)="97ef2b8e6d8b3f635224bf6fd0bfbb3312b444ac1649464b5b2d50ddec826d7c0c65628bc76abbae8686c6e74eff7583", 0x30}, {&(0x7f0000000740)="6db21e0d9afd8fe4018a63bb1d765c2acf14ffaebe2b70b9399a59734b4fcd97e3b15c0c549f509d3662b101c9e35f4376cd281f22df47dd6e91c8a1e09158f5cc812c828a8cfdc4757f32c4ebcf7f8d3740ef2971a2685741803dabf3f343daedb8c069d6d230f0b2d9bb3854255d9cdf651f1f2190f150df8e092cad2cd12412a6e144e4b4578bf5cbbe5b8b3db9d4e65507a9dc1f", 0x96}, {&(0x7f0000000800)="080e958a31e7d67e6802bc86c612b416a7bea4fbdd15cdafba3ac9718e9bb85ddfec0b3fc30fd39b00ce9befa6dafdb0607fa51ef8d44e5793dde73dc45de8973367f7186ac81c488cfa5da331d7eeff9a6afee2b66836295fd6d2d63ad73f55b3776dc76cb50ec2567c671016bb7017768fbbd2e695f7f8882b934ba301bcd96cd72d1bba1482c39c80668b545473", 0x8f}], 0x4, 0x0, 0x0, 0x20000000}, 0x4000) [ 964.404735] binder: 16386:16387 BC_FREE_BUFFER u0000000000000000 no match [ 964.411844] binder: 16386:16387 transaction failed 29189/-22, size 0-0 line 2852 [ 964.426777] binder: 16386:16387 BC_FREE_BUFFER u0000000000000000 no match [ 964.434015] binder: 16386:16387 transaction failed 29189/-22, size 0-0 line 2852 [ 964.443121] binder: undelivered TRANSACTION_ERROR: 29189 [ 964.448942] binder: undelivered TRANSACTION_ERROR: 29189 08:56:22 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0), 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:22 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x7, @mcast2={0xff, 0x2, [], 0x1}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) accept(r3, &(0x7f00000000c0)=@ipx, &(0x7f0000000140)=0x80) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7a}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:22 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x300}, 0x0) 08:56:22 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x700], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:22 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000000d100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:22 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x146) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r2, 0x4010ae74, &(0x7f0000000040)={0x6, 0x13, 0x1f}) 08:56:22 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x5], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:22 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x700}, 0x0) 08:56:22 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x700000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 964.618563] binder: 16397:16398 BC_FREE_BUFFER u0000000000000000 no match [ 964.650523] binder: 16397:16398 transaction failed 29189/-22, size 0-0 line 2852 [ 964.684990] binder: 16397:16398 BC_FREE_BUFFER u0000000000000000 no match [ 964.687552] XFS (loop6): SB sanity check failed [ 964.696794] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 964.707941] XFS (loop6): Unmount and run xfs_repair [ 964.712996] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 964.717856] binder: 16397:16398 transaction failed 29189/-22, size 0-0 line 2852 08:56:23 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) ioctl$KDGKBMODE(r5, 0x4b44, &(0x7f00000000c0)) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:23 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x4}, 0x0) [ 964.719720] 00000000a04bef50: 58 46 53 42 00 00 10 00 00 00 00 00 00 0d 10 00 XFSB............ [ 964.736133] 00000000c316e0b9: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 964.737111] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 964.745043] 0000000058e3ca23: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 964.758257] binder: undelivered TRANSACTION_ERROR: 29189 [ 964.761269] 00000000e619dcc6: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 964.761278] 00000000ab220f61: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:23 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair(0x11, 0x4, 0x1a, &(0x7f0000000000)) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="1163484000000000000000000000000000000000000000000000000000000000000000000900000000000000000000005928bb188282a2c9b15c6400000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) [ 964.761287] 0000000001836b3b: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 964.761296] 000000005ecb7171: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 964.761305] 0000000082a63b49: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 964.761482] XFS (loop6): SB validate failed with error -117. [ 964.790841] binder: undelivered TRANSACTION_ERROR: 29189 08:56:23 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x7], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 964.846462] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 964.875339] binder: 16441:16442 BC_FREE_BUFFER u0000000000000000 no match [ 964.923094] binder: 16441:16442 transaction failed 29189/-22, size 9-1782062440272363520 line 2852 [ 964.968139] binder: 16441:16454 BC_FREE_BUFFER u0000000000000000 no match [ 964.975419] binder: 16441:16454 transaction failed 29189/-22, size 9-1782062440272363520 line 2852 [ 964.985890] binder: undelivered TRANSACTION_ERROR: 29189 [ 964.991426] binder: undelivered TRANSACTION_ERROR: 29189 08:56:23 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000a40)='/dev/ppp\x00', 0x509240, 0x0) r2 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) preadv(r2, &(0x7f0000000980)=[{&(0x7f0000000340)=""/61, 0x3d}, {&(0x7f0000000380)=""/68, 0x44}, {&(0x7f0000000480)=""/150, 0x96}, {&(0x7f0000000540)=""/120, 0x78}, {&(0x7f00000005c0)=""/163, 0xa3}, {&(0x7f0000000680)=""/188, 0xbc}, {&(0x7f0000000740)=""/213, 0xd5}, {&(0x7f0000000400)=""/8, 0x8}, {&(0x7f0000000840)=""/65, 0x41}, {&(0x7f00000008c0)=""/166, 0xa6}], 0xa, 0x0) read(r2, &(0x7f00000001c0)=""/105, 0x69) write$P9_RSTAT(r2, &(0x7f0000000040)={0x61, 0x7d, 0x1, {0x0, 0x5a, 0x0, 0x80000000, {0x18, 0x3, 0x1}, 0x8000000, 0x7, 0x8, 0xe4, 0x0, "", 0xd, '/dev/usbmon#\x00', 0xd, '/dev/usbmon#\x00', 0xd, '/dev/usbmon#\x00'}}, 0x61) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) setsockopt$inet6_MRT6_ADD_MIF(r1, 0x29, 0xca, &(0x7f0000000c00)={0x0, 0x1, 0xffffffffffffff01, 0xb9d, 0x6}, 0xc) getsockopt$EBT_SO_GET_ENTRIES(r2, 0x0, 0x81, &(0x7f00000002c0)={'nat\x00', 0x0, 0x4, 0x4a, [], 0x9, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000240)=""/74}, &(0x7f0000000180)=0x78) tkill(r0, 0x15) write$RDMA_USER_CM_CMD_JOIN_MCAST(r1, &(0x7f0000000b00)={0x16, 0x98, 0xfa00, {&(0x7f0000000ac0)={0xffffffffffffffff}, 0x3, 0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x4e20, 0x1, @mcast2={0xff, 0x2, [], 0x1}, 0x6cc0}}}, 0xa0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r2, &(0x7f0000000bc0)={0x11, 0x10, 0xfa00, {&(0x7f0000000a80), r3}}, 0x18) 08:56:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf00000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 965.260410] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 965.270366] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:23 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0), 0x0) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:23 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000007c0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:23 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xa00000000000000}, 0x0) 08:56:23 executing program 3: ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r0 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r2 = socket$inet6(0xa, 0x80000, 0x36) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f00000029c0)='/dev/autofs\x00', 0x0, 0x0) r4 = dup(r2) ioctl$FIBMAP(r0, 0x1, &(0x7f00000000c0)=0x80000000) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0xa001, 0x0) renameat(r5, &(0x7f0000002940)='./bus\x00', r5, &(0x7f0000002980)='./bus\x00') sendmmsg(r5, &(0x7f0000002840)=[{{&(0x7f00000001c0)=@pptp={0x18, 0x2, {0x3, @remote={0xac, 0x14, 0x14, 0xbb}}}, 0x80, &(0x7f0000000880)=[{&(0x7f00000002c0)="22f7f5660b19538bedf262503e643e4d692afe9e9a824466c48fa918d959447e686f1af50ed37841e615a150b7870949177f291e630b97df799f9fab77fbd9e05875ea84ab8322ca3dcfcb19dcceb26b4962d4da0bbdda5ea4d0ed61b553e94fb00c6c31c89a2c8d4892e04a750e7b5a47f72d868a10b470cd64615e66d97b29dd7d41ba1ab091252f3ffd5a4f935a1efc", 0x91}, {&(0x7f0000000240)="c04bf89292b6fe97f673805d8e2fe5707bc5c960c1e220c88e", 0x19}, {&(0x7f0000000380)="c0da8d1a6d3ab23874390a36727d8f145f8ca4d747d4787383b4bb4dd55c", 0x1e}, {&(0x7f00000003c0)="a01ec35165eaccfd4255f085e9ef54cb99f292d6010682c4b7a6d7750c13254df28eca0c00ed85de85ae7b037c8bd711dba88fb37d5c4861776da5921c5777c5a2835676dc29cc4e880284e5b9ec4d67988e66e93047e76a544838e6cd2ea21c6ef8f977a742b9cea49f6200745be9e391668c37bff9c52bc94df83e4600f6dd6c92dd97f766f0a1040aa1ed634a94964a581ee1ac386b81af02dc939a15381a2993f7935191eb15b92c9e84a4763a158774aadddb11536291", 0xb9}, {&(0x7f0000000480)="afb9c15175ae462f9c02d9e1d55c56fd98f8e9dd9971d5d3da43313276e3626aedd83250f383d19b9eee4c6cafe02436", 0x30}, {&(0x7f00000004c0)="a9d4c88022444eaaccfd3c59b19cad818f5fcf493f51505bfce6727fe90c1864fef7d0802daface5088b1e9b4289e0cdcd32fd1c8bf647462d74037613d7476443a50e6b960bb89b56fd222b2cd7eb4b46e249c528915be117b301cafb72f044b58504fa5a60ba1e0d5fbc65b5506175fab0c69822bb09d0899d99391b337cdb65017a040884a90faf020854efd99c59a80ae4fefd4117fb3d5c188057c946a24ff6146e8e8ad2fe0380442df2fd043da2afd3e4b4821c8046baafe7739286ac746e7c999203118960656456a04140d45cfd435e9ff4d3fc3e1ceb", 0xdb}, {&(0x7f00000005c0)="20d05b31bc2a5606bc19", 0xa}, {&(0x7f0000000600)="5c049f9926c8b1d5b78f04ba37a8b44fee0cd58732584e8e86394334de08cfb6e7983c28b616c451b74f22c71972d435ddb1ac2616fd0be768dbf926bd930b76ad7897af290972b39152ee7d7ec96c30011eb1524120d7404d8f8c4c7166c20cf6d5c45934a0d5436165e9f8b079f34e8f715b36634968da5a41d66900d830598a37b68548484d796f2622bdacc5a4ea0aa112563a3a50cac649b92bf9bd0f524d553f11903f8f01b2f408cf1485", 0xae}, {&(0x7f00000006c0)="8e88b7cff3552831bae68d8eb1be73439fd48625eae69e1a159997c40566fccb510947b1d8b6f18b0947614a9db36467b10ff81f5a5fb44e90dd759209aa53422e0904b9a0b69bbe3f8fa9ebd6b3cdc26ae6393a4867d1510e28bd339eb3801150610e41868a12466b02e7239ce4e01fd09d0fb21bcc6d87a9b0cd3ac72f99bbcba0c4daac5b8dff663fc4cca5f48428976e32dd", 0x94}, {&(0x7f0000000780)="be5d5d172128c2c06dec4b09ce944722f34f4d0327c257c2fa9fa7e4801b3f19522734d16127ea60b32fbbd6f9fad30f49a90be1872e475b46f18be823f8e3e4d8c8aaa48127ba5cd517cb0921c39dac464449ef54d16a91ce3009a6e39b36080782c7e2d4af7240ea8456c4691758f582350f1e8a1488b0db95b7bab58eba3e9c0a7a7f0f1ee993d5274569cff9162e9c231e0ff4f77e23745b88b7bf97124eb1a152a16a1d536e3c0100ea2a2b9c36c5b6c895e5f93c195a564a83f9dd56fa5fa6a23e8deb02d2f129daea3e0381eb", 0xd0}], 0xa, &(0x7f0000000940)=[{0x68, 0x105, 0x7a, "0b46c42cc11950b66a401c2b9bceb811a138c740db034242d04c5090ff202241061b81b78b42c4deb8a0a132a114d97852ae32027a88b31dde41e36ec9f0eba3f55cf9f8abde52be5f6b0c12e8ab7d6cb2738e"}, {0x108, 0x0, 0xcf1, "feb011986101f92da9a1a11c9023a3380f3af5efcc41a3a3cb3ebac5d2828f63b84bcc1060d897386cd39bd7c2cf4ebaf825bc0e485512542f4616354ce0591a1d9db72e38e49bf8173b8d7bff6b0612f018d82319f74b50e80ff719ed605efcef184163a70b4a41cda0bd230e7efd9a0dfad1631877ea0bcc63da63c18a5740fcbb6a2c3778aad164fa7ed3aee8df0252ec337e2b198c2fcc3eaa761590fe611028ea1f05cc61fd42bcae0368080a9d2f2bc2375035097a9a541da483dcaac6d76b01ed16d1b878d44c7ba092be0824dce2bdb63ff71aecb0b56c6d649d884d14c0b97f8311a345e7bb91c2f4be2aff2d2a7f6f3f64adc5"}, {0x28, 0x117, 0x9, "50892eb2cc6fc976e23b8cd2ab0b9e97c740bef94e"}, {0x1010, 0x110, 0xfffffffffffffffe, "4c2a58c4cb8efe27b21e8c5ef8006dc05faedcbffbc496957669b4cfd6383f0e357d26747b1aa6ca6508b75214f0ad01d743c623275e96d36d8a532a0bd4fcb1ebc39bcc78a36bcd30b86a7fbf8dc488a8f1fa9e1337318c531725e0354302d9e6e05abfbb3fa3c4e7174ec15855b0ed61469635e5edaa5a6865a294910d2bcf89a6989c4eb6d1809d5bfacd5a2756864224db55f5c1e0225ff0c0c934427973d9a2d77397edc259a684c6d4f273a2c6a4df669d721066d5f7dd41010132dc1c5de236a8d8b2885d973f87c65095ac7047e98e5a8ded5849c24a3c7d0b74eeab3159b4632fb6786ee6fa9a975c684fc0bc1993ccfeff1dffc896057c93ee2dc32ada8c1f7699f0c8c658010928c4170d2ed5dd76a30d716df1a3092f5355f9666b3d009b1e66d0a87e22e6208149c6e7e896f42bb4abd4bd652d01b60226890e02d1716fc4c87a27f610c3636500c3c9f28e66670b33683e4fc01c23ca8b9d2561402a6771ae0ef35ca2d21e06f2524b2ef9348906d274f0a540316b5e1083e9d1fd3fae707269aac56f7893ac693144c6d4f780ab46d0bee0fc57e9e59b8afe918d66a8f5b3e4efa15c8bcdc306a592eac3aea3d7725183e3fec5c3905c9fd93e4fb0cb97f0e414bed6e094ee34b00835ea1203e682299eee95a098ee3ab4b23ca9e6d0173cf0c151cde76ba9cdac3fe13ad34eb74d5afb4a91c172035d556691759167187aa0b0bed1bae15e51a46dbb44c73cd5e30754654ea616cae1449b1ed11bc53235cf662c1ca23759d3c439ca180376f662b2fc8a04dd16a8012adc3771c5a7f824744ba0a1b9d3620ec520d6428f6bbe5aedbf4f88e6d94870b310f34b5332f5095b1b5cdc1f1423384bfcd43dff262c0743845d1071a856450187c8556db0a3ad9dd9f95c93465c0c115b2d9821660c0746d634199a8367a91a1c0862a16f24171301774b7c1677aa2433f08c2c79e0273f3806c63dc111c5e08b7245836ae37a37389b32bf1d1841490120d58496b8424b4c79616b71a2190439afce8660b9b802c7f9e862fbbf45c1f7d718fedc91f85e4fb211961cad234185e1b8ae6b3c7aa701801166b3e5a524fa46f81303787f50978e00d2bc133b6d024ff2ec9fef5d409e94ed14f7ab76528b84ac2ca8b28a7e92b1689aadab487ff6927e7b332d6ed199f6259c397ef8c1e7f5ca3dc4a716243ce1a51e4dc18fd2effb62620605af22b41851920f9d607de1e5d1c1f63f67774cbe660c736a1d9eb73ad4d91e8cfcb0c2a64430f3f11d2ce91ebd80215b786a0306fa13956de51b132c9e07e62f872e3de7f77cff832a720dab6fcaaca28c5563c1946e47a214d085731bf49e27ee1b9bdbd8e543b363100e84a7ce893c586bdc79cd9d1e2d9b2a1bff5f83f50821ec10bcf1f418dad45ecb0ea64f32a78a77e2c350d248974a4453853dc0f48f76e700ac3ddf5a2352b52b48905c85dd8dfd8aff45d5f610857f6349f7c4aaf45c930e6e6e95c1f1c444a3ec61f5d32118fb2e333485033260298e346b7d43e5a34ccf5f98d3437b5788603165cc3380886a1c2ab897a097d45e535c8632563e47c6e30d9c867c9e66fc8d33c29e37e90c048702bf675cf0e1fc9cb30096f32b0ecda369609d65462f5668cf3d4bcf813ff83ac7845ad9f41cf9645ae3657946cfc30aa4c0ce75a43206f156bc09c6401c477ec5ced0c56f373a6558fea1bfb6fda7b13fe0a9927fee11a4c3734120a66b7379ac4c813c89b4ebd963f2577136da3264390c14f92a3ff758b420c690fc4ff8212956745cc1f5f0662eb0157349ba8bef2d3f6749f2bb7e34dfb1b7a01ccfafeec7e9fef01f03de2770cbfa3f0014c699bdbf63ee375a879f39cd8d7ced3fa90d6fd9df38dbf5fef37173c2af8c23e0f51795304548f35800a733480f3c44f3fee1f6b58066bcdc6918dfd109ad2789eb2e906c7d46bccea54c6f8aabd58ede55e3e0589ab80c694c7f20618e952aaa987517b613d3436d8149dfa9497ea9a17e0c030e49aec525e8e74b70793e52d8ef5f63bdd8d1b604ef2f98a80c8f6a0ca5b0c20e900476210153b9c30f7562d15fcf57dd6e26ed181f361af5e0262e4a65184b5413af1ea54c799c92ce1c562e1abddc407359b69d0996e414b2e9a1dd395f4ca281df455323f7bb06f5182b8ce019a556f88634029cd5f85cb7ff9e1d4d849c86095ec241f24fd44fde8f376b8ac7ac2cb153301263ce3f5437976bf13f665add9089627686febcc3959eda4f66fe64f2ba0c3ac10d99c0a569390406a345e9ddc78f8c46dd3d6728d78524449f3bc050d8d31ce825fa7565af96abb2893003867c03c51f179c101a7f08699d4cc379a2495ffcb056ad75f483a79059ddcdfa1be874fcd2a2edc6238eeccb790017df478aa13626564eb37ff101a86e02a7f70455ac300a607662eee653554d1a41373fadf7010455c4f2f0ac1b7aead41e37b4ce502289cc20cc0e21eff4d1b3c6b5b19a4205877589c56b130d1590f59e18b6358f531bf8edfb5d5a82adab82f92dc246b3e537a9e0008246125fa952aeea6ac62fc19a5b9b77b813b5a7505c2e2d2e06f77067046591f4f54a02b017d748e8b6663e0a765626b08b12c9d02b4b7a5408d081bb2aa6c54dbfe597fc79bd73c0b4affda1efbdae34ef23c5f434e3ad33d0820ec1268ef40844a735120b893ab170dbb24459f1f4b465c35c446f4894f1bed68a6459e5298c08beb1760d26a3b17d3f5ef022c9702481a687867072fd4064dcccfd79d635d55fd2e0c95bf7cc60ae467ea03f361fbd2c188a939c9214744a117bd556d0010dc47531aa31fb9ad2f8b9604d8376258186d7c5125febd54a8811bda4d2abc9168dca9173deb6d5ff5f6067ee6ec0fa3eaa66e504f0595cf187eb94424b909508edc58e525c4508bdc6bdd5e78b63a310f8a9e3bf79aa8b5990b348e1d1769058de42ff0d68a88240de259dbce0a0f75f114b791d6ef417bb426c0348a15a6ad89a2cef022f78edfc334e23a5b2e6adbb65eb7177151e136b47e8b29977e71a66338e411278d16ab69293c40011fbded3977c12bfdab8b5ec04a1ed161398462c4bd1b59babc926257b214c106316a8bf2be20e187471195ebeb8006b89e36fda5e86ad2bcc5a50c4d0f122a93ae1fe0d5b841780051c47a534ca2fa49ab49cce53d8ca14c4a01990770f31927166ea80152d137e6eab9de431f56ab6fbf96aa9281730a2df5a07bdbe85e3609199cf58035844918abdfd5fa09686be3c223feb3f52d4e8ace75db19eb8f5f4b9ad7f7c5b4313a9939385b5b5c8c12aab7e54502b7294b7deb15e5aa9b33d14019e85b148d314b3d41e591c83e3ac1246a60c0b6c27dc6ebb86aa4c4b9587fb359cb8c55a47d872fc5d3a34af1985cd85b368f4cec595c3250089d99a08830d34eea02e1bdbde9e40a6ff71ae02fac865a2f0d31e9a2c2a9723a06c5243ab636c3949d13e15a2e1e7261d2ef5fcdc77b7286368a4c2de88d5e832cd0dbb59f02838175efe237ae20e798e2047deb249382fe942b49196230940cdb781e60e88958f680192b01d3a5d5892d86701738a789af2f33fc7a320a5125d1b2390e58c806c1dec50af9da115dd9a6b9a8b825d36c66f2e2be3229f89571eaba61f37c5f55bdf6c04cae6717ac05ca7c3198d4bc5babb43f28dee44a42e657e6e151545a0d1ffda27f185f4a3b3fce66b675710c0cbb4127cd946f269a91eb97cebd11bd241e4b671522cccc718773238dfd8d28bcba5a58ae99934b7041b01f18500113029c3619db1840f6eb1591a8de3e95483c4467e701be94746c2e6de964bbfdb695d01021f97b89b1faedfe2d8558b4cbed711e3fd2e17d259d522517c18a18e5d65e4c854153af4a7e95379b6bf54d0d8439e4bed3f35f3b3792f20b30bdec444170381bec75071dbbf2cd2596ffd2121dbbcb4d3484cc903837d0df9b412d6a0215a1ed54ddf1892be701bd324fb6f6fef467b72fdda69fc66a16a5cbc35bd3e34d4cbb2426427bcd0fd5276d5c3d17a912a3345cfdeaa129451d3b6f4acffb1b03ad170060b5cef41129773d9cc113e0b7b27f15794654eaa71bb6c4fc7e8aa8f23b76bc06bd1af6709bf5003a90e3e122d2309463ad9b425c915ea2ed491800a4800e99e932dc83db9d0c9b3afac8f8479eed3326962c0cc0b02cdcbf7ebf208768e5284cebd669fdf6ac2435d058176696e29fb057321c9fb2a786051c1e9779c6c2bd5a0132f9409d26a02e52741c559b28ee9d95ff430c3ee8139cd89be7871ba26ccdd7699b3ebde23aed4436634eb211cebf1e7947b2c7f1504d3695a6aacfac9762933ef21b1720ad62bcaff0489fee0b4d5b500c48c7dd72c1524a7874e449feddfe9e28a87e9480f066eec2877885c49656e6789887e39845e5861e393bce363093c03a46cb8d52a7f249aa4a379981426b16e4c5d362758654c7d5cf8cbd78ef9a942e9160b46eeadfeaf1abe4e9b8d60f428ce13afde87c99f691e7f31eeefb8b59a10cc8d2f78799a4b3b4e3b8dd7e3375c2dbb28e6dff84f7e8e5ea0df59260d16bcb3776a25dcb7b6a61bf3679876386784595c55945f3047652ddac156c8cd8c99fc340a5033dd8d8e1d2756c50a58184b95fb576b1315500526f76412f947114d4b50d16b8d514e05f7e1d51013233880918129e2893da168360ab9d4861096735e04d5a15192406c4eaa28e148830812722e8bac65882fe3cdde141ba97c9e543e423d2cfded6745d23b83d4e1936312ab3bf427d34b85f0aa3650adbb402e945ce1ed36a580341d9767042f2c0cbf81b1666de8002045f4c278c7782db96fde68305b23c7d53cc3d76ac8b1f7f510e35473c87babeb3383e57190ffb51cc425218985a15943309351c500cd9aca4aebe48382db772b4a850cbf419933d2796ec52e01b2f0375bf9b64ff873be75b888771fc7320d8746d95d86b4d26a26a07043a95ffea29d4274893720fc2f7df355afe762dfe1b4e8d68f06c5e9f3d295d11b5faf0718a299c9f3fa29cd75b9141d50191cc957805ac4944966a4cd7ac318eb53c587e80bb40ad76006bf48a8da929ed66526633b09ddd87a80c8f4771712e5dd3170d3a74e88955bc8ed7b9dad6143c07b0ab5bb66d900f907614a7b464ef0cee9c86b3a807011c721419450bc5a1372e6c1a000ebe01861dd2d631c2e71f4bc3c99b20024cff2a32d9d2e2d7dfb5c3f5d70476f5c8a077758a89bda8098cd9c82cfe99814ab0c42baf66e1da64da45b0ee4faba26c350352809099e6eb6a4baad010011cfedffa5d3684aa21fd6a4ed8767fe6d9353c48ddef21d005ece94be0e7430bda10428f91314c692f4b3202130289e0bbbc2a67827d8b2c98ebfe3de5fdb792def36121cdda8204f0050f9013ea8569631f76ad35350da8b76c894ba3ef9800d2775b7fce2dcdc35fe1d7440e724b72f70e1e599b6cf8cd441d7c6a9279903f0c926042f3f8a200cc2ad0e3c48448624ac7580f96dc1358cebf8b2152b095b03c15ebbd5091b8583fcd7d01ab073060ca2b77bcb9ca8522bc41b5fe8133853e16c398b404225b06c2ea19f7f68a221e2e3f1ae06bed61acc82bb3e9a6b5a5eafb42fc68b4b3a3bfeec2bd3c1c4561a6f88bee15cef76379cb1022f9291b4642ed8bd2b54655516c81f201d12a2ae2145069266c61e0021ba818807ff104f3c3b306bbe8d3fd5e82ee4b3415c39ba5f64418675b8f8c9318bb8163da6c3896bce9f0d87a645c1a3fcb4724365bad707c3b3"}], 0x11a8, 0xc040}, 0x1}, {{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000001b00)="90e747634712c59214eee85ced4c80c7e785fc6cce4c027ca641c6d43f89c1faa4fa180695e54d802af1be2888094debc7582dca18325db6dede0cbd4361e71feea070a9c7e27a4aaa3c11cfdf838ab6c855a7217ad795499be72a95a1997eba177a17818ae4502dbd62f2c50f76735cbe45b30b09379dc87e137fd0f03c49706a794c76f43974c72ec67bbaa42016c489b529ceed96b5824cddfabd8a2f909adf9a86029e83c6f3f7c574165332b44f0f", 0xb1}, {&(0x7f0000001bc0)="0882c871453a13dc5aab54af4615f93693634c2e9fb6ddc7657058be99c538", 0x1f}, {&(0x7f0000001c00)="36dab068c6b150c42c2353740f4ec830af67e6d8d95d", 0x16}, {&(0x7f0000001c40)="8abe449192f042b0b04f5f11b3592cf166bae9d7b0b2a2c9bc00b39b7162b20662b39c73055575255564122461a8acf6d01d0921cc0f7e0f8095dff730c663f7fcdd957dbc4a723fdf47af", 0x4b}, {&(0x7f0000001cc0)="0dd01d0402363d21d9750a7339815d06d8e04b669af818175873c4faa16ef1123ef750c86090b12b80518afd560d9366102712b958c9ef9cfc13ce5117b992", 0x3f}, {&(0x7f0000001d00)="0c195e12673c83c374f3962a4460758d50c8157660f5e6ea73ba372ac660c0e1dca7c40024d822448a33e9721ab2591cf7ab30913b33515a6522abf1af8a0f57ae884ea61321899b31622d3334a0e6d99245fccd369337c3fff56a7e19b15bf47733bfce0773c88cc42e5172d99c949973141a4692dc33f0abb7a6e60497da08ef0200", 0x83}], 0x6, &(0x7f0000001e40)=[{0x28, 0x19b, 0x1ff, "79c0c9ddbb34237862c3559feecddec3e3b4fb3d93f7d8"}, {0x88, 0x112, 0x100, "d8b221980d6d6d278168ac358a44f1b8018244644e83728af50bc5e939172d2b1beed33f2385d39479464c88005fbbbad6c03482dffa9ae49c4827783627ec20d700d3b3d52de4669b7b526deab402a8b49e97e483c2ab9522abfe2f95b08e8d25f4e0233e824b9429fc964e9556943b9cb274709cd2b0"}], 0xb0, 0x40}, 0xfffffffffffffffe}, {{0x0, 0x0, &(0x7f0000001fc0)=[{&(0x7f0000001f00)="b69984b29944af4c53ad69dcef07fb1e6ced011cbdffc103d2673da73a9acafcb3b366aa8381453da10c8439f42fdf454778d6af1c54d6939128f15ab2c506f4257a8f57fe43aae17276b9f3493b6ddafb5d4f1e4335b53efc0d6fc5c770760c51920f2b16244fce16e8a0abdd0df87c7112ebddd31b1438b406c1da198faba659a82867310a03a49199707277debf8afaf57eb9f7e5c5fa3e25ccf4a2076194f8bd7b74d944dee2769cdce0e92ccf8a44a2d58b364816b951de7584", 0xbc}], 0x1, &(0x7f0000002040)=[{0x80, 0x13f, 0x6, "b6b7f8047a3925e14430f80fb85df4e1f0637ad6f253e0af9759e820080bbb01c7a751e7fb1fcdb12e2115ada7091a8fdd0ba387af9322781bbb00e26d7f55635c181223c7c1966cf10e9fe84fc0372e07c18d23eff91a7bd067fe8796dc303d64df2b7141042ec0f9e23b238c"}, {0xc0, 0x119, 0xffffffff00000001, "b6d5b3244324dfb84d42713a888f7edd33ccdcdb9e3beaf7e9530bd86cea49d7c8973ed1f3fba416f32b255427e35ae205dae896155b26aad7668a1e9da123870140caef2b8b68483af31c3c81779cdfd7824528195ee2566503e581b9e7d2e24afc6a74fa691fe0c6c8294a146145ce4c8d159daac6e704aebd0498e1d536e39715c22a804eb3e0bd382f72a19b84f11135502b101fd84f0571e760a649f0668253aa15f66435c7c85a65ddd5ba"}], 0x140, 0x4}, 0x9}, {{&(0x7f0000002180)=@can={0x1d}, 0x80, &(0x7f0000002580)=[{&(0x7f0000002200)="47f77baa160d63c4f04f118e82814a78bfc14233360a599f2c642fcbe750ab2832e7447c899d5269eccc9ea510e59b8f3d26ce969438256a5532450269f48c9857bd8f30d17a21bbdb239366dbd9d90fa9c1d465dc813bb82fc2e19652d2f50a7f37dcd18b9da9cce29a5957e5ea6fc8d72eee1c3e053e786cbef758ca59d6a8d66d21fcef8a14ddc5f4a16e22ae15a7727435b4b0f39b7cb432808ec2ca4a1b7f2c590e5691758f638638deb4b52128b76f26ce", 0xb4}, {&(0x7f00000022c0)="c231e470767173d5f33f6e63305bb6ec39f2aaa34359179a9bd7b4f60debe959efdbb92bf40c89e5a0607ca540168b82a8c80acfaad245842bdf456c442e8b4f484c1c57f82d8544ce3f22b49dd4dffe171f62a67bdf884af805fc5db0cd898b9174e4da34a7b80e72b57a652b36bbeb41c656e45c334520768d6c63df5335e692345a4f47759864c64b26960fef9f9ff32631fd832cfe89c13dc778d33dd8db94b098e6c61b166ffc522a64c1b7d25bd69f1448d4045d1368", 0xb9}, {&(0x7f0000002380)="8dd6c4214bd5d7d3a4277d47de05ea983e2c75b21b357cdd4be96999ce8796a2b8a945896fc885fcbb33a797762d89c5eb22eb8a6318dfa194ebcdd03404d3abfd0a8ddb336c14ca4e7e2131bf8d8e130046ee662e8bb52d8987699c982a1b23c94636359f824e4ed04d1abfa2b83979d77d0f2cb4481a6721742f00a52122d818851798d0aac126ec2610d62a05e5c6174f8e2bf5c342b63b38bff6af8fe3a16882e962f49bc2e549ab299c8de3d9db334048e24bb611c297baf2e0e8801451ff563d6c0b1752e62e3362a52c811dd75cc962a7dffb88988f1710cffd429c0684d93126d5d5ca17cbe3f898ce3d08354323e94a3b9f8500aa74499d", 0xfc}, {&(0x7f0000002480)="bb136d98f8c12cfb03044413bc55093b9a48400a5f6273b5c1a472493863e26d421167d5c0add7858bae234e535d2567de5431e97abfaa2aa3a890220f817185d64a9a50ff6cc51c48a1822a3d9fc63f840a87cf952a84ff4fae24a5630ca18864bc011c84f4a5a7f77325e152c37341008845c635c0497c4843ef3f6fc9d5492badae8b2e02c730fd4ce7af36f94bc0a04f3227dca90e5f0d485ecbdac6f753bc54ece53f48ed26a7b32cacab94eaeefe46d1c339d59be7466529a3c2c4376497d0e81e2aa1d1276f3db7a444d78049fcba9115e2bf14d32121910179e6d10cc6891b8b54b1ef", 0xe7}], 0x4, &(0x7f00000025c0)=[{0x68, 0x115, 0x8, "b8303ef4387193ab6b4391d43a66e610ac75dcb0845f35512d580f1662203fa353e402f351e7607859ddcb96a7fe28943f46f4a80f11ebe7e29c292e94d92056745fa1feb688324f4cdc1e632f57276fc156545bc38a6fab"}, {0x48, 0x184, 0x0, "907687885108273b12e14bf0e1ff5bd3f3d5a1ec42118c21a3e976cfa02a2185435d8e7b214a0ae3b8318a4fa488ce7804"}, {0xe0, 0x0, 0x4, "9a16911aa6d29138b5806afe1e6b9e59bf030f16222a5cc67ffc99548666bd9bdb4c6ed4a354303a954944bf0512c78c07f9d858ea3517b24462647c71de6f4df74adeeaec8f91b1e6a4eaf9a321153fa9adb269d6f90e47a2d7a3ebb7d2ddd9aab6497531e2541850b34ce380decdd38cbaaccc00da821cbd48f9266baf6da72ff2f72bee721b1a273216d8246861777c105ffb54d9801bc21e865ee86d04c78b3b1e417c419f28fbb6e0dec63418b2527d4a356c16826c2ae81a192799727a10bafdf5da5b6dffb9489a6639d71dd3"}, {0xb8, 0x11d, 0x7ff, "707c1c40ad6496c1ff453d0e04cfb0549e8878a924a725b5d0a891b0eca188295e15a1ac4afacf2c7708268718486ccda9a968cf07dcae624855bc755546aa8229f36eefea870f65d04e02298c9e22b94267d91fcff115cc1779128d58bd85bf8e578dc1c84354a02d2456220d37aea81e8dfb7cfa110fe7387741e8e0f0ab99f2543d1c52bb12771e58d92268cff7a80bbfc319f3a4701ce40e01c3e59d3be1c7af90"}], 0x248}, 0x7}], 0x4, 0x0) syncfs(r2) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) syncfs(0xffffffffffffffff) sendto$inet6(r2, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) ioctl$BLKROSET(r4, 0x125d, &(0x7f0000000100)=0x9) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r2, r6, &(0x7f0000d83ff8), 0x8000fffffffe) io_setup(0x6, &(0x7f0000002a00)=0x0) io_submit(r7, 0x6, &(0x7f0000002f00)=[&(0x7f0000002b00)={0x0, 0x0, 0x0, 0x7, 0x3f3d, r4, &(0x7f0000002a40)="278696ad7a3991bf2d1158b0c85a16c127e91542a72ecaeffc11a72735a199115c87a20da6d2eb2d1fab2efe442ebfdfed09c6a6dc3e03f7dd8c0b05b881858463029e5592b6e7b46006960b1d08b6fa8b2a4a41dff2bfdc45c75e6ee6950a3e5fd1eae3e359a6efef6c9e2a435c2bdea9c0f9139a0f74078eaea3c76977c0e2dd6650", 0x83, 0x1, 0x0, 0x1, r3}, &(0x7f0000002c40)={0x0, 0x0, 0x0, 0x0, 0x101, r0, &(0x7f0000002b40)="0f17384c13402c68dd3cd4e4d8d5bcbc555d65a69a0f87c747c44d1fa44a07a4a34da954b78ae5ba40c92918478843fef13c2d8990d6b0bbb0ae2cdd106448f85680eb1ea2230ca5fa2d2bbe0d583895a764024b334665b25c2dae74230f1333d5fb11ea642c174fbd19f0fa6775d194e49ec134af751eb185209554b8f143ea7d1829d293d187e46a1c27498d0d827090953968244c7ac81e4e45fbe6e3008af4325de0115d373f32bd5eab2edff8a6329e2bfc963f60f878b100b5a0fdfa6cd0e33adcbb0ddb8091ab5696f2b8d65401df62b14becc468abe32997b5f4", 0xde, 0x80000001, 0x0, 0x0, r6}, &(0x7f0000002cc0)={0x0, 0x0, 0x0, 0x1, 0x9, r0, &(0x7f0000002c80)="d7367c89d6cc2cd47575d13f6728be2fedbc77003736e78208fd61380aa63cfec83cceae8bd60e6474de7697", 0x2c, 0x2, 0x0, 0x1, r6}, &(0x7f0000002d40)={0x0, 0x0, 0x0, 0xf, 0x100000001, r2, &(0x7f0000002d00)="c928058ae8bfa3e9256dc6f155f392", 0xf, 0x8, 0x0, 0x1, r6}, &(0x7f0000002dc0)={0x0, 0x0, 0x0, 0x3, 0x7, r1, &(0x7f0000002d80)="af3808ad4e159daaa1f7c682ab62231c16d9e8f52f521f364d06803a3d4db14a55b2b7a4a2bf5b12a02ccff6ba01e088a9dd36fd1595021ec98462", 0x3b, 0x64, 0x0, 0x0, r5}, &(0x7f0000002ec0)={0x0, 0x0, 0x0, 0x0, 0x1, r3, &(0x7f0000002e00)="58e7fac01eae231cd50d72b242bfe3b155ab352af9fc04a5221e28bf7545930360fe89a378730dd28fd10e7ece56b76022bd612188abc2dfc9f7c2ede73a7fb1ff34ef4eab037c6fca2cc933718b2c326b8192daf562b3e8792f9c6abf137baee077e3f64249060de8ac1f27557bc57a029e21d2c3a3e987621438a3d245ee5ba0cff6dbf287147dd0df080013aaae445956b067fef13a129fa0a11d", 0x9c, 0x1, 0x0, 0x0, r4}]) 08:56:23 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="3f91e7ef660cb6d01f575b6f8511da4d71792320e44809b0218fffa839484b68b88a9333ab2d82213eeb5bf6230b1a5bf84fcbe9d43cab34f0e625af3b369472919e275ffe09b31235e07b68f433fc22d3fc9cbcc073f5c6ede95928f85a0ee82a276edb9afe172cbd6e1e0569e67791464d0e9d3503b15cc9b1aa1c5f0dc67610dd34ab4d9a7c91ebb67f9535b9a7a503fdd8d5b3514722bf3abaf37a2d77c60a3b94", @ANYRES64=0x0, @ANYBLOB="116348400000000000000000130000000000000000000000000000000000574244df0000000000000000000000000466cb0d3d6ead71c42b003c0b9462cd15c185191c1b473301b0c00be922a0efb2e1f452fd36526668e52405f5eac53aaa7ceed107000000d632ab93b72c25684946a047a139d8e8d81d2d8b33736e7fb3c4061d4e59e1a15420d9856397", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="45941209394b8379"], 0x0, 0x0, &(0x7f0000000680)}) 08:56:23 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x2800000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x74000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:23 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x88480000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 965.603555] binder: 16469:16471 unknown command -270036673 08:56:23 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xaa}, 0x0) 08:56:23 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 965.644778] binder: 16469:16471 ioctl c0306201 20000700 returned -22 [ 965.671286] XFS (loop6): SB sanity check failed [ 965.676144] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 965.687302] XFS (loop6): Unmount and run xfs_repair [ 965.692371] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 965.699079] 000000001b99517a: 58 46 53 42 00 00 10 00 00 00 00 7c 00 00 10 00 XFSB.......|.... [ 965.707964] 0000000062410009: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 965.716957] 00000000e315eb76: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 965.725856] 000000007722b120: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 965.734783] 000000002536e51d: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:23 executing program 0: r0 = syz_open_dev$mouse(&(0x7f0000000300)='/dev/input/mouse#\x00', 0x3f, 0x80000) clock_gettime(0x0, &(0x7f0000000340)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000400)={0x0, 0x0}) write$evdev(r0, &(0x7f0000000580)=[{{r1, r2/1000+10000}, 0x8, 0x8, 0x1}, {{0x0, 0x7530}, 0x7, 0x0, 0x101}, {{r3, r4/1000+30000}, 0x5, 0x6, 0x9}, {{}, 0x80000001, 0x8, 0x7}, {{0x0, 0x2710}, 0x3, 0x8, 0x8}, {{r5, r6/1000+10000}, 0x23, 0x1000, 0x5}, {{r7, r8/1000+30000}, 0x4, 0x307, 0x40}, {{0x0, 0x7530}, 0xedb, 0x9, 0x2}, {{0x0, 0x2710}, 0x5, 0x1}, {{0x0, 0x7530}, 0x8, 0x5, 0x7}], 0xf0) r9 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r9, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r10 = dup2(r9, r9) r11 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000100)={{{@in=@dev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000200)=0xe8) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000240)={'veth1_to_bond\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) accept$packet(0xffffffffffffffff, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000001ac0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000001b00)={{{@in6=@remote, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@broadcast}}, &(0x7f0000001c00)=0xe8) accept(r9, &(0x7f0000001c80)=@xdp={0x0, 0x0, 0x0}, &(0x7f0000001d00)=0x80) getpeername$packet(0xffffffffffffff9c, &(0x7f0000001d40)={0x0, 0x0, 0x0}, &(0x7f0000001d80)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000001dc0)={'team0\x00', 0x0}) getpeername$packet(0xffffffffffffffff, &(0x7f0000001e00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000001e40)=0x14) sendmsg$TEAM_CMD_NOOP(r10, &(0x7f0000002280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x85000408}, 0xc, &(0x7f0000002240)={&(0x7f0000001e80)={0x3b8, r11, 0x20, 0x70bd29, 0x25dfdbfb, {}, [{{0x8, 0x1, r12}, {0x1bc, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r13}}, {0x8, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r14}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r15}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x6}}, {0x8, 0x7}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x8}}}, {0x44, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8, 0x3, 0xb}, {0x14, 0x4, [{0x3, 0x4, 0x10001, 0x937}, {0x5, 0x0, 0x6, 0x3}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x8}}, {0x8, 0x7}}}]}}, {{0x8, 0x1, r16}, {0x1d8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8, 0x3, 0x5}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r17}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xffff}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r18}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8, 0x3, 0x6}, {0x4, 0x4}}, {0x8, 0x6, r19}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r20}}}]}}]}, 0x3b8}, 0x1, 0x0, 0x0, 0x10}, 0x20000801) r21 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_ifreq(r10, 0x8993, &(0x7f00000000c0)={'bpq0\x00', @ifru_mtu=0x5}) ioctl$BINDER_WRITE_READ(r21, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:23 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x3c000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:24 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x59000000}, 0x0) 08:56:24 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x0, 0x80) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000200)=0x1567faec, 0x8) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = creat(&(0x7f00000000c0)='./bus\x00', 0x1) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000140)={0x0, 0x100, 0x100000001, &(0x7f0000000100)=0x2}) r3 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r4, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) syncfs(r5) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$RTC_PLL_GET(r6, 0x80207011, &(0x7f0000000240)) sendto$inet6(r5, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) [ 965.743697] 000000002a352a8a: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 965.752588] 000000003756ac71: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 965.761521] 00000000fdb22835: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 965.770479] XFS (loop6): SB validate failed with error -117. [ 965.854602] binder: 16510:16511 BC_FREE_BUFFER u0000000000000000 no match [ 965.865199] binder: 16510:16511 transaction failed 29189/-22, size 0-0 line 2852 [ 965.910825] binder: 16510:16527 BC_FREE_BUFFER u0000000000000000 no match [ 965.924981] binder: 16510:16527 transaction failed 29189/-22, size 0-0 line 2852 [ 965.951295] binder: undelivered TRANSACTION_ERROR: 29189 [ 965.956978] binder: undelivered TRANSACTION_ERROR: 29189 08:56:24 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f0000000080)={0x6, 0x74, [{0x6, 0x0, 0xf5e3}, {0x7f, 0x0, 0x3ff}, {0x5, 0x0, 0x3}, {0x3}, {0x80, 0x0, 0xedc5}, {0xffffffffffffff81}]}) r2 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r2, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:24 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:24 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:24 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x2000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:24 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x40000000}, 0x0) 08:56:24 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$PPPIOCSMRU(r4, 0x40047452, &(0x7f00000001c0)) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r5 = request_key(&(0x7f00000000c0)='rxrpc_s\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000140)='\x00', 0xfffffffffffffffb) keyctl$revoke(0x3, r5) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:24 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000003f0100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:24 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) r2 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x5, 0x402) ioctl$KVM_SET_PIT(r2, 0x8048ae66, &(0x7f00000000c0)={[{0xfffffffffffff000, 0x2, 0x53c, 0x3, 0x1, 0x6, 0x10000, 0x1000, 0x4, 0x5, 0x80000000, 0x6, 0x10001}, {0x2, 0x9, 0x6, 0x5f19, 0xe1e, 0x10000, 0x8, 0x4, 0x40a1, 0x7fffffff, 0x2, 0x7ff}, {0x101, 0x0, 0x200, 0x920e, 0x100000001, 0x4, 0xffffffff00000000, 0x100000001, 0x3, 0xffff, 0x2, 0x3, 0x10000}], 0x1d69}) 08:56:24 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x8}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:24 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e24, 0x1, @loopback={0x0, 0x1}, 0x1000}, 0xec) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) socket$netlink(0x10, 0x3, 0x1e) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:24 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xffffdd86], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:24 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xf5ffffff00000000}, 0x0) [ 966.612219] binder: 16554:16557 BC_FREE_BUFFER u0000000000000000 no match [ 966.633491] binder: 16554:16557 transaction failed 29189/-22, size 0-0 line 2852 [ 966.658688] XFS (loop6): SB sanity check failed [ 966.661550] binder: 16554:16557 BC_FREE_BUFFER u0000000000000000 no match [ 966.663594] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 966.681564] XFS (loop6): Unmount and run xfs_repair [ 966.686618] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 966.693324] 000000008d145353: 58 46 53 42 00 00 10 00 00 00 00 00 03 f0 10 00 XFSB............ [ 966.702209] 00000000881ab762: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 966.711080] 00000000a6d329d6: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 966.711574] binder: 16554:16557 transaction failed 29189/-22, size 0-0 line 2852 [ 966.719970] 00000000a5dea169: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 966.719983] 0000000007059706: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 966.719992] 0000000003b9e725: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 966.720000] 000000002a679d9a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... 08:56:25 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x200000000000000}, 0x0) 08:56:25 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xf5ffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 966.720013] 00000000341ee8ac: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 966.757337] binder: undelivered TRANSACTION_ERROR: 29189 [ 966.763231] XFS (loop6): SB validate failed with error -117. 08:56:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7a00000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:25 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$SG_SET_TIMEOUT(r4, 0x2201, &(0x7f00000000c0)=0x97ba) [ 966.784542] binder: undelivered TRANSACTION_ERROR: 29189 [ 966.877536] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 966.901915] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:25 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x3, 0x300) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) r2 = memfd_create(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000080)={0x16, 0x1, 0x3ff}) 08:56:25 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xe000000}, 0x0) 08:56:25 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x40000, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="44000000e284edd6f9379c36dc40a887b943074fb4dec73bfb37327134c9fba266072259f6adb4cef85d366b46a4a9662b2c7fd899c8c981299e55d0bac46f4cbd885653dd3965b07c06b4ccd65bdcfe55d8ad174d7df18ed97eaaa7c4cd00e41eb47d4030ff051fabac09ad118dab93a480d77c7fb086b6ac34dcd9cd2499a59ffe04fe4f42353fb8f5f5ac0c272a302da899cc944d9595b97b53d1310114dfca26c503528acc60f9f6b93f4238eeb5d43efdff455b42"], &(0x7f0000000040)=0x4c) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f00000000c0)=""/5) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={r2, 0x539697cc}, &(0x7f0000000180)=0x8) r3 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:25 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0xf401000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:25 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000bd50000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x1000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:25 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) r5 = msgget(0x1, 0x4) msgctl$IPC_INFO(r5, 0x3, &(0x7f0000000140)=""/12) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$netlink(r4, 0x10e, 0x2, &(0x7f00000000c0)=""/39, &(0x7f0000000100)=0x27) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:25 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:25 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x4000}, 0x0) 08:56:25 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)=0x8) tkill(r0, 0x15) 08:56:25 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4788], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:25 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xe803}, 0x0) [ 967.621495] binder: 16631:16637 BC_FREE_BUFFER u0000000000000000 no match [ 967.648518] binder: 16631:16637 transaction failed 29189/-22, size 0-0 line 2852 [ 967.676994] XFS (loop6): SB sanity check failed [ 967.681831] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 967.691862] binder: undelivered TRANSACTION_ERROR: 29189 [ 967.692971] XFS (loop6): Unmount and run xfs_repair [ 967.692987] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 967.710182] 00000000012df89c: 58 46 53 42 00 00 10 00 00 00 0b d5 00 00 10 00 XFSB............ 08:56:25 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0x65) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x9, 0x1) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r4, 0x84, 0x65, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x6, @empty, 0x75}, @in={0x2, 0x4e22}, @in={0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}], 0x3c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) setsockopt$inet6_tcp_int(r3, 0x6, 0x18, &(0x7f0000000100)=0xffffffff7fffffff, 0x4) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:25 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xa}, 0x0) 08:56:25 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0xe0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000680)}) 08:56:25 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x500}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 967.719116] 0000000053340522: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 967.728017] 0000000044ea291b: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 967.736915] 00000000a24744a8: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 967.745808] 0000000091327f55: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 967.754685] 00000000781166f0: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 967.763578] 00000000db935df0: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 967.772469] 000000008ce8cb78: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 967.782390] XFS (loop6): SB validate failed with error -117. [ 967.808576] binder: 16658:16659 unknown command 0 08:56:26 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xffffff8d], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:26 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000200000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:26 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xe803000000000000}, 0x0) [ 967.830210] binder: 16658:16659 ioctl c0306201 20000700 returned -22 08:56:26 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4c00000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:26 executing program 0: socket$inet6(0xa, 0x1000000000002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:26 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xa00000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:26 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xe00000000000000}, 0x0) [ 967.946551] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 967.969453] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 967.980191] binder: 16695:16699 BC_FREE_BUFFER u0000000000000000 no match [ 967.987440] binder: 16695:16699 transaction failed 29189/-22, size 0-0 line 2852 [ 967.996420] XFS (loop6): SB sanity check failed [ 968.001222] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 968.012389] XFS (loop6): Unmount and run xfs_repair [ 968.017446] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 968.024172] 000000001ee8127c: 58 46 53 42 00 00 10 00 00 00 00 20 00 00 10 00 XFSB....... .... [ 968.033056] 000000008c46782b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 968.041955] 0000000067f5d123: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 968.050830] 0000000013c96961: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 968.059711] 00000000f952949c: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 968.068594] 00000000fa7a19fe: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 968.077496] 000000006ab35791: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 968.086377] 000000009a6106fe: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 968.093380] binder: 16695:16713 BC_FREE_BUFFER u0000000000000000 no match [ 968.096139] XFS (loop6): SB validate failed with error -117. [ 968.103104] binder: 16695:16713 transaction failed 29189/-22, size 0-0 line 2852 [ 968.123552] binder: undelivered TRANSACTION_ERROR: 29189 [ 968.129285] binder: undelivered TRANSACTION_ERROR: 29189 08:56:26 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:26 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x300000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:26 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xf401000000000000}, 0x0) 08:56:26 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4000000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:26 executing program 3: openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x200000, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:26 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f0000000000)=0xe8) r3 = add_key(&(0x7f0000000040)='id_resolver\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000200)="df0c343491092ee12336ce4078245429d915310b7986a904311795e279b6ae7d8f2c241b8cd65342cc9c9a963bbf62317bdcec3f9f9c2a39068b863181d095afd48e9851109e9c754221c4b022e9fe1639ad908b8d673872404ffe68bdc5bc751b1ce378fb465c66bd1566fd9dd21dab1c7fc154b1", 0x75, 0xfffffffffffffffa) keyctl$get_persistent(0x16, r2, r3) 08:56:26 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000f40000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:26 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) lgetxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='security.capability\x00', &(0x7f0000000480)=""/4096, 0x1000) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:26 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getpeername$llc(r4, &(0x7f0000000100), &(0x7f0000000140)=0x10) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:26 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xfffff000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 968.627259] binder: 16740:16741 BC_FREE_BUFFER u0000000000000000 no match [ 968.639303] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 968.666100] binder: 16740:16741 transaction failed 29189/-22, size 0-0 line 2852 08:56:26 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x1030000}, 0x0) [ 968.683228] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 968.696641] XFS (loop6): SB sanity check failed [ 968.701471] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 968.705436] binder: 16740:16760 BC_FREE_BUFFER u0000000000000000 no match [ 968.712685] XFS (loop6): Unmount and run xfs_repair [ 968.724622] XFS (loop6): First 128 bytes of corrupted metadata buffer: 08:56:26 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x9}, 0x0) [ 968.731481] 00000000375847dd: 58 46 53 42 00 00 10 00 00 00 00 f4 00 00 10 00 XFSB............ [ 968.740349] 00000000a72dd856: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 968.749217] 00000000a675aa09: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 968.758105] 00000000fbc27f28: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 968.766972] 000000006db402c2: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 968.773086] binder: 16740:16760 transaction failed 29189/-22, size 0-0 line 2852 08:56:27 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf0ffffffffffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:27 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x86ddffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:27 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x301}, 0x0) [ 968.775841] 0000000057713e46: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 968.775853] 000000005e594c63: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 968.775864] 00000000744c0d60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 968.795376] XFS (loop6): SB validate failed with error -117. [ 968.824948] binder: undelivered TRANSACTION_ERROR: 29189 08:56:27 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x6) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) mmap$binder(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000000, 0x13, r1, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000040)=0x14) ioctl$sock_ifreq(r0, 0x893f, &(0x7f00000000c0)={'veth0_to_bond\x00', @ifru_addrs=@hci={0x1f, r2, 0x3}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) [ 968.841352] binder: undelivered TRANSACTION_ERROR: 29189 [ 968.987273] binder: 16790:16791 BC_FREE_BUFFER u0000000000000000 no match [ 968.994560] binder: 16790:16791 transaction failed 29189/-22, size 0-0 line 2852 [ 969.013474] binder: 16790:16791 BC_FREE_BUFFER u0000000000000000 no match [ 969.013713] binder: undelivered TRANSACTION_ERROR: 29189 [ 969.020750] binder: 16790:16791 transaction failed 29189/-22, size 0-0 line 2852 [ 969.039949] binder: undelivered TRANSACTION_ERROR: 29189 08:56:27 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:27 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x40000, 0x0) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r0, 0xc0385720, &(0x7f0000000200)={0xe3d58cff8e8179b, {r1, r2+30000000}, 0x8, 0x5}) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r4 = socket$inet6(0xa, 0x7, 0xffff) socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xa) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r5 = socket$inet6(0xa, 0x400000000001, 0x0) r6 = dup(r5) setsockopt$packet_tx_ring(r6, 0x107, 0xd, &(0x7f0000000100)=@req3={0xfffffffffffffff9, 0x2, 0x8, 0x3cad, 0x4, 0x7f, 0x11a5}, 0x1c) syncfs(r6) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r5, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00000000c0)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000240)) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$sock_inet_SIOCADDRT(r6, 0x890b, &(0x7f0000000300)={0x5, {0x2, 0x4e21, @local={0xac, 0x14, 0x14, 0xaa}}, {0x2, 0x4e22}, {0x2, 0x4e23, @multicast2=0xe0000002}, 0x252, 0x8, 0xffffffff, 0x20, 0x3, &(0x7f00000002c0)='veth0_to_bond\x00', 0x8, 0x7ff, 0x7}) 08:56:27 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x3f00000000000000}, 0x0) 08:56:27 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000d50b0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:27 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x9effffff00000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:27 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8906], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:27 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000000)={0x0, 0x3b}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={r2, 0xc0000000000000, 0xeadc, 0x6}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:27 executing program 7: r0 = gettid() r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x3) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x9, &(0x7f0000000040)=0x10001, 0x4) setsockopt$inet_group_source_req(r2, 0x0, 0x2f, &(0x7f00000003c0)={0x0, {{0x2, 0x4e23, @broadcast=0xffffffff}}, {{0x2, 0x4e20, @rand_addr=0x81}}}, 0x108) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f00000000c0)={0xfff, 0x46e, 0x2, 0x1bf, 0x8, 0x9}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[{0x9, 0x81, 0x1, 0x1}, {0x1000, 0x28, 0x81, 0x20}, {0x7, 0x9, 0x1, 0x1}]}) getsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000140)={@ipv4={[], [], @remote}, 0x0}, &(0x7f0000000180)=0x14) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="680000002400110329bd7000fbdbdf2500000000", @ANYRES32=r3, @ANYBLOB="ffff0e0000001000000004000800050020020000c61335d540b138d508000e00a7ca0000080005000505000008000e000800000008000e00ffff000008000d00000000000c9bcc103700b942cf00ef02c20b440001006266"], 0x68}, 0x1, 0x0, 0x0, 0x8800}, 0x80) 08:56:27 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x4000000}, 0x0) 08:56:27 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x1100], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 969.625402] binder: 16815:16817 BC_FREE_BUFFER u0000000000000000 no match [ 969.640236] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 969.649727] binder: 16815:16817 transaction failed 29189/-22, size 0-0 line 2852 08:56:27 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, [], 0x19}, 0xfffffffffffffffc}, 0xffffffffffffff50) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 969.672707] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 969.691243] binder: undelivered TRANSACTION_ERROR: 29189 [ 969.692445] binder: 16815:16817 BC_FREE_BUFFER u0000000000000000 no match [ 969.714721] XFS (loop6): SB sanity check failed [ 969.719521] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 969.730705] XFS (loop6): Unmount and run xfs_repair [ 969.731200] binder: 16815:16817 transaction failed 29189/-22, size 0-0 line 2852 [ 969.735769] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 969.735785] 000000006718f3ea: 58 46 53 42 00 00 10 00 00 00 d5 0b 00 00 10 00 XFSB............ [ 969.735795] 000000001ceda404: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 969.735804] 000000007333d7db: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 969.735818] 0000000043a638b9: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 969.762547] binder: undelivered TRANSACTION_ERROR: 29189 [ 969.767820] 000000008ab2d823: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 969.799892] 00000000dab7f03b: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 969.808780] 0000000051f6b75e: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 969.817668] 0000000076420153: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:28 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x7], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:28 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") flock(r0, 0x0) r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) pipe(&(0x7f00000001c0)) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) bind$llc(r5, &(0x7f0000000140)={0x1a, 0x32f, 0x9, 0x1ba4, 0x2, 0x8, @random="7d360c330133"}, 0x10) ioctl$KVM_GET_DEVICE_ATTR(r4, 0x4018aee2, &(0x7f0000000100)={0x0, 0xd36, 0x13, &(0x7f00000000c0)=0x681d64fa}) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:28 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0xfe80000000000000}, 0x0) 08:56:28 executing program 0: r0 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x5) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x1) fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x3, &(0x7f0000000340)=[r3, r4, r5]) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) getsockname$inet(r2, &(0x7f0000000000)={0x0, 0x0, @local}, &(0x7f0000000040)=0x10) 08:56:28 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6c000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 969.826593] XFS (loop6): SB validate failed with error -117. [ 969.877625] binder: 16854:16856 BC_FREE_BUFFER u0000000000000000 no match [ 969.914203] binder: 16854:16856 transaction failed 29189/-22, size 0-0 line 2852 [ 969.951582] binder: 16854:16856 BC_FREE_BUFFER u0000000000000000 no match [ 969.968593] binder: 16854:16856 transaction failed 29189/-22, size 0-0 line 2852 [ 969.990317] binder: undelivered TRANSACTION_ERROR: 29189 [ 969.998582] binder: undelivered TRANSACTION_ERROR: 29189 08:56:28 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:28 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x6488], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:28 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x8dffffff}, 0x0) 08:56:28 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000007000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:28 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfb, 0x8000}, 0xfffffffffffffd68) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:28 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x300000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:28 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = dup(r0) connect$pppoe(r1, &(0x7f00000001c0)={0x18, 0x0, {0x2, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x13}, 'veth1\x00'}}, 0x1e) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") fcntl$setstatus(r0, 0x4, 0x42000) fsetxattr(r0, &(0x7f00000000c0)=@known='user.syz\x00', &(0x7f0000000100)='.lo%md5sumcpuset-em1\x00', 0x15, 0x1) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/rpc\x00') bind$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x3, 0x2, 0x7b, 0x1, @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xc}}, 0x10) [ 970.622378] binder: 16875:16876 BC_FREE_BUFFER u0000000000000000 no match [ 970.633438] binder: 16875:16876 transaction failed 29189/-22, size 0-0 line 2852 [ 970.650062] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 970.667369] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 970.680263] binder: 16875:16876 BC_FREE_BUFFER u0000000000000000 no match [ 970.699683] binder: 16875:16876 transaction failed 29189/-22, size 0-0 line 2852 [ 970.707996] XFS (loop6): SB sanity check failed [ 970.712795] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 970.723959] XFS (loop6): Unmount and run xfs_repair [ 970.726544] binder: undelivered TRANSACTION_ERROR: 29189 [ 970.729015] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 970.729039] 00000000d95878ef: 58 46 53 42 00 00 10 00 00 00 07 00 00 00 10 00 XFSB............ [ 970.729047] 00000000a871ed06: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 970.729056] 000000002425e8e6: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 970.729064] 00000000b3d3e38b: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 970.729073] 0000000047e3ab39: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 970.729082] 00000000de7b43a4: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 970.729093] 0000000075194a4a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 970.729107] 000000001fa9f204: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 970.740293] binder: undelivered TRANSACTION_ERROR: 29189 [ 970.759120] XFS (loop6): SB validate failed with error -117. 08:56:30 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) io_setup(0x3, &(0x7f0000000080)=0x0) io_destroy(r2) ioctl$KVM_GET_NR_MMU_PAGES(r1, 0xae45, 0x1) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:30 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x800000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:30 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x9000000}, 0x0) 08:56:30 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) ioctl$KVM_HYPERV_EVENTFD(r4, 0x4018aebd, &(0x7f00000000c0)={0x1, r3}) 08:56:30 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000480)='/dev/dmmidi#\x00', 0x3, 0x800) ioctl$sock_bt_hci(r1, 0x400448de, &(0x7f00000000c0)="9eba5f0011b6153818259b5a28ddc51ed570f3a4b8418833673388f462ec2ad0537e664e27eca58f56ebf96e7a5fda918d05061b97f904dd708dd082795792b0b9a15c0bf22d566e9a36702f6d9af5cfc6fa7a7870f5e8270014e5619dcd31191c882fa75246da000a1f5d48a784282b3611b5462d62e5bf98e937508b80d3e3fa873d832d584db3b5f3fbf6c97b70f0b889d909ab09dc7163dbbcdc199abf1f6dd3cf0230091ba9e0f5bf0bdd6ac4ea6568733b3ba71084a95a7e4c522d36") ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x63, 0x0, &(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRESOCT=r2, @ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES32=r2, @ANYRESOCT=r1], 0x0, 0x0, &(0x7f0000000680)}) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000040)='./control\x00', 0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={[{@fat=@dos1xfloppy='dos1xfloppy', 0x2c}]}) ioctl$VT_RELDISP(r1, 0x5605) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r1, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xc101000}, 0xc, &(0x7f0000000240)={&(0x7f00000002c0)={0x140, r3, 0x800, 0x70bd2d, 0x25dfdbfb, {0x6}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x6}]}, @IPVS_CMD_ATTR_DEST={0x5c, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1=0xe0000001}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffff80000000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1ff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1f}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, [], 0xb}}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x48, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond_slave_1\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2=0xe0000002}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2=0xe0000002}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1=0xe0000001}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local={0xac, 0x14, 0x14, 0xaa}}]}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffebd}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local={0xac, 0x14, 0x14, 0xaa}}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x80000000}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xfffffffffffffff8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}]}, 0x140}, 0x1, 0x0, 0x0, 0x4000050}, 0x8000) 08:56:30 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000010000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:30 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x40030000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:30 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(0xffffffffffffffff) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:30 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x100000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:30 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3100000000000000}, 0x0) [ 972.660221] binder: 16922:16926 unknown command 808464432 [ 972.661659] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 972.673556] binder: 16922:16926 ioctl c0306201 20000700 returned -22 [ 972.687171] FAT-fs (loop0): bogus number of reserved sectors [ 972.693095] FAT-fs (loop0): This doesn't look like a DOS 1.x volume; no bootstrapping code [ 972.701670] FAT-fs (loop0): Can't find a valid FAT filesystem 08:56:30 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r0, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 972.733145] binder: 16922:16926 unknown command 808464432 [ 972.741549] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 972.750462] binder: 16922:16926 ioctl c0306201 20000700 returned -22 [ 972.763375] XFS (loop6): SB sanity check failed [ 972.768332] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff 08:56:31 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x700000000000000}, 0x0) 08:56:31 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8848000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:31 executing program 0: r0 = memfd_create(&(0x7f00000000c0)='/dev/rtc0\x00', 0x1) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000000100)) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="eeffffffffffffff"], 0x0, 0x0, &(0x7f0000000680)}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x1011c0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0xffffffffffffffff, 0x0, 0x5, 0x0, 0x3f}}) [ 972.779473] XFS (loop6): Unmount and run xfs_repair [ 972.784538] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 972.791251] 00000000529a960b: 58 46 53 42 00 00 10 00 00 00 10 00 00 00 10 00 XFSB............ [ 972.800150] 0000000075e93186: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 972.809040] 00000000d73cba2a: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 972.817928] 000000008b987427: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ 08:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 972.826814] 000000007d22151c: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 972.835694] 0000000012a09bef: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 972.844558] 0000000070fa3fa0: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 972.853417] 00000000c27b4a7f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 972.862715] XFS (loop6): SB validate failed with error -117. 08:56:31 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000a1030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 972.933455] binder: 16966:16967 BC_FREE_BUFFER u0000000000000000 no match [ 972.979587] binder: 16966:16967 transaction failed 29189/-22, size 0-0 line 2852 [ 973.014014] binder: 16966:16980 BC_FREE_BUFFER u0000000000000000 no match [ 973.043019] binder: 16966:16980 transaction failed 29189/-22, size 0-0 line 2852 [ 973.053114] XFS (loop6): SB sanity check failed [ 973.055708] binder: undelivered TRANSACTION_ERROR: 29189 [ 973.057930] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 973.063408] binder: undelivered TRANSACTION_ERROR: 29189 [ 973.074523] XFS (loop6): Unmount and run xfs_repair [ 973.074536] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 973.091788] 000000008d7fea32: 58 46 53 42 00 00 10 00 00 00 a1 03 00 00 10 00 XFSB............ [ 973.100685] 0000000021aa95dc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 973.109560] 0000000003813867: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 973.118456] 000000005683a864: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 973.127330] 000000000123a4b5: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 973.136195] 0000000072b7d37a: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 973.145065] 00000000d22236fc: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 973.153927] 00000000bd81fced: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 973.162849] XFS (loop6): SB validate failed with error -117. 08:56:31 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:31 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xfeffffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:31 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x8000000}, 0x0) 08:56:31 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) syz_open_pts(r4, 0x101001) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6800}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:31 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x200003, 0x0) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000000040)) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="116348400000000000000000000000000000007bb11bc2dd000000000000000000000000000000000000000000000000001b0000000000dc86a54a0960580d9dd6639afc2e864702fb3545980de5477ca4343976c978339aa6a9a53469cd7d833a5ddfcb359a9025be7c3c21aa2ce00aa79282e5214f80173a4bd7d11c4533ad7853a071b2fb7417355467cfbab82667b6e31653f8def211c982cb84e5be971e786379bb1b2ff827bde58d6e002bfd7ca659866c682364c74d525d940dd594c04af2181220f392e41724cd284f8e11cb96575d9cebe3c86709f7fe606e7ae63c3e", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:31 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000b4020000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 973.545175] binder: 16999:17000 BC_FREE_BUFFER u0000000000000000 no match 08:56:31 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:31 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x301}, 0x0) 08:56:31 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r4) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f00000000c0)={0x0, 0x5d, 0x100, 0xfffffffffffffffe, 0x9, 0x5}, &(0x7f0000000100)=0x14) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000140)={r5, 0xffffffff, 0x9b}, 0x8) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x600}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:31 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x6c], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 973.603607] binder: 16999:17000 transaction failed 29189/-22, size 0-29686813949952 line 2852 [ 973.615268] XFS (loop6): SB sanity check failed [ 973.620104] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 973.625009] binder: undelivered TRANSACTION_ERROR: 29189 [ 973.631249] XFS (loop6): Unmount and run xfs_repair [ 973.631260] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 973.631275] 000000005c68a3ff: 58 46 53 42 00 00 10 00 00 00 b4 02 00 00 10 00 XFSB............ [ 973.657358] 00000000ce4ac0e6: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 973.666244] 00000000cb5bb27d: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 973.675137] 00000000b95138f3: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 973.684049] 0000000071041919: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 973.692933] 00000000f3f566da: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 08:56:31 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x9effffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:31 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf5ffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 973.701839] 00000000fb60102d: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 973.710731] 00000000d88c5f26: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 973.719871] XFS (loop6): SB validate failed with error -117. 08:56:32 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3e8}, 0x0) 08:56:32 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vcs\x00', 0xc00, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x28c010}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0xa8, r3, 0x300, 0x70bd28, 0x25dfdbfe, {0x4}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x401}, @IPVS_CMD_ATTR_SERVICE={0x54, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x5}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6e}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x20, 0x2}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1c}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'rose0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}]}, 0xa8}, 0x1, 0x0, 0x0, 0x40}, 0xf931d9d3bfd538df) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x5, 0x30}, &(0x7f0000000040)=0xc) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000200)={r4, 0x2, 0x9, 0x40, 0x7fff, 0x5}, 0x14) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000000c0)={r4, 0xf3, "20b4f34bb5ba754a1fafd79cd1a0c1344f9002187d4eaef91d9a9d91e7b9798c68c5b09dfb94d43ea51448c018b9d6e8b2a33f5d64f9a22d0541240a06ec06f73b5e19f88fccf1037221919737f476d5c89c6c138d8e1e1521de143035b5dc8c115935271ef53580b1f11e5db387996c92cfb5beb2ff7ebaa651833598af8d89890919012edb9e78950b8a05a981d3e8cd52279b13a5d2921045a515e88511bad1944f31178f85d75cc94559428df6178b7fedfeffab303367ec89bbae35242251af448c462f1c0bbbe7c6824970801c92d8ce8a62ec7a3ee75291b3e59b781d3b1002400544faabf432df5691853644d7fb83"}, &(0x7f00000001c0)=0xfb) [ 973.810817] binder: 17050:17051 BC_FREE_BUFFER u0000000000000000 no match [ 973.849500] binder: 17050:17051 transaction failed 29189/-22, size 0-0 line 2852 [ 973.883208] binder: 17050:17060 BC_FREE_BUFFER u0000000000000000 no match [ 973.892909] binder: 17050:17060 transaction failed 29189/-22, size 0-0 line 2852 [ 973.903416] binder: undelivered TRANSACTION_ERROR: 29189 [ 973.909177] binder: undelivered TRANSACTION_ERROR: 29189 08:56:32 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x18) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000240)={&(0x7f0000000180)='./file0\x00', 0x0, 0x8}, 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000080)={0xffffffffffffffff}, 0x117}}, 0x20) keyctl$join(0x1, &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000100)={0x4, 0x8, 0xfa00, {r2, 0xb593}}, 0x10) 08:56:32 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000400000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:32 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) r3 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x1ff, 0x2) ioctl$KVM_INTERRUPT(r3, 0x4004ae86, &(0x7f0000000100)=0x10000) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @local={0xfe, 0x80, [], 0xaa}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) ioctl$BLKSECTGET(r3, 0x1267, &(0x7f0000000140)) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x5000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:32 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8060000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:32 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x1f4}, 0x0) 08:56:32 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="64568934", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) [ 974.427726] binder: 17073:17075 unknown command 881415780 [ 974.452266] binder: 17073:17075 ioctl c0306201 20000700 returned -22 [ 974.499577] XFS (loop6): SB sanity check failed [ 974.504426] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 974.515570] XFS (loop6): Unmount and run xfs_repair [ 974.520623] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 974.527434] 000000002d765891: 58 46 53 42 00 00 10 00 00 00 00 40 00 00 10 00 XFSB.......@.... [ 974.536307] 0000000048bf28e2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 974.545191] 0000000083e5f7df: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 974.554065] 000000006948972c: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 974.562956] 00000000d59d6a98: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 974.571843] 000000005d868703: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 974.580713] 000000001f3c273a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 974.589599] 0000000033414a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 974.600353] XFS (loop6): SB validate failed with error -117. 08:56:32 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:32 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x600], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:32 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x100000000000000}, 0x0) 08:56:32 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x80000, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@local, @in6=@mcast1}}, {{@in=@broadcast}, 0x0, @in6=@dev}}, &(0x7f0000000200)=0xe8) r2 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffff9c, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x200, 0x30}, &(0x7f0000000100)=0xc) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000140)={r5, 0x0, 0x6}, 0x8) r6 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r4, r7, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4c00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:32 executing program 0: r0 = socket$inet6(0xa, 0x4080004, 0x6) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_retries\x00', 0x2, 0x0) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x72, 0x3]) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x4000000000000007) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f00000002c0)=ANY=[@ANYBLOB="d32d00000000000002004e247f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002004e217f00000100000000000000000000850697264d3a7028000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x110) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000400)='tls\x00', 0x4) r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getdents(r1, &(0x7f0000000480)=""/77, 0x4d) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={r1, 0x28, &(0x7f00000001c0)={0x0, 0x0}}, 0x10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000240)={r3, 0x3, 0x10}, 0xc) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11630840725138982c31382c02e03962a0dad13567b2f6f2be60ec8b7cbf436a220e8d1425da45edf07e13798b931afcb2a1ddb5614b70e728f5f331490e33fb2622abe4289d061a466e36d6c093e1d2eb00a29acd50354074015a3fff102d810c64fda83453bdf7070e98ef99c7a24fff00ebd1e2", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="0000f8ffffff0000"], 0x0, 0x0, &(0x7f0000000680)}) ioctl$EVIOCGKEY(r1, 0x80404518, &(0x7f0000000440)=""/42) 08:56:32 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000f4000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:33 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x3c00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:33 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x5900000000000000}, 0x0) [ 974.755659] binder: 17116:17120 unknown command 1074291473 [ 974.762890] binder: 17116:17120 ioctl c0306201 20000700 returned -22 [ 974.803016] binder: 17116:17120 unknown command 1074291473 [ 974.810437] binder: 17116:17120 ioctl c0306201 20000700 returned -22 [ 974.815393] XFS (loop6): SB sanity check failed [ 974.821768] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 974.832869] XFS (loop6): Unmount and run xfs_repair [ 974.837998] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 974.844719] 00000000cfcf5dee: 58 46 53 42 00 00 10 00 00 00 f4 00 00 00 10 00 XFSB............ [ 974.853585] 00000000faa54ad5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 974.862467] 0000000053f9d0c5: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 974.871350] 000000000c62b35b: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 974.880237] 000000000d28f6ad: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 974.889113] 0000000076e60c1f: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 974.897995] 000000007b8a7af3: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 974.906884] 0000000047abb923: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 974.916135] XFS (loop6): SB validate failed with error -117. 08:56:33 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)=0x0) r2 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r2, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0x9208, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) timer_settime(r1, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {r3, r4+30000000}}, &(0x7f0000000080)) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x80000001) tkill(r0, 0x15) 08:56:33 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x43000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:33 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0x10000, 0x40000) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:33 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x101000, 0x80) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f00000000c0)) ioctl$KDSKBMETA(r2, 0x4b63, &(0x7f0000000180)=0xc1) getsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f00000001c0), &(0x7f0000000200)=0x10) write$P9_RAUTH(r2, &(0x7f0000000040)={0x14, 0x67, 0x2, {0x20, 0x3, 0x5}}, 0x14) 08:56:33 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xffffff80], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:33 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xfeffffff}, 0x0) 08:56:33 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000003f0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 975.301368] binder: 17149:17150 BC_FREE_BUFFER u0000000000000000 no match [ 975.329526] binder: 17149:17150 transaction failed 29189/-22, size 0-0 line 2852 [ 975.372771] XFS (loop6): SB sanity check failed [ 975.377694] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 975.388832] XFS (loop6): Unmount and run xfs_repair [ 975.393882] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 975.394654] binder: 17149:17150 BC_FREE_BUFFER u0000000000000000 no match [ 975.400589] 0000000079ccef7a: 58 46 53 42 00 00 10 00 00 00 00 3f 00 00 10 00 XFSB.......?.... [ 975.400600] 0000000071aa1d7f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 975.400611] 00000000322501bc: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 975.400621] 000000003b174513: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 975.400630] 00000000a060952e: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 975.400646] 000000002de22bff: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 975.408342] binder: 17149:17150 transaction failed 29189/-22, size 0-0 line 2852 [ 975.416462] 00000000422dc27e: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 975.416473] 0000000086e40e04: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 975.426169] XFS (loop6): SB validate failed with error -117. [ 975.437342] binder: undelivered TRANSACTION_ERROR: 29189 [ 975.498665] binder: undelivered TRANSACTION_ERROR: 29189 08:56:33 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:33 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8906000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:33 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x59000000}, 0x0) 08:56:33 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$EVIOCSKEYCODE(r4, 0x40084504, &(0x7f00000000c0)=[0x0, 0xfffffffffffffffa]) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x7) 08:56:33 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x1479}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:33 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_mount_image$nfs4(&(0x7f0000000000)='nfs4\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x3, &(0x7f00000002c0)=[{&(0x7f00000000c0)="d62bed12db391522e9c1c5b5ae186703cc195b08a9589f60d7c99bc0717bb5c44969d075b5dca8ea61034a1a3dce3839d1a9c82138c94954d5c1ba5fdf9554aefed1dd70edee4e603129ccc60ad03fea381c9b36f4cd94b7a80a0be231a70060022fe0697d72c7d60ea806f84a330d1892f9427d067aca20d4909430f03abc1d471534fc257d144e13512fa9b629225b16386121528da97abba8bfd43b6c54b145f2ca17bd982cb4215fcd61815ea1f43cf2f1d81ec64a9d440badcd4c515a6623f0379976ee529d69abc88a", 0xcc, 0x1}, {&(0x7f00000001c0)="75ff328a301002c3db6bc1171edb854d81c230f01a0ffe503bd0864c2bffed112841faa30f9e19655af8da1622664c152fe2e040243b4b2f412e50e3d7bf18be701608af9607d19e2a75d9d1ea0d4cdfb2412a44e6ee6bb9de289e8e1de5e7c17f2b9c6447b981064a181d33", 0x6c, 0xfff}, {&(0x7f0000000740)="ff7291e85f7d32ae323490b5764b7a1a9d32de8866b284575eff043374269f029931782e9d42cdcc1a81dc915b5b08bd367c8e8409524877f1c08348346cd513b2c3e0fe0da1324ba0feaf8ceaa59cbd358d4775449a477b9c661dd43cbfcbd14a8ce183f5b2051f5d12be62b2aec389befdf8d39644eb0bd9d7a26c773854fe4546f3c5ca1d5b7c272c3ac724131d52b06c3408ecaf7f95847d97c786a008d273a3682408540112718529dec7afcdd68465b7858cac82fc75a4653215f3dab2e7796e315060e159111eaab44210018383ad58f2724b9a6d23d5fe412f666545c65940a292f25f74e93534d011922eb835d22c920bd797a63321753a225b98eb7e397538ebfeeaf777565e5f70d6452862520c1f529f3e3d7a09607dc751848f3d86f3a33d15cbec5a2a195f3c1e7f3f6371fb13ef0fbd829063ebac061137b0a8987fd99f462080b0c36a4b6a6d361f6787849b5dec3686f99ecf8dfcd793ea1e67b7133c4f6b8766d582b90b308d5f89f396ed662759057f60419ecc2f218a60cca5ffcce178f9246bd1e5e97eb31f1e1ad688f6bb58179a6e416ec34a9032a0c3be64b1a2d8a1f19ab5f9e9d92eb14c2f4c28f944c156c4b677f4f58447f98ba6c585e60d0b23f1b197570b34b924502c851bfe9cb23bbf350ee24db9ff5320ec59217cdef10ca4aa41734162f09655c81d1c0e53097e4f6e83b592428348c8332268629224c2a520339e7b1cffa78a979fcf31c6150d5ec36c8e4151176a63ad814e4da28215fd93c7d094cf011b970e241e1916e6b5f9a70acca16662662ece2ad93c8d9edb6778256ad8a2757f6a2a9ecaf1bc7a6931c2990ee418333691f970e419909b69bb895346d877f2301dfdef1dc5c1a6c9876a09f7e0ab3326910121342f33f473865bf19cfad4ec5706ee51ae51155869b9a7b40652bf9165e3ff18e3292806f81549fb2b135f08c6c0e83902fff91d75080e6ff1b9b4aa783d2eb242dafe641f6882192aa2b90e05f784795ccad219e5fb941d0e906033fe6b43f24f395919d968fafc33f56a0cafc055f445d0fc7375893b72c71449346439beed26710f667b03794c4a645f1808ad7fb9ae15e48f99670b53489156cfe620f8c8ef301220262b0977af9e42d59b18bca0f399e80fa6eafbd5f637f915c775d8b0b710788bcfeb2d771b5fcf1f98385b6136b1d333d1fdddb247c5708ef3b8df6289c8dcb4f1c08f210ae52a4095889e18c28357cd16721c071a975d072fb711a12c3291ad01f4a1ca45155fea96988d151144edb584d77208f7ad328595ef86c7f0f47195082c23f31e7388def9ed679b76d05fafff96e5d6f703a74a262d77fb75516a80834a8bc77a224614346bd41c186a3403e37fa921e659c4436ed29c83463d42cb3d50cd79078c4380511941cce80a9171b348aa68c07d869dad727ebaa6e7a99e65103f355ba142fb819486e6e66a32662b327b6d42ceac59a4ae7205a0bb2108814bfe625f7c4b7a1f13a614c78ce34edf5b3aecc5699d96f68871de1dd28bf4b4512c6e1659288f6a9092f4bf0b1af7db3e6ee30a5de218e7cc5ac3c3c8d596d9f2307b2e64c517198a58af9450ddea12b52c1e635cfd94a44309ed6664066dcba939ec9bea99789e3edb2fba431846a7a8fe6d6cac78c61965c266519ee2c91dfdfcdce09a22b1efbf8e50b9ac6fdbc7cac632d837a6be6ff25e4bb4066bc96a89e92baf6ef6d867231c94c136f83407ee5482a826566da6358d094c4c5ea78a3f70451bba461c4a5d234ad45b95ab84e504d3cbc61da863513125f510118986fd43d67c20854c5d95ab81b99f051ea6737f31ee0f4cbb39b046c8c1e5cf51ceae4ba510fbddb2502928cfcf72d4060415690cf2bfaf49e56305f64d21a6bcb7da576de12f754c564b7cb6ae1945017df0c3f4835f8d8dc9297db965cf7195fa548bb9486a76ebc6678508d9a8586ffde446780d8434ab37115347e0a77004161b2ddbbca63198ad61e3fd864e74ac57c67e302494ff60ee76ef924033cee831d42019cc3ccb10fe74c6f91825d1b4c6faaf43a250291569cf2217199560609c56ecd01702783b460e0b20cf0cd4813b869004c30c75268f78c549c753e4f928a8b99a980711ed05334b9e4d3902e37ffd4867f34d40db0bd124133f46f19dd8a8d9234653a51696cbeda7f655bf111f6cd33bd9246aac7ad49121d2231f8969323bfa54342480260dcc5f33f5e9b2d078cf31ffd43f4b84edac6e0c113e1256d18f7099353f0163272fee00de925905614217eb68cc22bfd405239e57b8aa11bd251e95c55a0f214f0f642497359dc776c1ce87f4c41b9a386c25c4fab1d9bbfc46a5f558ff54bfde251ad4c3f5505f5007f2445a3c27201f3f00cf124229fe843595894c236af0816aae9d5a2aaa26a0b82a77af54b3dd58388ac2eebbaaa6f676dda8676842a0c17eb668f77f7316c8754f2c15971c7e50fb7185d5799f2b74732bef5c8514656ba87f8ddf998ba22715254611cd2a52c8999c3c30021fe07bda290115fe309a9922ddc0ae22b8689edab15aec121509f516a2ae611e2a9a099783aad0fcd2d097695357cb572778bdb5e320aaa1cab6b41719ac929d73f240beebec45f08aa8a83781caa1bdc2f85ba45a37b7dea253944d25ff126719574837bf3771b52ab86b55bfc2a3765f1e90ee132ee18093bf6818d149f3e9044b131cd1c965a61444c2083c979900b5ee24093964a5a2e5b8c4d4733c7a80ad2ab7bde922baa793739dd5ee1a1513c019c178b8f417d9ec936e3ad07d0ff025feb1590095ee9a1a1a626111331a5eb98fed6f8462dd13a054f3095e5dd8fb958e43a431f55dad457e624d82c0fa82d165a9a497c0eebd738a54fee8b35cc8cb60c241e2611222cc9e19c1b2c10ee4c81a90bf7c792a2b68ffbdb13b73210fbe0f546ef2b4d22759231415e6ae83e359b12b0e5b8f20f78c4a95e030a63cc580cf31584deb3197a7fd01536552ae751c713aa8b1382d20fc5bcdbc77c8bb3f966bd17eebaeddce756d413c437abf2387852b8411e3a21d2ffe498c28e2e12ddf915a8b42475262a7a18cc74bc632a6b97c1b451ba609b02b01f131144dd5ab57877d95a26ea4a7050ce7b3d551ced4850e6dcfa952efdc666878c07446d2bf247d3ee00d7e4f26fb3ca3d35e68b3adb79cbf7fe0f4590934538687250ce4f319b5d69264dd6131d27e790edd2253295be69635e98c3284ce64bd631d94022380559b3e2de4e459aef4f5029c43de06ee6b18edb891b6c5ff25d7a383a07db98bbe916e67e4e16dcb2a7d731932f294268784a49a074cefa6a91f869bbb27230ecd2557fdb714345cf7f3156e103fc767a7e5569f5eb95be96f979e909555cd56974b63aac6375dbb967dab7c26ea73a8344583d9d7c1f3d76a84e3eba498eabe911dae2ee1e074eec6679ce4f43a09a59d463eabede91d185cb9a674dd63a698fa3a063260969359d33972fbb60b98a3b22cd8cd594d47fb9a590cb2e7b9e82bcd462d071a071995d1be378318bc31deb56c520eefffe3e66354741d5251b7f8cbb99149469b6d4df75bc31fbe0d9ae23ebe0ff70a7f46e99752ed4a58a2005312a47f57a333c6f76c3aab7d32a7c33c41cd533344bed1ed1c2fc580ab330304a0c41882a62cd0df6186e8d79efe3648782e16d045f882c1bf34dcd1f22e8823692bb69af8b5916d09f7a146953df889b872bd17ec7588bfb0f5dbc8cad80a272ae8c8b8b18185fa0331495f9e791ee8e756c8ddd5f2a05c7847b91e9e36a982fca33737acff1a16ec806a916e87f29be99f793d4ed86cbf84a7984320b9bbd9d6f59429dd84901a1aaf1ef922537f17d2a3eb3f5f8193ef278fb13bb6f5a10374311787ab27c3b43cd69d87710a416d56515711a9383717de5ee71a65459bc33840af9a6151a685732b9f3b50f80b331410d43853f7c76f3e297011f46a642260d3607e9bb28553d14a273e192c270fc0e14dd146809a2e702daef250f2cb417b21dbd1836bb90d91f08e2d3359eba0c41fa50ddcaf612466e8acf4bb9118eb1f0b92f33276cb003bcd12fe241b896eb99f1542cd7c84f52b6c143548b8bd4e24f7a0a1fb46237db4b3921ea6d0c6754018a1596e7780aad1a6b4e9dc5805dd7955beacbf42bdcbdaec61ec11325c3006a13e3f849ca6c336721b26b99196c0c0409d3152823464b29915a883e72162bf2d94f3e3386effb1b83fb34ef0a91763364db277bd3c296cd20cd7252a9dd649f80bee489eff2d3920c242205bc9d28b048039f11e26fe7f7b42db556eeb390a76eb9c837e6a023e199f7d9ef690056d1b4335cfe6509aa9b124261c8d0e174e39a1bacce2ad1faddefd0ff80157f555ede967d960156ceda8b0c7ae82d081adcd30cbd067511c61060de07feb51b6595669eba94afd587f2a086b01567456a92e029d72795f625228186aa1256f9b1339f7b8769374f02fd7ea47dd0bf5ff1b772ae45fcc333fac7a343e52aad56739599b48853f57e131ba7e52e813a17e0b902603a541037cffb7be541a9955c65bbc3c36f41509afbad7b8b064b21a4e327d5889a6db42e55a8e62df808d0f4c4b87e5457468337130fb18dd2d6dd8916d2b1322a4181ab57126f0aa0eceac9a7a812fb7ee63b5ebada4b130c913f7b2710442ce125eddaaa517bf62951047c12e9ea0c821149984b15c12c1d01e0e63a8595aa2b762d6782a5aecdb1bbd91834966c14ce18f97eaf64a656f1a396fad47acfe929f1178f4cad4c3150c4a4509c15d67911c77ecc44701415dd88a1e66c72e8ebce270b93b81f03bfdd66678d4290aac9e4ff8cd31ad7a673297c8342f7d600a3e3910c2e41ddec93a3aa94c7020f749ae4f19dac4303aa867973d4a9a86df6777f7e763becadeaf39e400fec0899e83597a70413f4a12b6e270a3080e6570ff09b3780b351ccf0d016921003e45d21f53cfc958f698ecad08b047035064ede054bdf4130518e5e5f536324a52e62cd8d26561e3f5a2d31201dd6afeb33cb8c0b3539426eb5dc9cb6bc260d3b8f30e35955147c29044bbc0424ab77306efc29283018f144a3df01061b17a357199f60bd25ff38b434a37321205b894db7b54540aeae0bcd10ab88c86cbe30cfab2c7e6f0b1c60ff7700db01883f8834f80adfaeb0f877a2bdee67ee054698f8c810a635da3330b63eda616578ae47dc70dcac47881fd177a0fab895f33eebd891d66c7e49e4f7daf8dcea577bc0a2afa3e50c21a15a1353bcb3d1b2752e8f4a4f0f0ca10c1f53fe3e8d249b1905856a7ee8c3cf6d2d9d39467637d5708df3f1b475c29759c27693b0c0617ea0c5e211cb670b77e2003090571cc2affb386ae3da9ff35669314d644bf9638cd08d7b055e20d307d1369dee3ac60272d9b33305a6f78efb5c95d44e1c3157a2f1eddae06354b98db70932c1c1ea69b41d05a03bf8ed40807ec3501454655ce3dce890ba39dac19afea7aa9fc693ae241e1b1530e5caa0c436d9fcc6a76bce95699c2967efff495f84e8f71b50f2f6f4628cbbab2ee21751bffa80b2c88f0a84eff63cc38e5dbad1bbf79ab35bed98131151c67c72dce17a60719e80ec5751aa499a39c04361cf967f51644488450e3b2c20214eb58a5e2df9202667d3d0c9bf3b2714fbbd27facac817b31c1d323cf1f17092d80b29b2a8bee9f0b800fce95141f3c0fbd7c529a62865e0c8719d641519359ce4113001f0797fac739401a34c13cfe20351c10762d4df6d2a023", 0x1000, 0x2a}], 0x1008, &(0x7f0000000240)=':\x00') ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:33 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000003a10000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:33 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf0ffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:34 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x700}, 0x0) [ 975.773373] binder: 17190:17193 BC_FREE_BUFFER u0000000000000000 no match [ 975.802701] XFS (loop6): SB sanity check failed [ 975.807540] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 975.818696] XFS (loop6): Unmount and run xfs_repair [ 975.823765] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 975.830491] 000000008242875d: 58 46 53 42 00 00 10 00 00 00 03 a1 00 00 10 00 XFSB............ [ 975.834295] binder: 17190:17193 transaction failed 29189/-22, size 0-0 line 2852 [ 975.839420] 00000000e85327ed: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 975.855831] 00000000f8e240ed: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 975.864728] 000000003d03ddaa: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 975.873617] 000000000b58994a: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 975.882520] 00000000df86ebd5: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 975.885653] binder: 17190:17220 BC_FREE_BUFFER u0000000000000000 no match [ 975.891410] 0000000042cea28f: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 975.891435] 00000000779abb86: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 975.916240] XFS (loop6): SB validate failed with error -117. [ 975.930262] binder: 17190:17220 transaction failed 29189/-22, size 0-0 line 2852 [ 975.954993] binder: undelivered TRANSACTION_ERROR: 29189 [ 975.966093] binder: undelivered TRANSACTION_ERROR: 29189 08:56:36 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x16, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000000140)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) timer_create(0x2, &(0x7f0000000040)={0x0, 0x1f, 0x0, @tid=r0}, &(0x7f0000000080)) tkill(r0, 0x1c) rt_tgsigqueueinfo(r0, r0, 0x2c, &(0x7f0000000100)={0x18, 0x1, 0x0, 0x8}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x4e21, @loopback=0x7f000001}]}, &(0x7f0000000280)=0x10) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f00000002c0)={r2, 0x2}, &(0x7f0000000300)=0x8) ptrace$setregs(0xf, r0, 0x800, &(0x7f00000000c0)="7ea4ab3ba8f59f9a55b8a11bf934e3874078c0477c903f638a941db937bac720e075da7f8f17c303b857ad2257dd3e2d6197") 08:56:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xfffffffffffff000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:36 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x0, &(0x7f0000000380)="3430bbb918e3e889adad321b8e9c0cc8290e38ddf14e408f863b49eebd2b0bd78626156a5e0a18c4f77fbe03b01b5d0a847f0fd7768b9ae92d5bad81d3530f2369f9f89c21bed54a1610d578e53e57f9") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/mixer\x00', 0x2440c0, 0x0) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xc) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r0) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r5 = msgget$private(0x0, 0x1) msgsnd(r5, &(0x7f0000000400)={0x1, "b998d9b21356878acbe5f12290e861080453581c82298940dbe7761dc81eb72ab1ed2ff7c27ba9b71707f415ef1c8e79b8d1a2d9c2cd2d5b17b875863b248f3740cee1e0e41aefc89cd345a01da47a375469fd7ce82f2046431733de6abe3200fba2638aff6ad572fdfe51e40cdd1805e16bff9f1a29a527d1c0f9210e1278449476f51959a54f3339abd3a012650fd058dbd494c2849691ecba607423a440648de98a2a56a937bb65fe6cfafcf16bc01bad8ae551b1666b221f6d9cb804cb0fc40d56225f0ae0f6d4677280bbe3a428"}, 0xd8, 0x9b30acbe0a8fbae4) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000002c0)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e22, 0x800, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}, 0x4}}, 0x3, 0x10000, 0x20, 0x7, 0x25}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={r7, 0x3, 0x4}, 0x8) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) clock_gettime(0x0, &(0x7f0000000300)={0x0, 0x0}) futex(&(0x7f0000000280)=0x1, 0x4, 0x2, &(0x7f0000000340)={r8, r9+30000000}, &(0x7f0000000500)=0x2, 0x2) ioctl$SG_SET_RESERVED_SIZE(r4, 0x2275, &(0x7f00000000c0)=0x9) 08:56:36 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x500}, 0x0) 08:56:36 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xe00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:36 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000018a100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:36 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pwritev(r1, &(0x7f0000000040)=[{&(0x7f0000000000)="f3d9559f68a5c98ac508ccaf4b88d3aa67ac6f28c6fb003a192a2b4a", 0x1c}, {&(0x7f00000000c0)="18dcf2d0757e7e11ce6f4bcf7b3cbfabe0648fc71d5e60d7938a29334127acb66d7b898d3589e740101fb570d071bafd9cd2a97481a577aa14f3491c985259c835d5652ff0ae0d0e4bbcf56cf1eb86eaa9f7e21b82d90186c4eaf2c752fbe587a59e4ecc1c0cab2d050eb455346867", 0x6f}, {&(0x7f0000000140)="5294985291f1660c2e4464bbedf05c42fdd0c536dc50e08cde1e68e97a5a0495d13b4b7614ac89061a1a2b992ec903ddc52c24443738b2030d9a55be4dfe5bbd540c92d51b35", 0x46}], 0x3, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB, @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:36 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x0, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) [ 978.345136] binder: 17242:17243 unknown command 0 08:56:36 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xfffffffffffff000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:36 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xfffffffe}, 0x0) 08:56:36 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x2}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:36 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r1) getpeername$llc(r4, &(0x7f00000000c0), &(0x7f0000000100)=0x10) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000001400), 0x0, 0x20000008, &(0x7f00000013c0)={0xa, 0x1000004e20, 0x0, @local={0xfe, 0x80, [], 0xaa}}, 0xfffffffffffffec3) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) syz_mount_image$iso9660(&(0x7f0000000140)='iso9660\x00', &(0x7f00000001c0)='./bus\x00', 0x6, 0x3, &(0x7f0000001340)=[{&(0x7f0000000200)="517f8935ea11db827c12a1511a3a93f728b16b7a66c0db1a45c69bcfb0", 0x1d, 0x4}, {&(0x7f00000002c0)="785ae20e7b325885afc555d1f80549111be6c47f3aa28a81669f3b033cf7905859a8a0226a8ae63145fe1b6385258b50947be1ff31522f37801f1308dfde16d54a19b8dcfa246e11af120cb8f846aebd7cb0a91b208240962ea7e8443a86992e27b314d4534a", 0x66, 0xd29}, {&(0x7f0000000340)="2da57aaa520b9e4a499ff7844ba0be552aeba023ec850321fa802a4fee777fe1485cb2c38aa5383d0d74d83c3f7a81e416f5e9cb08e30cee1622d6169c1d3bbe5916df802ba98df3cdd2b4a33643a6d360221c7677b75d9347faab82bd4978f922a4119e942cdcfea42ec3d977afaf4b0f0b9454692b8d0d2852a0e91787ff7791e5304a0f6eaa91034d22c867e67a9349ed49469194b21f79ae263734db5633def761bbeb12cf8b7508d94e96acdf7b67da3a9eee3128d18143e248f31b43eba647763619da3c2dbff3122c767a3e9a118cb80a1840ff33101b9b0edba5b223b7f3ef93f0316322ebf9de3252fc0f7a8c273be2aa17c3e5cb96987c5a4139d77d3b05cb1ab6bf496874e6a7060763d7d83cb8f3eee6829464a24446b8854c92f63c50aff44461d7b6bc04c0e0db32e0556b00f228188fc267641d10f7a478eedf12e6558b249096d467d33c81bf3ca85a111aaa8ff0b7e3162cdc959a0aaa18531c06c09eadbb9751bc7c6c14e166cad45f08a16c722f3912e9ee7f57aba9482a56946988e1b715fa119311a2028c0634a717e13be17da7fb907290f6550945b666e5f17b2e3cefdec392978b7b7c0bb5ee3470a7e895842769df2d451dd9b9a6b8ab82639a682ff3cd821d66449acc21905951b995eddd7eda2ea5249f2ba915784d94245e079a03c0c5ab7f1d60199c12d5fd0f228ae9d2b04faf2a5745219573ecba1c4da1444b6ad29cb852d2913126db2736a59cf08f6790492c2b92b46b531eb8244116b91483b64d25969c21dc0ff52daa18b37287c8c9bdb82789ef5c06151c12aa5826f00e4c624b7d3ea7169226bba9d6edeb53d54709df5e766a4dd4bc6cb62e3a00830db027365860d504f440f246a2ceb5177b0b6be493c2ae2686239346a4b03cadeb252efad990c03d14219d4c95d0ce38d028302fddc0e51c1327428ac9d44a7aaf33a8d39c286a68d3dc5da9d8c184e98a4650e003749fb0c68cc99c84e73ab3ea4256ddf569e8c43b0c15adf0a8918293b69aa566bb2bb151db69c06426f02aa1a3958c9e3375965fbfde28d67d80492af8f986d5503f10fecdc10fdfadfff1acfee55c0ad3adfbd011dbeb451f23882eb3c5b8fc3e78d9a75cf50272d25ce4a29406c46ac6a340245d37f8237526d5af9292f2d7ba5415cba3e55e0d3b9f6b66fb1bb9c8a1151797e8bf34d69023bc898ba6a48455bce31b5e4072681f555f3a7c4e1143364ea706c7aa5238c29fa3c75369ad82ea561255a43437a77a84721b3beb461674181927794cabd56617a1cbfc1dd273c86fd2246aadc1dd2ba4360b0da9ef6c851bf736beb73241adeb775645cdb37eb47c866e947b0a6470124066f65a3247cd49ffb868f83bcbbdf923a26a9a02873e943e59a495f66505a2a316a5589c316cefd3c833164b3d0c22809d3299ea96e4eadb7c503a0c64c55b44dcc1837503e0062d456f75a9a564d568d1da440335c37a65a7527475547412f00b4c190953c85f0932f9158bef5051371248b8a6ef13dc1c8db88195ffbe78e79a5a11af53f15766ebc9b308e8f60d4fba162573ffe937880352050cd61adc8e8f2544f9761686e2be4394e50f59afbdf084a979a3f7a2a2c5beecec69f2d6235a1579ff4aa4c76607824e4ceb19014d3bd9f413cf06d01e2e448cf603fc5626ed2d489b111ade01f8e01383aec87f7a7d15ec0866d6d3efb3a375e56d4230f8287e7b251454b970c660da1dd81a878d4bd2daeef5f5f4cf224bae9dec086ae549d0647492477ba860f6f02ac7333d73cb46d4365d178903fb0bbddf208886d1b345063513004cbdb8d9fa13cee9afe58a2da287eaa290ccb90e0bf990df17bfaa28b73a6c1e88b572bc00651ee5f7a5a6a5f180c57e7ab0e49cb979b2e07af2daa8d557d964aa3bdb6ce158128008a3e094e1e70092015533acd893b6e7e8ba4ea0723046ace5079ade3e4a2bf9a20a4154de4037efef2e3eb44607b86c3e5151f74813404737c700fcb60f6190c786b6ed0751ba9eba9309ede05c888a8468485792bcb4e51d6807ee78628727b8dfb294d1cdf0cdfdfa6039527ca20428baf7cb262f3fb57ed9b75ef5aea70de6f84c912bfe106a660e14fa9781975d8ca3c93719f1620d0e1b486ef6840304aa36e266a3d73c01199f120db8ce566c694980753640bc780ebfc2b23dff8d0bffdc1781f884ea8f86ba5234e35e83e02a15dce55fe95533a24935b24ad7b68a03b92a452a3e78005de25908b3656ac1880d4bff4223ecb55243e4fae7f785d460172473936b3bc440268c1579461d6ec4e464640ae5c806c046c4a8567df78b50b99493a3a8f4c0128c5a0f5492bf3deaad565b5e310896f82227543f355709a3509a0a9d38271d63c4808192b6ceda7762e1c89d5b421104a55cbdf5c95296da3e7e6eca92a6ec6e21bb0dfb4e7c63b64705f68d48e377afbc3ef51f62d552c2183fa045ca26e1574398a34a5fa07e30410dc69175a3d8d16e906347829a99aac87cbd4ae9f8332c3d5fd565fa815a2b97632a01b4f21b03128026906796d6e6e65e6d7e9c179068c2623897ab41bd04275a93a70cd9a3ff4d1b2c52bc780b6d75e7b7d454de4a03c495e45036e021704c8a8eb9bc85f4a9bdd949337a98a83453541f36a03b75b94d4ea1da077f0ca6145d2ba8a66b8881f9ff8629472fcd544f1107ecf48859d37954d0a2e65d0e4bfbe14bce10c67d7585495b747277b6e3915348dc24b08347ddbee0cef216d2fb7df96f62779dd2583f3161daa536d67d58f6c3af9dee436738523550abb13b5029def09e113e8bf308fff95727481f6ef89ce336c438d2a5ee7184fcd7ce13a4140f87b485125ea857404eb3abef6804e72e15174b135d6bdb5b71bfd00d1f01f21f0f7affce159c342bd837ec223a3add2b35f7f281f015644cd2a2336bbf91deb2859dbd5195691f2058e63eb828b551b88691b77740b11447b2aee91905ae37ad00a83762ed654b338c69533a8a5752b32d66f6be9f93bcca91188ae602f2b5c88a5ff2184a357c008ca067127fe8bd9656af9335f142d32de3e5ac2759e2303471f141282aa2082c9ea8587161c875400c8a4611245fcf8dfdc0df3300c32e91966bc8d902c72bd8a6d854c677e920f08cda9e3bdef8e554aaa7f813fabbe2bc00a877a4ae8a2be1a8b3473701f5e5bc829993d151184e18548c166532cdc554fa143f5b31f4cc43b1ba54e171643e1fadc0dca2752328d9d204828566cae6afcb705a5d1703c898513b1266e85e7f61eaa120eb3d3757412726b450d8813fd3b97ddb6931ad53596b3578852ed8d07ef750c49ea9d902c36bb787bde969c31749fc359049ae42778f354983c3ce2bf4f8eaa06a8e2bc5219987eaae6522ba7db5e15811c1b113e25bf9ae60cde8512347277783800c98b49738e22517a643503d628937353e5d007f9f5eb795cfcae708c5d08c2bef38ec7cd58979e2ae5204fac80f3abae13919c17859876853174ec736a73e935016cdb2ad58606c8b464b99324526bcd7f86c7df1d6c56849cde9a8f530d07727defc838f105682fcd7308a92601047d662a98cc604cd49c3200d301ec4c3a20eb3ad11a3d026ddef5ead81245daefbb45489b3773a5903bec1a95e685e9ec44f55fee9fdec4db7113d7000fbe0acdf463751984e6fd3bed11e220a7db5ad0f201ed85643038c2a42e758337d622246001a507617a6efc1d097d82f950f93fc240ab4375f436885b6ee3a6ef8b8b607c3579d5886a924e8424def74a763492725fde6848e646ef1ab9ad6c004790ceda02df09ad6f00ada685fc9e2f5dac9e94a8610ae69b86466cc7dcb904027bdf27723c555d00f13d034617f6af086aece76acca314b5e5b791e1ca2aeba4ff1730f50a26d1ac0d7482a229cfb2d6837699005dc512a1930a8997e3edaea1e5b7380547da4db00721ef83de3bad1a3847017645f6a6bfa04917754b779f9f8c78acee659866669470ffee0ea88205f3ba7e009fe30ac8b3514e57bc251d60d0c28f030fdb13034ee439ccebf0a93cd32c42d5e8bdeafb3a1a0832518374ad8e7a2dc63cf92aa2475f168619418101fd7466edaec55f99d0db9a77f624989f22796c5bc5cef49c62bc70517d9dc8fe3f6ed5f047ec40cd782a62716066d501194f67b7f691bfd149246c22a922684a223e6ef6398a82193d9749e80a9c5188523772bc21646f7ed7c3391c075b531abb6e9b798bc4c407e75368bb11761c3024860e25907c3e0ab2c44cb4163ca253dcffd0bc3e8da5040d77e8b7b5fff85649e76c690847bb0e1ae0072818704aa76494aac6dd1522d54e22071fc37acca0c5e65a93025d7c3f36258a9c61ced20378b17a09b9906dec6d6d3564a7a1dce461c139f4c87f00771f47fe2cf23b782a7853407ecb48cc287b7ea1acd58526aa3150827d7ea51e27dfc65c0915637fc0d7bf5568a757263d001644f16e3b975be1b8c9af88e649052a0cc7a50decba828b677ebc3a559db977d3c047617d4bd3bc33c25b09dcd34df9554c44a218423fd21b51453d5ac1f893ed52e1a5d0f88a7e923003fdaaf4f1055aa0b76af3ed5ab814882dff9758960723221cc2f6d6ee7b2794055f143f66466b8837a26bfc40c2a6e5dc9de96284e9dd7dfa1016843322a702afc5ebecb5b1b40de555e54da4e4de8fcd73fee3414477a7d3d11c72b6868c16e71c3a16241251782f167283279dbd512746171361f6d81754b74d63c11aa9b684308b4c7b50f00f5f345a78505b0ac187c9eb10938198dfd21aa0dd6de1b058984918f8d34a6af27fe872af6ee132c6d8641564ce60e74ba780a4f30c39749dbaf10dbdbaae0ff44399f0318b165fb9699293af0c66785473ca2b5d9b550a6a8e874d68ec9da1a0ac480aaa2ef00f19ab08e4d80d67f197add826c5d0aa0fd18e3e67fd1947aa736c3326d2f60ed58feed95d34c5dcafd296ec03930fd414605dece423cb4277849faa9bf5164d5117dbf1afd1a790a8ecf8ae877d05903a5edc6e5dbabbb955f0171c8860a661819d3c3a58052a5cfb9c0871a76dafec679aa131d36dcb147d93bf2f34272e252205a2abd031fd777b0c999532a2a7bd9bd2e1a38411c626338c2d81599140c0fb65f501e59f49f349b7b55f3ca0c237c773d9df84e93b7388c0e842555831f29c7735ad7bfe46f5417ac5faa52375454bc5c935e0449af3fb73ad6652b86bbdb38e474b6eea2b17e3749bf566d4a35c405481e8930abe44549546bf4255c5ee958935c75365d45b4f5e76316ea4eb7f727c8850271ca7d3b40aad0147e79d9fff6878e554950d3f9c9be197ca82c4aed88508c512626ec2a454d073a6862e7742d0aab38aadab9f12bee61cf66fa15a0fac21a8c4eddafcdced8f00f0b74f20e17f9c2730465ea90c37a5f81512ef48a1859ae73f491a74fdb3070c6f0215c464858a389a6964ee369a56b60612a245b92754b6eb3678690fb2bf058173755e937870cb06090ba3a43dac44159cb3f7c3ab3bd0fe9b40fdf12f0d9a9ce19590c784e7c8c2d63db32b5c9204b50beebe1973936fb3a010987d7091387ddcb12296630bd049424b630b402afada23d3157437bed287da4b2b2732a8f66dc73fae2dc81e7d09369c571426aff78ca03786373dd25ec026b03f5dbf36e8e0dd962e465ae09db4e58d8f2f5b8b51f44411122dba5976a31f330d33e035d1c95599245842179c742ec8d727182f0bd131db28e1d167e81c674b4d3fbf06e0c7155fb063bab", 0x1000, 0x8}], 0x220000, &(0x7f0000001480)=ANY=[@ANYBLOB="546f6a6f6c6965742c63727566742c686964652c696f636861727365743d69736f38383539740f00006303000000000001006861727365743d6d61637475726b6973682c2e657373696f6e3d305830d89e3030303030636861727365743d6d6163637972696c6c69632c004bc0e45950fd583d628e83c9a0990b4f84ccdf0000000000000000000000"]) [ 978.371652] binder: 17242:17243 ioctl c0306201 20000700 returned -22 [ 978.407615] binder: 17242:17262 unknown command 0 [ 978.433119] binder: 17242:17262 ioctl c0306201 20000700 returned -22 [ 978.454785] XFS (loop6): SB sanity check failed [ 978.459637] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 978.471228] XFS (loop6): Unmount and run xfs_repair [ 978.476302] XFS (loop6): First 128 bytes of corrupted metadata buffer: 08:56:36 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x8000, 0x0) accept$nfc_llcp(r2, &(0x7f00000000c0), &(0x7f0000000140)=0x60) ioctl$SG_GET_SCSI_ID(r0, 0x2276, &(0x7f0000000000)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0363085b", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) ioctl$SCSI_IOCTL_SYNC(r2, 0x4) ioctl$void(r0, 0x5451) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) ppoll(&(0x7f0000000180), 0x0, &(0x7f0000000200)={r3, r4+30000000}, &(0x7f0000000240)={0x1}, 0x8) 08:56:36 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 978.483015] 00000000a75d0739: 58 46 53 42 00 00 10 00 00 00 00 00 01 8a 10 00 XFSB............ [ 978.491955] 000000009d63ae72: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 978.500848] 00000000bc34054f: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 978.509764] 00000000b0b00667: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 978.518653] 00000000bb712eb8: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:36 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x1000000000000000}, 0x0) 08:56:36 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x3e8], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 978.527544] 0000000013a8dc88: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 978.533734] binder: 17279:17281 unknown command 1527276291 [ 978.536427] 0000000087fe1179: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 978.536439] 00000000e7c963df: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 978.561110] XFS (loop6): SB validate failed with error -117. [ 978.667843] binder: 17279:17281 ioctl c0306201 20000700 returned -22 [ 979.339875] binder: 17279:17304 unknown command 1527276291 [ 979.345625] binder: 17279:17304 ioctl c0306201 20000700 returned -22 08:56:39 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x4000000000000) getdents(r1, &(0x7f0000000040)=""/68, 0x44) 08:56:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x800000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:39 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x200000000000000}, 0x0) 08:56:39 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000048100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) pkey_alloc(0x0, 0x1) 08:56:39 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4400000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:39 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x0, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:39 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x40) ioctl$KDSKBLED(r1, 0x4b65, 0x3) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000000)={'syzkaller0\x00', 0x8000}) 08:56:39 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x88470000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 981.400530] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 981.427352] binder: 17326:17327 BC_FREE_BUFFER u0000000000000000 no match [ 981.443067] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:39 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x900000000000000}, 0x0) 08:56:39 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r2) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) recvfrom$inet6(r0, &(0x7f00000002c0)=""/214, 0xd6, 0x2, &(0x7f00000000c0)={0xa, 0x4e24, 0x7, @empty, 0x6}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) ioctl$BLKFRASET(r4, 0x1264, &(0x7f0000000100)=0xbc) sched_yield() r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:39 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8035], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 981.448751] binder: 17326:17327 transaction failed 29189/-22, size 0-0 line 2852 [ 981.462649] XFS (loop6): SB sanity check failed [ 981.467512] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 981.478677] XFS (loop6): Unmount and run xfs_repair [ 981.483736] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 981.490437] 00000000c128ffdc: 58 46 53 42 00 00 10 00 00 00 00 00 00 48 10 00 XFSB.........H.. [ 981.500064] 00000000d6cfce34: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 981.508959] 000000000dc64ad6: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 981.512143] binder: 17326:17327 BC_FREE_BUFFER u0000000000000000 no match [ 981.517832] 00000000ce3b5162: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 981.517845] 00000000b0eb7601: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:39 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x543], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:39 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x200000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 981.517855] 00000000a0f7fb47: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 981.517866] 00000000f24d580e: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 981.517876] 000000006e8095b4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 981.569407] XFS (loop6): SB validate failed with error -117. [ 981.581256] binder: 17326:17327 transaction failed 29189/-22, size 0-0 line 2852 08:56:39 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x8004020000000000}, 0x0) 08:56:39 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x102, 0x0) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r0, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000180)=0x4) r1 = socket$inet6(0xa, 0x1000000000000, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) [ 981.628954] binder: undelivered TRANSACTION_ERROR: 29189 [ 981.662989] binder: undelivered TRANSACTION_ERROR: 29189 [ 981.673020] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 981.729740] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 981.846794] binder: 17362:17366 BC_FREE_BUFFER u0000000000000000 no match [ 981.859075] binder: 17362:17366 transaction failed 29189/-22, size 0-0 line 2852 [ 981.909493] binder: 17362:17366 BC_FREE_BUFFER u0000000000000000 no match [ 981.909818] binder: undelivered TRANSACTION_ERROR: 29189 [ 981.924329] binder: 17362:17366 transaction failed 29189/-22, size 0-0 line 2852 [ 981.945299] binder: undelivered TRANSACTION_ERROR: 29189 08:56:40 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000040)={0x0, 0x3a, 0x0, @tid=r0}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000080)={{0x40000000000000, 0x2}, 'port1\x00', 0x20, 0x30002, 0x1f, 0x2, 0x200000000000000, 0x200, 0x5, 0x0, 0x3, 0x7}) 08:56:40 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000378100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:40 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x86ddffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:40 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x103}, 0x0) 08:56:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4800000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:40 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, r3, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000001380)={0x14, 0x0, &(0x7f0000000300)=[@increfs_done={0x40106308, r4}], 0x0, 0x0, &(0x7f0000000380)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="117e484000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) 08:56:40 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x0, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) timerfd_create(0x7, 0x800) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:40 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8004020000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:40 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x4000}, 0x0) [ 982.412872] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 982.436808] binder: 17391:17392 BC_INCREFS_DONE u0000000020ffa000 no match [ 982.441234] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 982.472339] binder: 17391:17392 BC_FREE_BUFFER u0000000000000000 no match [ 982.479469] binder: 17391:17392 unknown command 1078492689 [ 982.495712] binder: 17391:17392 ioctl c0306201 20000700 returned -22 [ 982.505759] XFS (loop6): SB sanity check failed [ 982.510625] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 982.521766] XFS (loop6): Unmount and run xfs_repair [ 982.526821] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 982.533525] 00000000a5e40d4f: 58 46 53 42 00 00 10 00 00 00 00 00 03 78 10 00 XFSB.........x.. [ 982.542404] 00000000647f45a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 982.551274] 0000000002510277: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 982.560156] 0000000021f779db: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ 08:56:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = dup(0xffffffffffffffff) syncfs(0xffffffffffffffff) setsockopt$inet6_tcp_int(r3, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(0xffffffffffffffff, r4, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:40 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7914000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:40 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xe000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:40 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x40000000}, 0x0) [ 982.569315] 00000000626918cc: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 982.578218] 00000000e23e14b7: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 982.578374] binder: BINDER_SET_CONTEXT_MGR already set [ 982.587213] 0000000068a82233: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 982.587224] 00000000704c12da: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 982.595408] XFS (loop6): SB validate failed with error -117. [ 982.617148] binder: 17391:17422 ioctl 40046207 0 returned -16 08:56:40 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) openat$cgroup_type(r4, &(0x7f00000000c0)='cgroup.type\x00', 0x2, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:40 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xd000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 982.636364] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 982.638413] binder: 17391:17418 BC_INCREFS_DONE u0000000020ffa000 no match [ 982.670103] binder: 17391:17392 BC_FREE_BUFFER u0000000000000000 no match [ 982.677198] binder: 17391:17392 unknown command 1078492689 [ 982.711404] binder: 17391:17392 ioctl c0306201 20000700 returned -22 [ 982.726802] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:41 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f0000000080)=@add_del={0x2, &(0x7f0000000040), 0x4}) tkill(r0, 0x15) getitimer(0x3, &(0x7f00000000c0)) 08:56:41 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xe8030000}, 0x0) 08:56:41 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000014100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:41 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = getpid() syz_open_procfs(r2, &(0x7f0000000140)='net/anycast6\x00') sched_getattr(r2, &(0x7f0000000180), 0x30, 0x0) getsockopt$XDP_MMAP_OFFSETS(r0, 0x11b, 0x1, &(0x7f00000000c0), &(0x7f0000000040)=0x60) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="1f3264f8", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) sched_getscheduler(r2) r3 = open$dir(&(0x7f0000000000)='./file0\x00', 0x1, 0x2) fcntl$setflags(r3, 0x2, 0x1) 08:56:41 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x3000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x60000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 983.282672] binder: 17457:17459 unknown command -127651297 [ 983.306521] binder: 17457:17459 ioctl c0306201 20000700 returned -22 [ 983.342307] XFS (loop6): SB sanity check failed [ 983.347149] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 983.358362] XFS (loop6): Unmount and run xfs_repair [ 983.361258] binder: 17457:17459 unknown command -127651297 [ 983.363422] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 983.363437] 0000000040ad5a7e: 58 46 53 42 00 00 10 00 00 00 00 00 00 14 10 00 XFSB............ 08:56:41 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) connect$inet(r5, &(0x7f00000000c0)={0x2, 0x4e23, @broadcast=0xffffffff}, 0x10) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:41 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8847], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:41 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3000000}, 0x0) 08:56:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x4800}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:41 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0xfffffffffffffffc) ioctl$FICLONE(r0, 0x40049409, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) [ 983.363454] 0000000007e32657: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 983.379221] binder: 17457:17459 ioctl c0306201 20000700 returned -22 [ 983.384675] 000000004ac7bb42: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 983.384687] 00000000d9f16668: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 983.384697] 000000006f151478: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 983.384712] 000000003f4bdbf4: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 08:56:41 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xfffffff5], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 983.436054] 00000000e6c574da: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 983.444973] 000000007222470e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 983.453896] XFS (loop6): SB validate failed with error -117. 08:56:41 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2080}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)={0x64, r6, 0x200, 0x70bd2a, 0x25dfdbfb, {0x1}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x14}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1b}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@local={0xfe, 0x80, [], 0xaa}}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x10}, 0x8000) 08:56:41 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x31}, 0x0) 08:56:41 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x2000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:42 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e23, @local={0xac, 0x14, 0x14, 0xaa}}, @in6={0xa, 0x4e21, 0x8, @local={0xfe, 0x80, [], 0xaa}, 0x6}, @in6={0xa, 0x4e22, 0x1f, @mcast2={0xff, 0x2, [], 0x1}, 0x4}, @in6={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, [], 0x12}, 0x9}], 0x64) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x77359400}, {0x77359400}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:42 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0xfffffffffffffd8f, 0x0, &(0x7f0000000680)}) 08:56:42 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x104], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:42 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000200100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:42 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xfe80000000000000}, 0x0) 08:56:42 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) execve(&(0x7f00000000c0)='./bus\x00', &(0x7f0000000340)=[&(0x7f0000000100)='syz_tun\x00', &(0x7f0000000140)='wlan0\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='syz_tun\x00', &(0x7f0000000240)='syz_tun\x00', &(0x7f00000004c0)='syz_tun\x00', &(0x7f0000000300)='syz_tun\x00'], &(0x7f0000000440)=[&(0x7f0000000380)='syz_tun\x00', &(0x7f00000003c0)='syz_tun\x00', &(0x7f0000000400)='system\x00']) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r1, r4, &(0x7f0000000480), 0x8000fffffffe) [ 984.206207] binder: 17523:17524 BC_FREE_BUFFER u0000000000000000 no match [ 984.217373] binder: 17523:17524 transaction failed 29189/-22, size 0-0 line 2852 [ 984.269615] XFS (loop6): SB sanity check failed [ 984.274474] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 984.285645] XFS (loop6): Unmount and run xfs_repair [ 984.290702] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 984.297408] 00000000deb22806: 58 46 53 42 00 00 10 00 00 00 00 00 02 00 10 00 XFSB............ [ 984.306287] 00000000492d5373: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:42 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:42 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7a00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:42 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xd00000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:42 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x800000000000000}, 0x0) 08:56:42 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) ioctl$int_in(r2, 0x5452, &(0x7f00000000c0)=0x3000000000000000) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:42 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x100000001, &(0x7f0000000280)="025cc83d6d345f8f7666d2") ioctl(r0, 0x5, &(0x7f00000001c0)="31b18d67e6d588e2f5ec08f92093809f2ea1d2a0a6") r1 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x101, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000000680)}) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000040)={0x10001, 0x80000000, 0xa, 0x931, 0x81, 0x5b42, 0x1, 0x0, 0x0}, &(0x7f0000000140)=0x20) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000180)={0x4d47, 0x0, 0x2, 0x3f, r2}, 0x10) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x400200, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) write$evdev(r3, &(0x7f00000000c0)=[{{0x77359400}, 0x40, 0x6, 0xf62}, {{r4, r5/1000+30000}, 0x1, 0x7f}], 0x30) [ 984.315165] 00000000e71d30ad: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 984.324045] 00000000c6f94c0d: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 984.332942] 000000001066b0b3: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 984.341811] 0000000052db182a: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 984.350711] 00000000d842447b: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 984.359590] 00000000295c02f8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:42 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x88640000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 984.368559] XFS (loop6): SB validate failed with error -117. 08:56:42 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x10000000000000}, 0x0) 08:56:42 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x7fffffff, &(0x7f0000000000)="00d10800ffffff7f04000000") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:42 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PIO_FONT(r1, 0x4b61, &(0x7f00000002c0)="8b4024c516dd9901361fed23e23d9875bf6d7fa62b782545755247d9249ba50a20cfa2a64a5cec02840142ec48ad0335f10ba64dd2dcb7092cd7756f4068e6a6958cd502a281309e2aae56a8e9bc57e9d4845e4f5241da6d077def77a805bce48d1967f511d0b8d714b701fbf8a7f2e5b10219dbc34c8de6b4f66d806b011a33f95a7a84f3b106127ef69c844957f7b8539fc3f42b4f6d8543f3edffd803d01322f408856f47e4015e95490781") ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x7fffffff}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000140)={r5, 0x6, 0x30}, 0xc) r6 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r6, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r4, r7, &(0x7f0000d83ff8), 0x8000fffffffe) [ 984.477283] binder: 17579:17580 BC_FREE_BUFFER u0000000000000000 no match [ 984.504824] binder: 17579:17580 transaction failed 29189/-22, size 0-0 line 2852 [ 984.539815] binder: undelivered TRANSACTION_ERROR: 29189 [ 984.539873] binder: 17579:17580 BC_FREE_BUFFER u0000000000000000 no match [ 984.552644] binder: 17579:17580 transaction failed 29189/-22, size 0-0 line 2852 [ 984.560329] binder: undelivered TRANSACTION_ERROR: 29189 08:56:45 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x195) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000040)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x0) 08:56:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:45 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000007c000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:45 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xe00000000000000}, 0x0) 08:56:45 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x9000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_udp_encap(r3, 0x11, 0x64, &(0x7f00000000c0)=0x5, 0x4) r4 = dup(r3) fcntl$setflags(r1, 0x2, 0x1) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f00000001c0)="000000000000000000000000aa22750b0000", 0x12, 0x4000000, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x800}, 0xffffffffffffff0d) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:45 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000000)=[@clear_death={0x400c630f, 0x1}], 0x8c, 0x0, &(0x7f00000000c0)="ea4aed33c4fec7594123a749a7fa9a9ff274f4071830acb27dc0b1a843f2c2daa0472905f60f11128dda21d4e290a832112fb00378ee7a8f6641e4d3804e94bb4f6cd5018df31c89bb397956d4b1da7525fc0aec00f02e6aa1b3e813fb293ae753f35263b765d23ab3cfd3582b9a4afc112c421400bb1b5cae5ad4a8e5b47ed0bbd99df04f84666572b94c47"}) 08:56:45 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:45 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x7000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 987.280791] binder: 17597:17611 BC_FREE_BUFFER u0000000000000000 no match [ 987.321840] binder: 17597:17611 transaction failed 29189/-22, size 0-0 line 2852 [ 987.331979] XFS (loop6): SB sanity check failed [ 987.336861] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 987.348002] XFS (loop6): Unmount and run xfs_repair [ 987.353062] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 987.355843] binder: 17597:17611 BC_FREE_BUFFER u0000000000000000 no match [ 987.359776] 0000000077699399: 58 46 53 42 00 00 10 00 00 00 7c 00 00 00 10 00 XFSB......|..... [ 987.359795] 00000000742af98d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 987.368264] binder: 17597:17626 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 987.375609] 000000000ad25089: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 987.375621] 0000000087602639: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 987.375632] 00000000711faf05: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:45 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) getegid() r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:45 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x31000000}, 0x0) 08:56:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6c}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:45 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8847000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 987.375649] 00000000b7a75fd2: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 987.389161] binder: 17597:17611 transaction failed 29189/-22, size 0-0 line 2852 [ 987.391485] 0000000047d2e6df: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 987.433063] binder: undelivered TRANSACTION_ERROR: 29189 [ 987.434546] 00000000d544b488: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 987.449070] XFS (loop6): SB validate failed with error -117. 08:56:45 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x600000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:45 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x87ffffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:45 executing program 0: r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x10000) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000040)={0x5}, 0x1) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f00000000c0)={{0x100000000, 0x3ff}, 0x28}, 0x10) socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) setsockopt$inet6_opts(r0, 0x29, 0x0, &(0x7f0000000100)=@fragment={0x3b, 0x0, 0x8, 0x8000, 0x0, 0x8, 0x68}, 0x8) [ 987.533217] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 987.540354] binder: 17646:17647 BC_FREE_BUFFER u0000000000000000 no match [ 987.554484] binder: 17646:17647 transaction failed 29189/-22, size 0-0 line 2852 [ 987.569909] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 987.596786] binder: 17646:17647 BC_FREE_BUFFER u0000000000000000 no match [ 987.609577] binder: 17646:17647 transaction failed 29189/-22, size 0-0 line 2852 [ 987.619443] binder: undelivered TRANSACTION_ERROR: 29189 [ 987.633150] binder: undelivered TRANSACTION_ERROR: 29189 08:56:46 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = memfd_create(&(0x7f00000000c0)='trusted%systemvmnet1\x00', 0x2) r2 = accept$inet6(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, @loopback}, &(0x7f0000000140)=0x1c) r3 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r3, &(0x7f00000001c0)=""/105, 0x69) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000040)={0x0, 0x7f, 0x7, 0x200, 0xffffffff, 0x6}, &(0x7f0000000080)=0x199) setsockopt(r3, 0x80000001, 0x3ff, &(0x7f0000000240)="0b8eac5717c79cd73c82edff8ffcd04ec3fcd408da595adcdc1ad8fed64c3620ae15400ca718755a32fd7db48eda096807832e1e653762fe3b4e9b19c58d53ec0cb6e3ed1ab2922918c208a193c19ef14e409097b3ed34e4fe19c70b1eaf5c0e05e44e0e42a6130b42d0c8762063ce960be7dac2c6f81443db4a02e60c4655349ce36a37fa2dfda1896360b5314ff6e04d9360a680c016b1b189f578cdb82081b557be36ebcdbbcc3270dc73e5822955a92c0f2b7d25fbaf3b5565bbf61061a0147f4c8c38b76e5eeffbb8effde248545ab20367ef1a738ebce57bfd0b638897b2b501a455dad323a0f94ebb3c0f1332", 0xf0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000000480)=ANY=[@ANYRES32=r4, @ANYBLOB="79000000b59db030c396b7ee9e47ab56c50ed582e83390615bf41ec256fd84edb294b9870dfaa225bfba666d60540f2b50efc89b106942be0cc887f79afb41e0cbceb647adeddff1672b0c34e369f678a2a96e261210c19214e6f4d8594b5c7eed53685b4b91b72aac7b2828b6a28c5f9c86998b61634894cc00461df393af49320a74e590002b173d090cbaf72969786f8b0814be12c780d59f4e33ead8ed6a5ea56c5934b3bdd105a2705a72bd019b94869ab67741d98fd543546a40c3b2cef57cc4b9a8795347075cdca5c992065fcfc20f01f532e1b0c2376211ee763d7a1dd0d48d8d113fdb77865b6d0d35736df5436f47651f08221943ce7a38a935c9232e843012b340ab0e8b599d0176398dcb67b401b1040ad28cb0d9effe0b942fc159ab48aacbbc6bb99be59929fc632f3c2f"], &(0x7f0000000180)=0x81) ioctl$KVM_SET_NR_MMU_PAGES(r3, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, &(0x7f0000000340)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) 08:56:46 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x1000000}, 0x0) 08:56:46 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x900], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0, 0x152) ioctl$EVIOCGSND(r3, 0x8040451a, &(0x7f00000002c0)=""/251) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:46 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000003100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf0ffffff00000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:46 executing program 0: r0 = socket$inet6(0xa, 0x1000000000006, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="723486738ab3f6cea3", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) [ 988.145941] binder: 17667:17669 unknown command 1938175090 [ 988.160300] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 988.179154] binder: 17667:17669 ioctl c0306201 20000700 returned -22 [ 988.195894] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 988.216452] XFS (loop6): SB sanity check failed [ 988.221487] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 988.232631] XFS (loop6): Unmount and run xfs_repair [ 988.237684] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 988.244386] 00000000d4dd8c66: 58 46 53 42 00 00 10 00 00 00 00 00 00 03 10 00 XFSB............ [ 988.253346] 000000001a0159db: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 988.262669] 000000004a41c6c6: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 988.271543] 000000008dfcdd69: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 988.280431] 00000000a9dd5be4: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ 08:56:46 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:46 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x2000000}, 0x0) 08:56:46 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xe8030000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e25, 0xfffffffffffffffd, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000140)=@assoc_value, &(0x7f00000001c0)=0x8) get_mempolicy(&(0x7f00000000c0), &(0x7f0000000100), 0x3ff, &(0x7f0000ffd000/0x1000)=nil, 0x7) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) r6 = getuid() fstat(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuseblk_mount(&(0x7f0000000200)='./bus\x00', &(0x7f0000000240)='./bus\x00', 0x1, r6, r7, 0x200, 0xfffffffffffffffd, 0x1b8442) 08:56:46 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000040)={0x5, [0x7, 0x8001, 0x80000000, 0x9, 0x1]}, &(0x7f00000000c0)=0xe) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="00000000001f8c9e"], 0x0, 0x0, &(0x7f0000000680)}) [ 988.289307] 00000000d68fccd0: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 988.298184] 00000000a49aac12: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 988.307051] 000000006f73d9c5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 988.317497] XFS (loop6): SB validate failed with error -117. [ 988.325848] binder: 17696:17699 BC_FREE_BUFFER u0000000000000000 no match 08:56:46 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xffffff7f00000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:46 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x5900}, 0x0) 08:56:46 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x300], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 988.347856] binder: 17696:17699 transaction failed 29189/-22, size 0-0 line 2852 08:56:46 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f00000001c0)={0x0, 0x4b, "ca219d7ba343959368793b4415080ca5b94eb22d3af9074bba108c1112f977235601b8788902f72b4da8801a9e27ff2d869b3629b55d97f766bae8beedfb73bdb6313eb6c60ec43d4439af"}, &(0x7f0000000140)=0x53) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000002c0)={r5, @in={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xc}}}, 0x5, 0x3, 0x6, 0x7f, 0x2}, &(0x7f0000000240)=0x98) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) [ 988.392982] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 988.405221] binder: undelivered TRANSACTION_ERROR: 29189 [ 988.444607] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:47 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xffffca88], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:47 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x800000000) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:47 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000005c0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:47 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) timer_create(0x7, &(0x7f0000000040)={0x0, 0x2a, 0x0, @tid=r0}, &(0x7f0000000080)) tkill(r0, 0x15) 08:56:47 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xa00}, 0x0) 08:56:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x48000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000001c0)={'bpq0\x00', &(0x7f0000000140)=@ethtool_stats={0x1d, 0x2, [0x800, 0x80]}}) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r5 = getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in=@local}}, {{@in=@rand_addr}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) fcntl$lock(r3, 0x6, &(0x7f00000000c0)={0x0, 0x4, 0x8, 0x80000001, r5}) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) fcntl$dupfd(r4, 0x406, r0) [ 989.064444] binder: 17730:17731 BC_FREE_BUFFER u0000000000000000 no match [ 989.076136] binder: 17730:17731 transaction failed 29189/-22, size 0-0 line 2852 [ 989.125836] binder: undelivered TRANSACTION_ERROR: 29189 [ 989.169290] XFS (loop6): SB sanity check failed [ 989.174123] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 989.185334] XFS (loop6): Unmount and run xfs_repair [ 989.190415] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 989.197144] 00000000158f87f4: 58 46 53 42 00 00 10 00 00 00 00 5c 00 00 10 00 XFSB.......\.... [ 989.206048] 000000004c973615: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:47 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:47 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x689], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x8000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:47 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xa}, 0x0) 08:56:47 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x80000, 0x100) connect$bt_sco(r1, &(0x7f00000000c0)={0x1f, {0x2cdc, 0x5, 0x5, 0x5, 0x1ff, 0xc43}}, 0x8) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000140)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x115d00, 0x0) getsockopt$inet_dccp_buf(r3, 0x21, 0x0, &(0x7f00000001c0)=""/166, &(0x7f0000000100)=0xa6) ioctl$PPPOEIOCDFWD(r3, 0xb101, 0x0) 08:56:47 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f00000000c0)) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 989.214934] 00000000336bf6e3: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 989.223851] 00000000bb515eb0: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 989.232736] 0000000069934027: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 989.241637] 000000002588e47e: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 989.250557] 000000001ca972de: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 989.259309] binder: 17765:17768 BC_FREE_BUFFER u0000000000000000 no match 08:56:47 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x2], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:47 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x7}, 0x0) 08:56:47 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7914}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 989.259447] 00000000438ee5f5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 989.275272] XFS (loop6): SB validate failed with error -117. [ 989.306730] binder: 17765:17768 transaction failed 29189/-22, size 0-0 line 2852 08:56:47 executing program 3: r0 = socket$inet6(0xa, 0x5, 0x1670) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffc4b) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r0) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) write$P9_RREADDIR(r4, &(0x7f00000000c0)={0x4b, 0x29, 0x2, {0x7fff, [{{0xe405aff08d0d016e, 0x0, 0x4}, 0x80, 0x10000, 0xb, './bus/file0'}, {{0xa9, 0x1, 0x6}, 0x6, 0x101, 0x5, './bus'}]}}, 0x4b) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) setsockopt$inet6_tcp_buf(r5, 0x6, 0x1c, &(0x7f00000002c0)="37d1ef10398b1270e222c7730b55bb8c3e4f0297bfe139d3b1fa22466b138f2ab6f460c349dc339edbefaa6fb8739d257ebe25aa87a55cc5398a4eb86c0d12ef31700218b3ed6ee2d38a7b6dcf345333c43e3e2505d898baa8abd5101ec08ff251826a4637559e696eef0f83e099739b67f0c3ffd4d99cd35f7e60d47d4b4a0f3f52682402f9765e1fb21a33717a038e807a42623d6592d6b67a54f74a26a7de658f77575fc453e3f7628bb6d1401e74e537f62fa9fdde7a41bc5e541dd129a48e6d8fb3afe592a93e54daebf0224b0e2593fc510b08df55bc15", 0xda) [ 989.330691] binder: 17765:17768 BC_FREE_BUFFER u0000000000000000 no match [ 989.367072] binder: 17765:17768 transaction failed 29189/-22, size 0-0 line 2852 08:56:47 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xf5ffffff00000000}, 0x0) 08:56:47 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000c40000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 989.402451] binder: undelivered TRANSACTION_ERROR: 29189 [ 989.410083] binder: undelivered TRANSACTION_ERROR: 29189 [ 989.510524] XFS (loop6): SB sanity check failed [ 989.515444] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 989.526578] XFS (loop6): Unmount and run xfs_repair [ 989.531633] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 989.538347] 00000000e6236077: 58 46 53 42 00 00 10 00 00 00 00 c4 00 00 10 00 XFSB............ [ 989.547216] 00000000ef82a29f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 989.556094] 000000008aa31adc: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 989.564952] 00000000fcc0cd40: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 989.573802] 0000000051cd25a7: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 989.582663] 000000002072f9b9: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 989.591512] 00000000acc58109: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 989.600362] 0000000051735f9b: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 989.609586] XFS (loop6): SB validate failed with error -117. 08:56:48 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file0\x00', 0x480, 0x42) r2 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r2, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x9}}, &(0x7f0000000000)) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000140)=0x54) sendfile(r2, r1, &(0x7f0000000080)=0x24, 0x0) tkill(r0, 0x15) ioctl$sock_proto_private(r2, 0x89e7, &(0x7f0000000240)="635517c0820912b29ed0a75da3954a153ee65c2772638fc92699814aa21c649634eb4fb97b82c0aa867d02ea42fb97ffa169d263fba67c41a82fe1b13d7ed6a670c42944d954d6f96a2d58dbc2b8161543e9794282bd9f2eed04428f3a2b0d44614ecd62caebc14d4b8f30c52d83b3473cdc66c7f3bffba584b3dc97c96b9d1769b930df0446fcf1c69caa383d384cdc7ff6295f") 08:56:48 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8035000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:48 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) [ 990.016266] binder: 17833:17834 BC_FREE_BUFFER u0000000000000000 no match [ 990.025188] binder: 17833:17834 transaction failed 29189/-22, size 0-0 line 2852 [ 990.035660] binder: undelivered TRANSACTION_ERROR: 29189 08:56:48 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) ioctl$EVIOCGABS0(r4, 0x80184540, &(0x7f00000002c0)=""/4096) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:48 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xf5ffffff}, 0x0) 08:56:48 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000080010000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:48 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x87ffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:48 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair(0x1a, 0x1, 0x100000001, &(0x7f0000000000)={0xffffffffffffffff}) r2 = getpgid(0xffffffffffffffff) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f00000000c0)=r2) ioctl(r0, 0x8912, &(0x7f0000000040)="bf8affffffffffcdff1c45706a00004800007f51687d008023c40000000057efff698a8888") r3 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x300}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r4, &(0x7f0000000140)={0x5, 0x10, 0xfa00, {&(0x7f00000002c0), r5, 0x1}}, 0x18) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:48 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x8dffffff}, 0x0) 08:56:48 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf0}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:48 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 990.175946] binder: 17850:17851 BC_FREE_BUFFER u0000000000000000 no match [ 990.213146] binder: 17850:17851 transaction failed 29189/-22, size 0-0 line 2852 08:56:48 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) getsockopt$inet_sctp_SCTP_INITMSG(r4, 0x84, 0x2, &(0x7f0000000200), &(0x7f0000000240)=0x8) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) syz_mount_image$bfs(&(0x7f00000000c0)='bfs\x00', &(0x7f0000000100)='./bus\x00', 0x1, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="452285fe0165e2", 0x7, 0x80000000}], 0x20000, 0x0) ftruncate(r5, 0x2007fff) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x20000, 0x0) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 990.261330] binder: 17850:17873 BC_FREE_BUFFER u0000000000000000 no match [ 990.268885] XFS (loop6): SB sanity check failed [ 990.273710] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 990.284853] XFS (loop6): Unmount and run xfs_repair [ 990.289916] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 990.294746] binder: 17850:17873 transaction failed 29189/-22, size 0-0 line 2852 [ 990.296633] 00000000ec9c905e: 58 46 53 42 00 00 10 00 00 00 80 01 00 00 10 00 XFSB............ [ 990.296645] 000000007f7468aa: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 990.296660] 00000000a9f80215: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 990.320342] binder: undelivered TRANSACTION_ERROR: 29189 [ 990.321935] 00000000961a7d43: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 990.321954] 0000000034a5579d: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 990.330815] binder: undelivered TRANSACTION_ERROR: 29189 [ 990.359513] 00000000127d1378: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 990.368404] 0000000070bc516d: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 990.377275] 000000004ddcc229: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 990.386472] XFS (loop6): SB validate failed with error -117. 08:56:51 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) clock_getres(0x0, &(0x7f0000000040)) setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f00000002c0)={0x2, 0x4e22, @multicast1=0xe0000001}, 0x10) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) setsockopt$inet6_udp_encap(r2, 0x11, 0x64, &(0x7f0000000280)=0x7, 0x4) tkill(r0, 0x15) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp\x00', 0x200002, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f00000000c0)={@in={{0x2, 0x4e23, @multicast2=0xe0000002}}, 0x8, 0x6, 0xe000000000, "a7a557cb0631f4030dcbe777d26bf749da0b97cd9be8f6640c8b438b258372722e78e03da4583b77103a8e54a531aa73da9025b770be28edd01845f6001bb7c1fbbcc80e69a7a9810145bce0a81b9560"}, 0xd8) 08:56:51 executing program 0: fanotify_init(0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:51 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf5ffffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:51 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x10000000000}, 0x0) 08:56:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xffffff9e}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:51 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000074100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:51 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x3, 0x80000) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r3, 0x40405515, &(0x7f0000000100)={0x2, 0x5, 0x7ff, 0x100000000, 'syz1\x00', 0x4c3}) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) pwrite64(r0, &(0x7f00000002c0)="5406ea46b35964650326215488936e5e6d2c1882a89009894c4d162c8577a8f3ae3fae4b89db506c9f70cf2cf1b1c7e9bbd61495fe1377cd71d6a3f2c52bd01bb21c62fcf9454918ab54002021c52e90cf621ddaac5b6209edc004ebfb98cdbc2f36a435e6509a44dc06eac24845698451fbd802732940450155189fc3268d50cbbab539d04ecc6a9b8198ec2f8b86a392433a8839713de918550a22237b5a63b37c78e1566773e1133b6a550dbcbd22990bfb5114830b9b53258199ca151c6f13caea08b36f59bf8cba55e2518f997f8d567eaaf66bf4b1d68ce6ba5220f910f3e0d5f05ea246060f49084d2a73558573a3100803", 0xf5, 0x0) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:51 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000), 0x0, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:51 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x6000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 993.050274] binder: 17900:17914 BC_FREE_BUFFER u0000000000000000 no match [ 993.065842] binder: 17900:17914 transaction failed 29189/-22, size 0-0 line 2852 08:56:51 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x900}, 0x0) 08:56:51 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCDIFADDR(r4, 0x8936, &(0x7f0000000100)={@loopback={0x0, 0x1}, 0x2f, r5}) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) setsockopt$XDP_RX_RING(r6, 0x11b, 0x2, &(0x7f0000000140)=0x40, 0x4) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:51 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 993.100688] binder: 17900:17924 BC_FREE_BUFFER u0000000000000000 no match [ 993.138845] binder: 17900:17924 transaction failed 29189/-22, size 0-0 line 2852 [ 993.148379] XFS (loop6): SB sanity check failed [ 993.153188] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 993.164340] XFS (loop6): Unmount and run xfs_repair [ 993.167832] binder: undelivered TRANSACTION_ERROR: 29189 [ 993.169389] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 993.169408] 00000000a33c8559: 58 46 53 42 00 00 10 00 00 00 00 00 00 74 10 00 XFSB.........t.. [ 993.174878] binder: undelivered TRANSACTION_ERROR: 29189 [ 993.181534] 0000000096c1e2d5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 993.181548] 00000000dffafd7b: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 993.213551] 00000000f428d7b8: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 993.222554] 0000000011ed5e06: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 993.231460] 00000000a75e6954: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 993.240340] 000000007f60f91a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... 08:56:51 executing program 0: r0 = fcntl$getown(0xffffffffffffffff, 0x9) r1 = memfd_create(&(0x7f0000000040)='%posix_acl_access*securitykeyringlovboxnet1cpusetselinuxtrusted\x00', 0x3) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x7fff, 0x100000000, 0x93, 0x212a, 0x0, 0x1, 0x10000, 0x0, 0x100, 0x9, 0x0, 0x3, 0x8001, 0x7f, 0x400, 0x0, 0x2eec38f9, 0xfe, 0x2, 0x7, 0xfffffffffffff5dd, 0x3f, 0x4, 0xeeb5, 0x8, 0x14af, 0x5, 0x40, 0x2355, 0x2d, 0x3, 0x100000001, 0x5, 0x5, 0xfffffffffffffffd, 0x5, 0x0, 0x4ccc, 0x0, @perf_bp={&(0x7f0000000000), 0x1}, 0x0, 0xd7bff0a, 0x85, 0x3, 0x9, 0x7, 0x8}, r0, 0xf, r1, 0xb) r2 = socket$inet6(0xa, 0xe, 0x4) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r3 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:51 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x80fe}, 0x0) 08:56:51 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x43050000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:51 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x6, 0x4000) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) getsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in=@dev}}, &(0x7f0000000200)=0xe8) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'rose0\x00', r5}) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r3, r6, &(0x7f0000d83ff8), 0x8000fffffffe) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x106, 0x1009}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r6, &(0x7f00000001c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0x7fff, @loopback={0x0, 0x1}, 0xffffffffffffff3c}, r7}}, 0x30) [ 993.249240] 00000000e3672870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 993.258375] XFS (loop6): SB validate failed with error -117. [ 993.267462] binder: 17939:17940 BC_FREE_BUFFER u0000000000000000 no match [ 993.276389] binder: 17939:17940 transaction failed 29189/-22, size 0-0 line 2852 [ 993.289893] binder: 17939:17943 BC_FREE_BUFFER u0000000000000000 no match [ 993.336467] binder: 17939:17943 transaction failed 29189/-22, size 0-0 line 2852 [ 993.380837] binder: undelivered TRANSACTION_ERROR: 29189 [ 993.386442] binder: undelivered TRANSACTION_ERROR: 29189 08:56:52 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000002500000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x2000000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:52 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x88a8ffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:52 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$SG_GET_SCSI_ID(r1, 0x2276, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:52 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x9}, 0x0) 08:56:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000003, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:52 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000), 0x0, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:52 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x40, 0x0) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f00000000c0)) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000100)=0x9, &(0x7f0000000140)=0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000000)=0x4, 0x4) [ 993.959267] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 993.976423] binder: 17973:17980 BC_FREE_BUFFER u0000000000000000 no match [ 993.988601] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:52 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x80040200], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:52 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3}, 0x0) [ 994.007942] binder: 17973:17980 transaction failed 29189/-22, size 0-0 line 2852 08:56:52 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xffffff8d}, 0x0) 08:56:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0xbf) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) mount$9p_rdma(&(0x7f00000000c0)='127.0.0.1\x00', &(0x7f0000000100)='./bus\x00', &(0x7f0000000140)='9p\x00', 0x100400, &(0x7f00000001c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@rq={'rq', 0x3d, 0x2}, 0x2c}, {@rq={'rq', 0x3d, 0x3}, 0x2c}, {@common=@nodevmap='nodevmap', 0x2c}]}}) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 994.065102] XFS (loop6): SB sanity check failed [ 994.069925] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 994.081063] XFS (loop6): Unmount and run xfs_repair [ 994.086119] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 994.092818] 00000000ac6ee09c: 58 46 53 42 00 00 10 00 00 00 02 50 00 00 10 00 XFSB.......P.... [ 994.101700] 0000000043673b6d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 994.110577] 0000000082db1677: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 994.119456] 0000000071a3f260: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 994.128334] 000000005c1ce47f: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 994.137216] 00000000be1e893f: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 994.146112] 000000009099acbd: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 994.154985] 00000000af78856a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:52 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x4000000000000000}, 0x0) 08:56:52 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6c00000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:52 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x806], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 994.164718] XFS (loop6): SB validate failed with error -117. [ 994.168791] binder: 17973:18017 BC_FREE_BUFFER u0000000000000000 no match [ 994.188090] binder: 17973:18017 transaction failed 29189/-22, size 0-0 line 2852 [ 994.197657] binder: undelivered TRANSACTION_ERROR: 29189 [ 994.204858] binder: undelivered TRANSACTION_ERROR: 29189 08:56:52 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000100), &(0x7f0000000140)=0x4) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000040)=0x1) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f0000000680)}) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000)=0xfffffffffffffffe, 0xffffffffffffffdc) [ 994.245177] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:52 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000018a0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:52 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:52 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xe803], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 994.285763] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 994.419138] XFS (loop6): SB sanity check failed [ 994.423964] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 994.435103] XFS (loop6): Unmount and run xfs_repair [ 994.440145] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 994.446832] 0000000069c7eb20: 58 46 53 42 00 00 10 00 00 00 01 8a 00 00 10 00 XFSB............ [ 994.455694] 000000008d776fcf: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 994.464549] 00000000da7e52bc: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 994.473402] 0000000019a2727d: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 994.482280] 00000000a6562043: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 994.491138] 00000000569e3f15: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 994.499997] 000000002c9c3c2d: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 994.508865] 000000000f84b73c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 994.517831] XFS (loop6): SB validate failed with error -117. 08:56:53 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000040)={0x10000, 0x10, 0x0, r1}) gettid() tkill(r0, 0x5) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:53 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xc0ffffff00000000}, 0x0) 08:56:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x68000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:53 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x88912, &(0x7f00000001c0)='p\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40, 0x0) getsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000040), &(0x7f00000000c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) 08:56:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x806000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0xfffffffffffffffc, @ipv4={[], [0xff, 0xff], @rand_addr=0xffffffff7fffffff}, 0x7}, 0xffffffffffffff92) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) ioctl$BLKROSET(r4, 0x125d, &(0x7f00000000c0)=0x2) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:53 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000034000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:53 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000), 0x0, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8100000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x79140000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:53 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x400000000000000}, 0x0) 08:56:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f00000000c0)=0x83, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) madvise(&(0x7f0000ff4000/0xa000)=nil, 0xa000, 0x6d) ioctl$TIOCMSET(r4, 0x5418, &(0x7f0000000000)=0x80000001) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 994.918920] binder: 18075:18077 BC_FREE_BUFFER u0000000000000000 no match [ 994.948146] binder: 18075:18077 transaction failed 29189/-22, size 0-0 line 2852 [ 994.996747] binder: undelivered TRANSACTION_ERROR: 29189 [ 994.997452] binder: 18075:18077 BC_FREE_BUFFER u0000000000000000 no match [ 995.028620] XFS (loop6): SB sanity check failed [ 995.033421] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 995.044559] XFS (loop6): Unmount and run xfs_repair [ 995.049609] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 995.056313] 00000000b981e4ed: 58 46 53 42 00 00 10 00 00 00 34 00 00 00 10 00 XFSB......4..... [ 995.065194] 00000000899f4146: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 995.069569] binder: 18075:18077 transaction failed 29189/-22, size 0-0 line 2852 [ 995.074064] 000000000bbb8986: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. 08:56:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x4, &(0x7f00000004c0)="00000000000000000000009aa6b771507e0963ce792159242ecc07a7ab3af8a9d746f555cfbead61079b96424800aec0b1fbf230f0630e761a0fd1b960d22f0b5bb1e502c58d6f50f2738d75801d93c6e131cccbf7329c6b61e9088d6d98cb1caad0b425f909ca211ecd47a9047eba9278b87fecf5289fa605250a5932f7eb5dc783e5fa22014cb4b58db3ef65743f2b0d228874a761d1e9f18f1ea2364386eab5b8dcda9756f142605736cd8c1fae56503d450a476d8158b5b921a6272a7d50394d2505429754c59fc5d70b7370fdbd72b340488751d1efec5b090082c47c20ccde73777d0e3f6ea3b1c9ed2f1f22df96105e42623e66f867bde75be0661123") r1 = socket$inet6(0xa, 0x8000000000f, 0x10003) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$sock_buf(r2, 0x1, 0x1c, &(0x7f0000000140)=""/33, &(0x7f00000001c0)=0x21) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = dup(0xffffffffffffffff) ioctl$TIOCSTI(r3, 0x5412, 0x276) ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r3, 0x40045730, &(0x7f00000000c0)=0xa8) syncfs(0xffffffffffffffff) setsockopt$inet6_tcp_int(r3, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e20, 0x4, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) write(r2, &(0x7f0000000340)="57382a08f05d5b7750674f79fe8bb408b2baa2881ff4792ecdbdf37edf1a25e54840130587c409d41582a7701a0b92a56bc46cc438b36caa3a50c328b0432817e83dead05a3d1d83a4476648caed211977b542f16957a95caffc699bde56eb127235567fc14d8de8d5245e09c5201293a2443270a0306e6a30ce7a657fdc322a", 0x80) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) pipe2(&(0x7f0000000100), 0x4000) ioctl$EVIOCGID(r3, 0x80084502, &(0x7f00000002c0)=""/121) ftruncate(r4, 0x4) recvfrom(r1, &(0x7f0000000200)=""/17, 0x11, 0x40000062, &(0x7f0000000240)=@llc={0x1a, 0x19, 0x4, 0x6, 0x7fff, 0x5, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}, 0x80) sendfile(0xffffffffffffffff, r4, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:53 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x8}, 0x0) 08:56:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x600000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xffffff7f}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 995.074075] 00000000d7435c64: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 995.074093] 00000000590722a3: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 995.089597] binder: undelivered TRANSACTION_ERROR: 29189 [ 995.090529] 000000004d437971: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 995.122551] 0000000037cb3113: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 995.131441] 00000000439cc241: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 995.140353] XFS (loop6): SB validate failed with error -117. 08:56:53 executing program 7: timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r0 = memfd_create(&(0x7f0000000180)='/dev/usbmon#\x00', 0x2) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f00000001c0)={'icmp6\x00'}, &(0x7f0000000200)=0x1e) ptrace$peekuser(0x3, 0x0, 0x7) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000240)=0x0) process_vm_readv(r2, &(0x7f0000000340)=[{&(0x7f0000000280)=""/172, 0xac}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x2, &(0x7f0000004680)=[{&(0x7f0000001480)=""/4096, 0x1000}, {&(0x7f0000002480)=""/211, 0xd3}, {&(0x7f0000000380)=""/189, 0xbd}, {&(0x7f0000002580)=""/4096, 0x1000}, {&(0x7f0000003580)=""/79, 0x4f}, {&(0x7f0000003600)=""/4096, 0x1000}, {&(0x7f0000004600)=""/79, 0x4f}], 0x7, 0x0) mq_timedreceive(r1, &(0x7f0000000080)=""/198, 0xc6, 0xa0, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(0x0, 0x15) ioctl$TUNGETVNETHDRSZ(r1, 0x800454d7, &(0x7f0000000040)) 08:56:53 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x20, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r1, 0x80045700, &(0x7f00000000c0)) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03630840", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB="00000000000000003647ec0f0f09b2529c3507f5339bf6a4f419c04cb59331060e6b01cf8045d1158c0a4327a923a8b1a9fbab4b9a31c37b22aff42063b9cb621e3c7266afe7e367809f9a504cf690b7bb190e583663432b9240506b6c6e1528131e1aee943686726ac938be78f753b57cf8d626386eb4b5e45d13e06d5f3ba5ed38060000000000000057cc0aafbbc8f52270aaf2aff746488dde8e52dc6192efb0d2fecfe3348ef7838f74262cde0d2a4a451b47096a133b56d128b04a3a59513886020bc069b052fa48806589aaba486ed84eb13d203ae12e158f153589b9a9fe0041000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, &(0x7f0000000680)}) 08:56:53 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xe}, 0x0) 08:56:53 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xfffffffe], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:53 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e22, @loopback=0x7f000001}, @in6={0xa, 0x4e20, 0x1, @loopback={0x0, 0x1}, 0xfffffffffffff800}, @in6={0xa, 0x4e23, 0x17, @mcast2={0xff, 0x2, [], 0x1}, 0x2}, @in={0x2, 0x4e24, @broadcast=0xffffffff}, @in6={0xa, 0x9, 0x20, @local={0xfe, 0x80, [], 0xaa}, 0x4}, @in={0x2, 0x4e21, @rand_addr=0x27e}, @in={0x2, 0x4e21}, @in={0x2, 0x4e22, @loopback=0x7f000001}], 0xfffffffffffffe58) syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x10000, 0x200000) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:53 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000006100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:53 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x700}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:53 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x4}, 0x0) 08:56:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x500000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 995.793079] binder: 18139:18140 BC_FREE_BUFFER u0000000000000000 no match [ 995.804325] binder: 18139:18140 transaction failed 29189/-22, size 0-0 line 2852 08:56:54 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xc47}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000000c0)={r2, @in6={{0xa, 0x4e22, 0x4, @remote={0xfe, 0x80, [], 0xbb}, 0x7ff}}, 0x1fa, 0x378}, &(0x7f0000000180)=0x90) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x2, 0x4) 08:56:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6000000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:54 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = syz_open_dev$dmmidi(&(0x7f00000000c0)='/dev/dmmidi#\x00', 0x4, 0x1) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) [ 995.844493] binder: 18139:18163 BC_FREE_BUFFER u0000000000000000 no match [ 995.857062] binder: 18139:18163 transaction failed 29189/-22, size 0-0 line 2852 [ 995.869234] XFS (loop6): SB sanity check failed [ 995.874070] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 995.877540] binder: undelivered TRANSACTION_ERROR: 29189 [ 995.885197] XFS (loop6): Unmount and run xfs_repair [ 995.885206] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 995.885222] 00000000645f3c64: 58 46 53 42 00 00 10 00 00 00 00 00 00 06 10 00 XFSB............ [ 995.908309] binder: undelivered TRANSACTION_ERROR: 29189 [ 995.911269] 000000000dd6e540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 995.925586] 000000002c51519a: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 995.934468] 000000009712df41: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ 08:56:54 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f0000000500)=[@free_buffer={0x40086303}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000480), &(0x7f00000004c0)}}}], 0x0, 0x0, &(0x7f0000000680)}) r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xf23, 0x200) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r2, 0x84, 0x1e, &(0x7f0000000040)=0x6, 0x4) 08:56:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xe803000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x6}, 0x0) [ 995.943374] 00000000673bedab: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 995.952261] 00000000af0e1d7e: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 995.961156] 0000000077de2e43: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 995.970047] 000000001fa33c8d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 995.979138] XFS (loop6): SB validate failed with error -117. 08:56:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xaa}, 0x0) [ 996.030649] binder: 18184:18187 BC_FREE_BUFFER u0000000000000000 no match [ 996.047584] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 996.066109] binder: 18184:18187 transaction failed 29189/-22, size 0-0 line 2852 08:56:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x2000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:54 executing program 3: socket$inet6(0xa, 0x1000000000002, 0x0) r0 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r1 = semget(0x1, 0x7, 0x421) semctl$GETVAL(r1, 0x3, 0xc, &(0x7f0000000340)=""/240) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x2, 0x0) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, &(0x7f00000002c0)={0x7, 0x0, [{}, {}, {}, {}, {}, {}, {}]}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r3, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f00000001c0)) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) getsockname$packet(r5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f0000000140)=0x14) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$SG_GET_LOW_DMA(r5, 0x227a, &(0x7f00000000c0)) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r6, 0x2007fff) sendfile(r4, r6, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:54 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000008100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 996.091119] binder: 18184:18187 BC_FREE_BUFFER u0000000000000000 no match [ 996.098392] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 996.107312] binder: 18184:18187 transaction failed 29189/-22, size 0-0 line 2852 [ 996.116081] binder: undelivered TRANSACTION_ERROR: 29189 08:56:54 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x7a000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xaaaaaafeffaaaaa8}, 0x0) 08:56:54 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x40, 0x2) ioctl$KVM_SET_CPUID(r1, 0x4008ae8a, &(0x7f0000000180)={0x7, 0x0, [{0x80000007, 0x7, 0x3, 0x0, 0x7}, {0x80000019, 0x6, 0x1000, 0xfffffffffffffffd, 0x5}, {0x5af2d2846c1e63e1, 0x5, 0x81, 0x101, 0x100}, {0xc000000f, 0x3, 0x40, 0xfff, 0x9}, {0x80000008, 0x7, 0x5, 0x3ff, 0x1f}, {0x80000001, 0xe2a, 0x1, 0x44, 0x5}, {0x8000001f, 0x1, 0x7, 0x2, 0xd03}]}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000700)={0x58, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="036308401d8bd0a28988ff7205a24522103cefccf155f2934947148fd4ef3342d402e09b81841d9754adda4d30d8d431de3af4e262e2d9426290bdec3db70ce680271e8598657f2a6ec3e677e44c7e209a7eefc5155f0b04370ef272806354c37550429737fadd4e5433f87e", @ANYRES64=0x0, @ANYBLOB="11634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[], @ANYPTR=&(0x7f00000004c0)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000680)}) [ 996.142319] binder: undelivered TRANSACTION_ERROR: 29189 [ 996.231701] binder: 18216:18217 BC_FREE_BUFFER u72ff8889a2d08b1d no match [ 996.238754] binder: 18216:18217 unknown command 574988805 [ 996.242365] XFS (loop6): SB sanity check failed [ 996.249110] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 996.260321] XFS (loop6): Unmount and run xfs_repair [ 996.265374] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 996.272098] 00000000553e65e9: 58 46 53 42 00 00 10 00 00 00 00 00 00 08 10 00 XFSB............ [ 996.277488] binder: 18216:18217 ioctl c0306201 20000700 returned -22 [ 996.280965] 00000000ce8d8295: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 996.280977] 000000002233b0ab: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 996.280987] 000000003a76d198: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 996.280998] 00000000de1c8ae2: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 996.281012] 00000000b5584c97: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 996.281044] 00000000e7a9dd6d: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 996.340674] 00000000f7fab131: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 996.349666] XFS (loop6): SB validate failed with error -117. 08:56:54 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:54 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x6c00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:54 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xffffffc0}, 0x0) 08:56:55 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x17a3) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:55 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r3 = socket$inet6(0xa, 0x400000000001, 0x0) r4 = dup(r3) syncfs(r3) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r3, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r3, r5, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x6000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:55 executing program 0: 08:56:55 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000007fffffff100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:55 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x3c], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:55 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x20480}, 0x0) 08:56:55 executing program 0: 08:56:55 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x88a8ffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:55 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3f00}, 0x0) [ 996.901635] XFS (loop6): SB sanity check failed [ 996.906519] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 996.917851] XFS (loop6): Unmount and run xfs_repair [ 996.922914] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 996.929627] 00000000542d46ab: 58 46 53 42 00 00 10 00 00 00 7f ff ff ff 10 00 XFSB............ [ 996.938531] 000000001c675c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf0ffffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:55 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x2100000000000002, 0xffff) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=0x0, &(0x7f00000001c0)=0x4) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000200)={r3, 0x5}, &(0x7f0000000240)=0x8) r4 = socket$inet6(0xa, 0x400000000001, 0x0) r5 = dup(r4) syncfs(r4) setsockopt$inet6_tcp_int(r5, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r4, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r6 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x10000) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000100)={0x50413e89, 0x3, 0x4, 0x0, 0x5, 0x2, 0x7, 0x8, 0x0, 0x5, 0x3, 0x1ff, 0x0, 0x1, 0x80000000, 0x100000001, 0x100000001, 0x1800000000000, 0x2}) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r7, 0x2007fff) sendfile(r4, r7, &(0x7f0000d83ff8), 0x8000fffffffe) [ 996.947427] 000000003671ecd3: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 996.956303] 0000000020cf7d40: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 996.965194] 00000000d6fbcf51: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 996.974087] 00000000e6b14512: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 996.982988] 00000000711b62bf: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 996.992066] 00000000b3aa809e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:55 executing program 0: [ 997.001071] XFS (loop6): SB validate failed with error -117. 08:56:55 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(0xffffffffffffffff, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:55 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xf401}, 0x0) 08:56:55 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8100], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:55 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000fff0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:55 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0xf0ffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:55 executing program 0: 08:56:55 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000040)={0x10, 0x0, 0x8000, 0x200040}, 0xfffffffffffffd7a) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = dup(r2) syncfs(r2) setsockopt$inet6_tcp_int(r3, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) sendto$inet6(r2, &(0x7f0000e77fff), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x1000004e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r2, r4, &(0x7f0000d83ff8), 0x8000fffffffe) 08:56:55 executing program 7: 08:56:56 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020a001607000000000013002d54036205001a06000c9a934d4fe600001000e0c900020000000000289f0700202100000000000000f0ffff805d8579c71e9e8128c23ed4b62c196f27585d227c9677"], 0x4f}, 0x1}, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") sendmmsg(r0, &(0x7f0000000180), 0x20, 0x0) 08:56:56 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x300}, 0x0) 08:56:56 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = dup2(r0, r0) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000080)={'mangle\x00', 0x78, "1a77718ecbc73919d5986e97d675cc9f42856c3bc6917d6fb4b9bf07a88e290a8cf33b6cae4f69738a8f76819f40f92465ea5ab21ac415633b49f2274a30cf4d69c2d5708a7ea54e0eef5b095321ef9448048fd4947c281c440548797630261fafbc456bb890299615cb0a693ba889b8bd87495f04f10c98"}, &(0x7f0000000140)=0x9c) 08:56:56 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf0ffffffffffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:56 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x68}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 997.881826] XFS (loop6): SB sanity check failed [ 997.886670] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 997.897813] XFS (loop6): Unmount and run xfs_repair [ 997.902870] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 997.909578] 000000006acb97c1: 58 46 53 42 00 00 10 00 00 00 0f ff 00 00 10 00 XFSB............ [ 997.918454] 0000000018b2ff5a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:56 executing program 3: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x19000)=nil, 0x19000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000e53fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000007fe0)={{&(0x7f0000000000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_UNREGISTER(r0, 0xc020aa04, &(0x7f0000007ffc)={&(0x7f0000000000/0x2000)=nil, 0x2000}) [ 997.927362] 00000000496d8298: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 997.936240] 00000000462c5cd9: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 997.945122] 0000000080200499: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 997.954001] 0000000036f451de: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 997.962884] 00000000e824bbbd: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 997.971808] 0000000058c1eceb: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:56 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x103000000000000}, 0x0) 08:56:56 executing program 7: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r1, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0x9208, 0x0) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x17a3) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) [ 997.980837] XFS (loop6): SB validate failed with error -117. [ 997.996903] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 998.040897] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:57 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:57 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:57 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xe803000000000000}, 0x0) 08:56:57 executing program 3: r0 = gettid() timer_create(0x0, &(0x7f0000000440)={0x0, 0x12, 0x0, @thr={&(0x7f0000000240), &(0x7f0000000340)}}, &(0x7f0000044000)) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) ioctl$KVM_GET_XCRS(r1, 0x8188aea6, &(0x7f0000000080)={0x6, 0x74, [{0x6, 0x0, 0xf5e3}, {0x7f, 0x0, 0x3ff}, {0x5, 0x0, 0x3}, {0x3}, {0x80, 0x0, 0xedc5}, {0xffffffffffffff81}]}) r2 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) read(r2, &(0x7f00000001c0)=""/105, 0x69) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0x9208, 0x0) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r0, 0x15) 08:56:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x88caffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:57 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000400100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x3000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf4010000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 998.805964] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 998.832063] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 998.844449] XFS (loop6): SB sanity check failed 08:56:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 998.849294] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 998.860444] XFS (loop6): Unmount and run xfs_repair [ 998.865511] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 998.872199] 000000006dae7570: 58 46 53 42 00 00 10 00 00 00 00 00 04 00 10 00 XFSB............ [ 998.881082] 00000000c0969bc5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 998.889977] 000000000b7028c3: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. 08:56:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x6c000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x80350000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:57 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3f00000000000000}, 0x0) 08:56:57 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000029000)='\\\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000032ff3)='/dev/snd/seq\x00', 0x0, 0x6) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f000002b000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r2, &(0x7f00000000c0)=[{0x5e, 0x9, 0x46, 0x0, @time={0x0, 0x1c9c380}, {0x2, 0x1000}, {0x4, 0x1}, @addr={0x7, 0xc3}}], 0x30) write$sndseq(r0, &(0x7f0000042f70)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw32}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, @time, {}, {}, @addr}], 0x90) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000040)}, 0x10) [ 998.898854] 0000000036adf1a0: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 998.907729] 00000000bbec761d: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 998.916645] 0000000006f3f136: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 998.925539] 00000000aa791505: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 998.934440] 00000000aac830c3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 998.943914] XFS (loop6): SB validate failed with error -117. 08:56:57 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x5}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:57 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000f0030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:57 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf0], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 999.046447] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 999.062626] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 999.112093] XFS (loop6): SB sanity check failed [ 999.116971] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 999.128114] XFS (loop6): Unmount and run xfs_repair [ 999.133170] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 999.139870] 0000000082751eac: 58 46 53 42 00 00 10 00 00 00 f0 03 00 00 10 00 XFSB............ [ 999.148744] 00000000bbd6b0e2: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 999.157613] 00000000931aaf32: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 999.166505] 00000000efd616dc: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 999.175378] 000000003cbbf060: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 999.184258] 00000000938b2a27: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 999.193270] 0000000081346504: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 999.202155] 00000000f0b757ea: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 999.211099] XFS (loop6): SB validate failed with error -117. 08:56:58 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x11000000}, 0x0) 08:56:58 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000029000)='\\\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000032ff3)='/dev/snd/seq\x00', 0x0, 0x6) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f000002b000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r2, &(0x7f00000000c0)=[{0x5e, 0x9, 0x46, 0x0, @time={0x0, 0x1c9c380}, {0x2, 0x1000}, {0x4, 0x1}, @addr={0x7, 0xc3}}], 0x30) write$sndseq(r0, &(0x7f0000042f70)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw32}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, @time, {}, {}, @addr}], 0x90) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000040)}, 0x10) 08:56:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x34000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x6], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:58 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002680)={0xb, 0xc, 0xfff, 0x80000000006, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000040), &(0x7f0000000140)}, 0x20) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/arp\x00') ioctl$UFFDIO_ZEROPAGE(r1, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000ffe000/0x2000)=nil, 0x2000}}) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e24, @multicast2=0xe0000002}}, 0x0, 0x3d}, &(0x7f0000000240)=0x90) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000440)={r2, 0xa2, "13f8ee874e5a92f72ecfc5e1fc21ed42190a5c0aa69073de3c00d8e8132dc9236e17b811c9ce415a623baeb757e2e822221c2b9a4b12eb1f9eab9602cecd6cec4535c93779487d689589d903256854eb25d2e5dac43542eedf0d17baf58ac6a66913adb9dbec68ceb6202284edbc545374a6"}, &(0x7f0000000280)=0x254) getsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000180), &(0x7f0000000200)=0x4) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000140)={r0, &(0x7f00000002c0)="4bd68abd00b9", &(0x7f0000000040)=""/5}, 0x18) 08:56:58 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000005c000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:58 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xfe800000}, 0x0) 08:56:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x800e0000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:58 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000029000)='\\\x00', 0x0) r1 = syz_open_dev$sndseq(&(0x7f0000032ff3)='/dev/snd/seq\x00', 0x0, 0x6) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f000002b000)={0x0, 0x0, 0x0, "9ede7a8c5ae95ec8672c93340f643a664f13eeab65c0322901dc6bd36cde2c51f01b7f0b014f9f91eeb7c37c7240f476c8d753d000aa8faf8fb574dbcfa6dc4d"}) write$sndseq(r2, &(0x7f00000000c0)=[{0x5e, 0x9, 0x46, 0x0, @time={0x0, 0x1c9c380}, {0x2, 0x1000}, {0x4, 0x1}, @addr={0x7, 0xc3}}], 0x30) write$sndseq(r0, &(0x7f0000042f70)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @addr}, {0x0, 0x0, 0x0, 0x0, @time, {}, {}, @raw32}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, @time, {}, {}, @addr}], 0x90) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28, &(0x7f0000000040)}, 0x10) 08:56:58 executing program 3: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1, 0x4400) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000000c0)={@ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x1d}}, 0x70, r1}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x3, 0x3) dup2(r2, r2) r3 = dup2(r2, r2) ioctl$LOOP_CLR_FD(r3, 0x8906) [ 999.819849] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 999.837302] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 999.885580] XFS (loop6): SB sanity check failed [ 999.890409] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 999.901549] XFS (loop6): Unmount and run xfs_repair [ 999.906628] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 999.913347] 000000004f224004: 58 46 53 42 00 00 10 00 00 00 5c 00 00 00 10 00 XFSB......\..... [ 999.922244] 00000000cf9fad42: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:58 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x43}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:58 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4400], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 999.931126] 000000008459b118: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 999.940009] 0000000058d4d719: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 999.948911] 0000000037c41ba7: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 999.957805] 000000006676c529: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 999.966688] 0000000054cc6991: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 999.975604] 000000006e121f87: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:56:58 executing program 3: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x4cc00, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r0, &(0x7f0000000080)="d027c39d1cc2f5dc07024ea4291da2cc4d3e48b3be601a12bc29c118a6049815626b466d0e1ed4c5353fde670b93ca693e0b2f25082f61db669aebf4f7e70d85c15a05a3a2de3fc439e0ef9431c5817ee91011ea754ca8f19f2562f6dfcfe968b0ec3db8ee568a96f30f06164c5520bea5d9ef4a80", &(0x7f0000000100)=""/89}, 0x18) setsockopt(0xffffffffffffffff, 0xff, 0x1, &(0x7f0000000040)="1800167518", 0x5) [ 999.984541] XFS (loop6): SB validate failed with error -117. 08:56:58 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xc0ffffff}, 0x0) [ 1000.038090] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1000.089278] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:59 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:59 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4305], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:59 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0xe677) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x800, 0x0) pread64(r1, &(0x7f0000000180)=""/123, 0x7b, 0x0) ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f0000000100)) r2 = socket$kcm(0xa, 0x2, 0x11) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000140)=0x2, 0x4) setsockopt$sock_attach_bpf(r2, 0x88, 0x67, &(0x7f0000000000)=r2, 0x10060) sendmsg$kcm(r2, &(0x7f0000000580)={&(0x7f0000000040)=@in6={0xa, 0x4e24, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f]}}, 0x80, &(0x7f0000000300), 0xe0, &(0x7f0000000380)}, 0x0) 08:56:59 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000005a030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:56:59 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000d00)={&(0x7f0000ffd000/0x2000)=nil, 0x2000}, &(0x7f0000000d40)=0xfffffffffffffeb9) 08:56:59 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3f000000}, 0x0) 08:56:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x60}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:59 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, 0xffffffffffffffff, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:56:59 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x100, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x0, 0x0, 0x0, @remote}, {0x0, 0x0, 0x0, @dev}]}) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f00000001c0)="800000000002000019000000e60100006c000000000000000100000001000000004000000040000080000000000000006d5ebe5a0000ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f00000003c0)={[{@usrquota='usrquota', 0x2c}, {@nolazytime='nolazytime', 0x2c}, {@jqfmt_vfsv0='jqfmt=vfsv0', 0x2c}, {@jqfmt_vfsv1='jqfmt=vfsv1', 0x2c}, {@delalloc='delalloc', 0x2c}, {@block_validity='block_validity', 0x2c}]}) 08:56:59 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf401], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:56:59 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x80040200}, 0x0) [ 1000.825809] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1000.849700] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:56:59 executing program 7: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r0, 0x2}], 0x1, &(0x7f00000000c0)={r1, r2+30000000}, &(0x7f0000000100)={0x8000}, 0x8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x7, 0x31, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000012000/0xc00000)=nil, 0xc00000, 0x0, &(0x7f00009ecff8), 0x2, 0x3) [ 1000.881362] QAT: Invalid ioctl [ 1000.918202] EXT4-fs (loop3): bad geometry: block count 512 exceeds size of device (1 blocks) [ 1000.929570] XFS (loop6): SB sanity check failed [ 1000.934405] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1000.945550] XFS (loop6): Unmount and run xfs_repair [ 1000.950616] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1000.957337] 000000004ec268cc: 58 46 53 42 00 00 10 00 00 00 5a 03 00 00 10 00 XFSB......Z..... 08:56:59 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x4c00000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:56:59 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xfffffff5}, 0x0) [ 1000.966218] 00000000003fc0e1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1000.975111] 000000004ad6e3f1: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1000.983993] 000000009468aedd: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1000.992888] 0000000089674962: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1001.001770] 000000009d2dd9bb: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 08:56:59 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x10000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1001.010686] 0000000053bbb1aa: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1001.019563] 000000008211131e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1001.028474] XFS (loop6): SB validate failed with error -117. [ 1001.042703] QAT: Invalid ioctl 08:56:59 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) r1 = shmget(0x1, 0x2000, 0x1330, &(0x7f0000ffc000/0x2000)=nil) shmctl$SHM_STAT(r1, 0xd, &(0x7f0000000000)=""/29) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) [ 1001.066664] EXT4-fs (loop3): bad geometry: block count 512 exceeds size of device (1 blocks) [ 1001.094223] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1001.175889] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:57:00 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:00 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000330100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:00 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf401000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:00 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xaa00000000000000}, 0x0) 08:57:00 executing program 3: r0 = socket$inet6(0xa, 0x7, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet(0x2, 0x3, 0x3e) sendto$inet(r1, &(0x7f0000edf000), 0x0, 0x0, &(0x7f0000ee9ff0)={0x2}, 0x10) setsockopt$inet_int(r1, 0x0, 0x7, &(0x7f0000002940)=0x1, 0x4) recvmsg$kcm(r1, &(0x7f0000000280)={&(0x7f0000000100)=@generic, 0x80, &(0x7f0000002580), 0x0, &(0x7f0000002600)=""/143, 0x8f}, 0x0) 08:57:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x40030000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:00 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) r1 = shmget(0x1, 0x2000, 0x1330, &(0x7f0000ffc000/0x2000)=nil) shmctl$SHM_STAT(r1, 0xd, &(0x7f0000000000)=""/29) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:00 executing program 0: r0 = socket$inet6(0xa, 0x40000080806, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@loopback={0x0, 0x1}, @in6, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast1=0xe0000001, 0x0, 0x2b}, 0x0, @in6=@dev={0xfe, 0x80}}}, 0xe8) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x40, 0x1, 0x0, 0x62, 0x5d}, 0xc) close(r2) close(r2) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r0, 0x20000003) r3 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r3, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback={0x0, 0x1}}, 0x1c) r4 = accept4(r0, &(0x7f00004d4000)=@nl=@proc, &(0x7f0000047ffc)=0xc, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="84000000"], 0x1}, 0x1, 0x0, 0x0, 0x844}, 0x20000000) setsockopt$inet6_opts(r4, 0x29, 0x37, &(0x7f0000000000)=@dstopts, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000140)=[@in={0x2, 0x4e24, @remote={0xac, 0x14, 0x14, 0xbb}}, @in6={0xa, 0x4e24, 0x4, @loopback={0x0, 0x1}, 0x100000000}, @in6={0xa, 0x4e20, 0x5, @local={0xfe, 0x80, [], 0xaa}, 0x5}, @in={0x2, 0x4e21, @multicast1=0xe0000001}, @in={0x2, 0x4e22, @broadcast=0xffffffff}, @in={0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}, @in6={0xa, 0x4e21, 0x8, @loopback={0x0, 0x1}, 0x7169}, @in6={0xa, 0x4e21, 0x410, @mcast1={0xff, 0x1, [], 0x1}, 0x8000}, @in={0x2, 0x4e22, @multicast2=0xe0000002}], 0xc0) ioctl$sock_inet_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000080)={'sit0\x00', {0x2, 0x4e22, @remote={0xac, 0x14, 0x14, 0xbb}}}) connect(r4, &(0x7f00007a8000)=@generic={0x0, "8c36b043d081c3c1503af6a768406b9267f60ac286da2338bd8e3f6ba990189977170a0705ea90c13e26ba0b966b9b9d3289c8784f16963ce7c312649ce2996cd4e7126f704ab2546e516d216ed2fb7a95ff906185874a2d44029a01f46a380e73c5477efe9e01548612afd6c667be500d748038f499a492ef8fe4e62653"}, 0x80) listen(r4, 0x0) 08:57:00 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x1100000000000000}, 0x0) 08:57:00 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) r1 = shmget(0x1, 0x2000, 0x1330, &(0x7f0000ffc000/0x2000)=nil) shmctl$SHM_STAT(r1, 0xd, &(0x7f0000000000)=""/29) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:00 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x88480000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:00 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xf0ffffff00000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 1001.883843] dccp_close: ABORT with 1 bytes unread [ 1001.921362] XFS (loop6): SB sanity check failed [ 1001.926199] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1001.937347] XFS (loop6): Unmount and run xfs_repair [ 1001.942402] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1001.949116] 00000000ca020f26: 58 46 53 42 00 00 10 00 00 00 00 00 03 30 10 00 XFSB.........0.. [ 1001.958048] 0000000048969f5d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:00 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) r1 = shmget(0x1, 0x2000, 0x1330, &(0x7f0000ffc000/0x2000)=nil) shmctl$SHM_STAT(r1, 0xd, &(0x7f0000000000)=""/29) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:00 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4010000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:00 executing program 0: r0 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x0, 0x400) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/kvm\x00', 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x400000, 0x0) epoll_pwait(r2, &(0x7f0000000180)=[{}], 0x155555555555574c, 0x4354, &(0x7f0000000200), 0x8) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = memfd_create(&(0x7f0000000080)='/dev/kvm\x00', 0x3) setsockopt$bt_BT_DEFER_SETUP(r4, 0x112, 0x7, &(0x7f00000000c0)=0xffffffffffff3797, 0x4) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x80, 0x0) ioctl$KVM_SMI(r4, 0xaeb7) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r3, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000500)="0f0866b8ed008ec066ba4000b000eed2a807000000410f01cab98e0b0000b862000000ba000000000f30b90b0800000f320fc72a8f2a60128f00000000003000000fc7aa00100000", 0x48}], 0x1, 0x0, &(0x7f0000000000)=[@cstype0={0x4}, @vmwrite={0x8}], 0x2) ioctl$KVM_INTERRUPT(r5, 0x4004ae86, &(0x7f00000002c0)) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r4, 0xc058534f, &(0x7f0000000240)={{0x8000, 0x87bb}, 0x1, 0x3, 0x400, {0x1}, 0xfffffffffffffffb, 0x7}) [ 1001.966927] 0000000006ef7a93: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1001.975796] 00000000d0b388ee: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1001.984687] 00000000df2000b9: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1001.993568] 00000000f50eebac: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1002.002463] 000000004661858a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1002.011338] 00000000f7c0bd82: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:00 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x8dffffff00000000}, 0x0) [ 1002.020550] XFS (loop6): SB validate failed with error -117. 08:57:01 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:01 executing program 3: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x2, 0x11, r0, 0x0) fallocate(r0, 0x0, 0xffff, 0x4) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f0000000000)) mmap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x7, 0x11, r1, 0x0) madvise(&(0x7f0000007000/0x4000)=nil, 0x4000, 0x9) 08:57:01 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) shmget(0x1, 0x2000, 0x1330, &(0x7f0000ffc000/0x2000)=nil) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:01 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x5000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:01 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xa8aaaafffeaaaaaa}, 0x0) 08:57:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x4c00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:01 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000134100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:01 executing program 0: r0 = socket$inet6(0xa, 0x5, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r1, &(0x7f00000009c0)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}, 0x6}, 0x1c) llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000800)=""/252, 0xfc) sendmsg(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)="2c0271ca8b080aae3300bfa4def38003c21c104094", 0x15}], 0x1, &(0x7f0000000140)}, 0xc100) sendmsg(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000001180)="b10b938636ea69df7b5a9984bb1bc72ef58d96e56e11df900a707f4946b1637e2096c584b9a1b4e017163fbdb35160a56c11dfbe74df97d36d19ad6a91c6fb4ad19581b8cf707131830f7a22b1b263c9da0e443c5e969ed6a0d3bc508bf75c3147447379f585759ceba0de5cda46291dc1b8f106a83e1cde43a862d95413ce2616b261ed9f79913ae781b3b843ea1b4429a750b8ccb1952a7b863d0bada9f61df6609fe368eaf47c0ce9e46a22b0d75b063deeaa94285d0c43353046e0a308296a76b0b0145f8af9aa0ed0e18bc50509eaef21c8e03842a97df3a462ea3f9d5f83bf1d4d2875f0d5b24e941483f863cd2ea7c769bd3e594fb173dd873c7d9a3fd20939ad1d5867881ed77a078007b4972aba36cae02004373a6a74d74cb15a52c5f8426cb6f235d38048fd91f5d6100fd58a335df10add227d804167ba191c7a035c5a2a916e7fef18a6003578820b3e0be26a22f2c149f40a0335cadcca64a5e44179e6ce4d7f7c16e8a96c5be7cdf66eef901cb8eeabc94bae30acca8c6fa02889c32311044dcbc9a2e02e0632f7f9aa96849abede543773745e4652fccc503003f10cd68ddab594969ad36cb622ed7ba22dc46a80fb63ac2c561a80ae5c10b295b9f75d9536ba1ac24b8e9ae217611ffe79cb9422158475c1a89a51547d13c03b68d75ffb5717a35f381774567871e9e4190272c97eafcfa0a07a751d0bc8eeb0c206e12b2cff1065a3d5622635fa44c0dcb0722ad4c97e6b7d5844b2e9bab9ba1d083fa2930a3ea267d7f15d817e2b2e055ccfbaf019292f6156efd3a9a13ea90ecf59fc1bf35c6626db1c6759a50ed84acefd3cdb3532da1f23a262055223e7a3a62f15eeb8060dc9cfa30e6783757ae2f0ac6ed75d3212591ccd73de4aed62fda77585403cb2d1446e86c12fc6ad1b8f954960a439a096ec3bf1dcc6e8cff12c8abe42391d75c0861ddd448b7dbf208cf748c9de", 0x2b7}], 0x1, &(0x7f0000000e00)}, 0x8000) sendmsg(r1, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000500)="d09a0e63c9476288b671afdbd53a5994e137381f62021d1951b627b8dda57a5d17d744648c81c5703ed8146ab1b0171f89091b1dd3238d03dbb686df460963245dedf2013ee555af99499e44ad420dbf65fd46fbc99a1274429e2d5783751815828ec8cb3553110cca66460215353d19f6d8bbd8fb264eddea60b18e16c31aa5e200000491634ac2fd10e2cd30bcd7fede24263a7fff16e53ea293f3551b7147c33a44ea437fb1515c3e8d4f162fdebf8ebe11ae6fcd9372c8d8f19556ae091fe94215ae9434da412f6fa4cb6561e5f78ff9707844ee5d573fb294437722d9a06dfa61748c32c73d759933a8dd344c947d3efdbe90d0eb049df5fbb0c19f6785264b619c530d97395d44b04f7e2a280d658c7871ad373b792678c49227999651ef3b2ee1bc2b8f3035db376e8e09aa3837233c8713065a8ad131d24f6c42a3220d0e07c3d3e95d59a5dd10c09716b5f874ecf53aadfa5050ff40f2c3c4a629b6445e5836100afff5a8977583653b40ca316f8f11416e5c1bd5499636ddae25fc4970b37209cf5c0bf8e432160c258d14223baa52798e09858645773dd97e68a9531072713cff077b2e73e03ed4f145e9199c126a7f235e5674a3c7f5c7129ac7c1a3319590249b6d34ef6c3d8b94c6fc7cdcbddb053243053f7bc1f230d3bc7dfc4359e33992d0a3946b914a093287a76ac4a249b5b86cc75476466e409553355fefab75e9268a8751ffc9481fcff1f49c475699595b315e2147eebe8b7291600c6b1cf7c8f24d587b9464a67e5ccec17820e711b98f4f7d5053642068a3fff704c3fe35ba862b53e2622d6e8b4a4c815fb2ea90ef63e141209dd29254e5ab5bde9c6857b3cb184586049e7741b2d8b5b1a19e99e1834a25959155720c1c0ef84d9d3c42e1ba282847d476cef0228b1422aba08e5f3c1cd279bbd1c5303c2e9c16a0da4f88f770fca118b09e92b51a33970e32ade0c74eee1b31a420d7914c9d75db25855ae32798edc1b47e0f0f88429b2b60ae63", 0x2d5}], 0x1, &(0x7f0000003b40)}, 0x0) 08:57:01 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x401000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:01 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:01 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x10000000}, 0x0) 08:57:01 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xffffff7f}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:01 executing program 3: syz_mount_image$nfs(&(0x7f0000000100)='nfs\x00', &(0x7f0000000180)='./file0\x00', 0x2, 0x3, &(0x7f00000002c0)=[{&(0x7f00000001c0)="82716a18106fb38d86d43a8325e364d3f74c311d90c6a5b1e5899e2f57c24a61312766ed4316253d34ec6ffd5e61384323578440f689843c1c02fe97093f70e9bc17f74e332511f937f49d57ef84cacac575cdfda78e076b2293c5393ee43c", 0x5f, 0x20}, {&(0x7f0000000240)="2373d3a3a62632a2c991355786ad7f5fa215a4917babebd0af", 0x19, 0x9}, {&(0x7f0000000280), 0x0, 0x3}], 0x20000, &(0x7f0000000340)='syzkaller\x00') r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000140)="295ee1311f16f477671070") mmap(&(0x7f0000012000/0x1000)=nil, 0x1000, 0x0, 0x41010, r0, 0x0) clone(0x0, &(0x7f00000006c0), &(0x7f0000000780), &(0x7f00000000c0), &(0x7f0000000180)) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x0, 0x1, &(0x7f0000001fe8)=ANY=[@ANYBLOB="00ced43a7389ac9c53"], &(0x7f0000003ff6)='syzkaller\x00', 0x0, 0xc3, &(0x7f0000009f3d)=""/195}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="b4000000000000003c000000000000000f0000000000000000000000000000009500000000000000723d2234f384a731bd4baf33f21647f311ac3d0db643fbc5510d1dbb3f69bd9ac631113a99149ed6ce6121b2200c1ff38815c7945ed73044a4f0d057dec1322db484df531dd07db28cd9335e7f5e09ed668a26369e82657fb45423ee8b507a4ee19e2b53eba3f2b32dea"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x437, &(0x7f000000cf3d)=""/195}, 0x48) inotify_init1(0x800) [ 1002.888497] XFS (loop6): SB sanity check failed [ 1002.893327] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1002.904476] XFS (loop6): Unmount and run xfs_repair [ 1002.909532] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1002.916284] 000000008242875d: 58 46 53 42 00 00 10 00 00 00 00 00 01 34 10 00 XFSB.........4.. [ 1002.925164] 00000000e85327ed: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1002.934062] 00000000f8e240ed: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1002.942942] 000000003d03ddaa: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1002.951815] 000000000b58994a: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1002.960691] 00000000df86ebd5: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1002.969569] 0000000042cea28f: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1002.978454] 00000000779abb86: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:01 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x3c00000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:01 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mkdir(&(0x7f0000000040)="2e02", 0x0) bind$alg(r0, &(0x7f00000001c0)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sm3)\x00'}, 0xffffffffffffff57) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="cd7290074c33b5ba5472c1892c2273651b5fca8881c22d2080ddf45989bbe92905abdb0447971f3b9413bab7ba60000a4ba0dbab8ec6ea3fc4b26e118a1aef8792728f7f55e4aa6c492460d946ab928533bb58f24e3989a8b1a8d304f0427c28cef56b26cb5b2a0c7e26a6607e6a2affab2950a894f567826f917b5eb19c1e17", 0x80) [ 1002.989191] XFS (loop6): SB validate failed with error -117. 08:57:01 executing program 7: ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x6611, 0x0) 08:57:02 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:02 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xf4010000}, 0x0) 08:57:02 executing program 0: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) getsockopt$IPT_SO_GET_ENTRIES(r0, 0x0, 0x41, &(0x7f0000000200)={'mangle\x00', 0xe1, "581dc481f98d14495256132d8d7d12c4f4ca8f26e235c69686e0dff71b8d8d072a766a71e96c99004ded681c0b1f89576c8b7eedd71d8a59afad425eee5c68e71bc9891f381d5e5f4a022a794069d7571dca0fb039df47b332d646cbd0c816b08600f875a671d0e24fa98c251413142bed976dc7e0f58f5068bf3d3764553ff97db05e7eee78dec0a845641bffc4ade659a8b2378f9136ae5751c8290cfa32a4c6be4dc4de507c2bc66b810ec7b9054c387170e8f1bd72d438fcbea18afc04f7788895b016deed8397f6af41b5a66a058a1beda0678623c5c46953e4e2ef8dec73"}, &(0x7f0000000340)=0x105) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x200000032, 0xffffffffffffffff, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000080)={{0x6, 0x8, 0x5, 0xbe0, 0x9, 0xdce7}, 0x7fffffff, 0x1, 0x1, 0x40, 0x39, "19d2ac2c42eaf054863db35ac3e3db59fd3d508ca1cb8257005ee8d0c575e6c098587a7df6491887409fb44f2965e3c219c0f35a54dfa250c203ed31480f2991cfc28621dd325bdb14c73f16a5aa82548ccd7d01c012a89ba565c812c736ac27373fc0a641becc7be8751b1e51ffdc5807a893c46c214b08773ac92dab657740"}) accept4(r1, &(0x7f0000000140)=@vsock={0x0, 0x0, 0x0, @my}, &(0x7f00000001c0)=0x80, 0x0) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x74, &(0x7f0000001640)=""/4096, &(0x7f0000000040)=0x1000) 08:57:02 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8864], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:02 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000000005c100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x2}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:02 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x6611, 0x0) 08:57:02 executing program 3: io_setup(0x0, &(0x7f0000000000)) prctl$intptr(0x200000000002b, 0x0) 08:57:02 executing program 7 (fault-call:1 fault-nth:0): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:02 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x4300000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 1003.889330] FAULT_INJECTION: forcing a failure. [ 1003.889330] name failslab, interval 1, probability 0, space 0, times 0 [ 1003.900667] CPU: 1 PID: 18781 Comm: syz-executor7 Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1003.909093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1003.918473] Call Trace: [ 1003.921098] dump_stack+0x1c9/0x2b4 [ 1003.924750] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1003.929962] ? __init_rwsem+0x1cc/0x2a0 [ 1003.933972] should_fail.cold.4+0xa/0x11 [ 1003.938061] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1003.943193] ? ext4_mark_inode_dirty+0xb50/0xb50 [ 1003.947951] ? inode_insert5+0x490/0x4a0 [ 1003.952015] ? lock_downgrade+0x8f0/0x8f0 [ 1003.956165] ? trace_hardirqs_on+0x10/0x10 [ 1003.960395] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1003.964971] ? check_same_owner+0x340/0x340 [ 1003.969281] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1003.973680] ? rcu_note_context_switch+0x730/0x730 [ 1003.978602] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1003.984131] ? iget_locked+0x195/0x580 [ 1003.988010] ? __sanitizer_cov_trace_cmp8+0x18/0x20 [ 1003.993023] ? filemap_map_pages+0xca2/0x1990 [ 1003.997512] ? check_same_owner+0x340/0x340 [ 1004.001829] ? lock_acquire+0x1e4/0x540 [ 1004.005790] ? rcu_note_context_switch+0x730/0x730 [ 1004.010707] ? lock_downgrade+0x8f0/0x8f0 [ 1004.014845] __should_failslab+0x124/0x180 [ 1004.019070] should_failslab+0x9/0x14 [ 1004.022858] kmem_cache_alloc+0x2af/0x760 [ 1004.026997] ? __filemap_fdatawrite_range+0x31d/0x4a0 [ 1004.032182] jbd2__journal_start+0x1e7/0xa80 [ 1004.036582] ? jbd2_write_access_granted.part.9+0x430/0x430 [ 1004.042279] ? rcu_note_context_switch+0x730/0x730 [ 1004.047202] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1004.052764] __ext4_journal_start_sb+0x182/0x600 [ 1004.057507] ? ext4_ioctl+0x1d21/0x4210 [ 1004.061471] ? ext4_journal_abort_handle.isra.5+0x260/0x260 [ 1004.067172] ? lock_two_nondirectories+0xdd/0x120 [ 1004.072006] ? _down_write_nest_lock+0x130/0x130 [ 1004.076759] ? security_capable+0x99/0xc0 [ 1004.080901] ext4_ioctl+0x1d21/0x4210 [ 1004.084693] ? check_same_owner+0x340/0x340 [ 1004.089006] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1004.094553] ? ext4_ioctl_group_add+0x560/0x560 [ 1004.099208] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1004.104730] ? _kstrtoull+0x188/0x250 [ 1004.108525] ? _parse_integer+0x190/0x190 [ 1004.112661] ? lock_release+0xa30/0xa30 [ 1004.116621] ? check_same_owner+0x340/0x340 [ 1004.120934] ? __check_object_size+0x9d/0x5f2 [ 1004.125422] ? lock_acquire+0x1e4/0x540 [ 1004.129380] ? __fget+0x4ac/0x740 [ 1004.132822] ? lock_downgrade+0x8f0/0x8f0 [ 1004.136962] ? lock_release+0xa30/0xa30 [ 1004.140924] ? pid_task+0x115/0x200 [ 1004.144546] ? find_vpid+0xf0/0xf0 [ 1004.148077] ? __f_unlock_pos+0x19/0x20 [ 1004.152042] ? __fget+0x4d5/0x740 [ 1004.155495] ? ksys_dup3+0x690/0x690 [ 1004.159203] ? kasan_check_write+0x14/0x20 [ 1004.163426] ? __mutex_unlock_slowpath+0x197/0x8c0 [ 1004.168347] ? fsnotify+0xbac/0x14e0 [ 1004.172045] ? vfs_write+0x2f3/0x560 [ 1004.175742] ? ext4_ioctl_group_add+0x560/0x560 [ 1004.180415] do_vfs_ioctl+0x1de/0x1720 [ 1004.184308] ? fsnotify_first_mark+0x350/0x350 [ 1004.188883] ? __fsnotify_parent+0xcc/0x420 [ 1004.193193] ? ioctl_preallocate+0x300/0x300 [ 1004.197586] ? __fget_light+0x2f7/0x440 [ 1004.201545] ? fget_raw+0x20/0x20 [ 1004.204989] ? __sb_end_write+0xac/0xe0 [ 1004.208954] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1004.214478] ? fput+0x130/0x1a0 [ 1004.217742] ? ksys_write+0x1ae/0x260 [ 1004.221543] ? security_file_ioctl+0x94/0xc0 [ 1004.225956] ksys_ioctl+0xa9/0xd0 [ 1004.229399] __x64_sys_ioctl+0x73/0xb0 [ 1004.233274] do_syscall_64+0x1b9/0x820 [ 1004.237148] ? finish_task_switch+0x1d3/0x870 [ 1004.241629] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1004.246548] ? syscall_return_slowpath+0x31d/0x5e0 [ 1004.251465] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1004.256472] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1004.261479] ? perf_trace_sys_enter+0xb10/0xb10 [ 1004.266141] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1004.270978] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1004.276153] RIP: 0033:0x455e29 [ 1004.279323] Code: 1d ba fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1004.298528] RSP: 002b:00007f210a4cbc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1004.306226] RAX: ffffffffffffffda RBX: 00007f210a4cc6d4 RCX: 0000000000455e29 [ 1004.313480] RDX: 0000000000000000 RSI: 0000000000006611 RDI: 0000000000000013 [ 1004.320737] RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 [ 1004.327992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 08:57:02 executing program 3: r0 = socket(0x10, 0x802, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x0, 0x0) write(r0, &(0x7f0000000080)="1f000000520007f20000b2fef5000f430a0000e80000001ab4a5eaffffb92b", 0x1f) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)=""/28, 0x1c}, {&(0x7f0000000140)=""/80, 0x50}], 0x2) 08:57:02 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x2800], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:02 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x600}, 0x0) 08:57:02 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f00006cdffb)="8907040000", 0x5) sendto$inet(r1, &(0x7f0000000000), 0xfec4, 0x4008000, &(0x7f0000001000)={0x2, 0x4e22, @broadcast=0xffffffff}, 0x10) setsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000040)=0x487c, 0x2) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000000)) sendto$inet(r1, &(0x7f0000000d80), 0x219, 0x0, &(0x7f0000000d00)={0x2}, 0x10) [ 1004.335252] R13: 00000000004c5738 R14: 00000000004cce78 R15: 0000000000000000 [ 1004.379548] XFS (loop6): SB sanity check failed [ 1004.384407] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1004.395685] XFS (loop6): Unmount and run xfs_repair [ 1004.400752] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1004.407474] 00000000e354c6a0: 58 46 53 42 00 00 10 00 00 00 00 00 00 5c 10 00 XFSB.........\.. [ 1004.416352] 0000000018a871c3: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:02 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xe00}, 0x0) 08:57:02 executing program 0: r0 = request_key(&(0x7f0000000300)='big_key\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0) keyctl$describe(0x6, r0, &(0x7f0000000180)=""/108, 0x6c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={"6e72300100", 0x2}) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000240)={0x0, 0x9, [@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @dev={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa]}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2}, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @link_local={0x1, 0x80, 0xc2}, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}]}) [ 1004.425256] 0000000083381e17: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1004.434153] 0000000019e0809f: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1004.443068] 00000000460bf509: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1004.451959] 00000000e280cff4: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1004.460864] 000000001f895e1a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1004.469755] 00000000a968d19f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1004.478721] XFS (loop6): SB validate failed with error -117. [ 1004.516255] validate_nla: 10 callbacks suppressed [ 1004.516263] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1004.551677] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:57:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x400000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:03 executing program 7 (fault-call:1 fault-nth:1): r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:03 executing program 4 (fault-call:10 fault-nth:0): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:03 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x10}, 0x0) 08:57:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x20480], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:03 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socketpair$inet_sctp(0x2, 0x5, 0x84, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bind$inet(r2, &(0x7f0000000100)={0x2, 0x84e20, @dev={0xac, 0x14, 0x14, 0x1e}}, 0xfffffffffffffecb) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000040)={0x0, 0x5, 0x8}, 0xc) setsockopt$inet6_int(r1, 0x29, 0xcb, &(0x7f0000000180), 0x3) 08:57:03 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000024030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:03 executing program 0: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x4002000031, 0xffffffffffffffff, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000040)=0x0) fcntl$setown(r0, 0x8, r1) r2 = timerfd_create(0x0, 0x0) r3 = dup(r2) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r3, 0x40085400, &(0x7f0000000080)) 08:57:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xffffa888], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:03 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x11}, 0x0) 08:57:03 executing program 3: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000a8eff8)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000ac5000), 0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x80, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000a8cff0)={0x1, &(0x7f0000528000)=[{0x6}]}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x4c831, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000040)=0xc) close(r0) 08:57:03 executing program 0: r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000200)=0x5, 0x6b9) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCDARP(r2, 0x8953, &(0x7f0000000080)={{0x2, 0x4e24, @local={0xac, 0x14, 0x14, 0xaa}}, {0x400000000000306, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x400000000058, {0x2, 0x4e22, @local={0xac, 0x14, 0x14, 0xaa}}, 'sy\x00'}) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x408880, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000180), &(0x7f00000001c0)=0xb) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000100)) [ 1004.828205] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1004.859810] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:57:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xf0ffffffffffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 1004.937750] XFS (loop6): SB sanity check failed [ 1004.942621] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1004.953764] XFS (loop6): Unmount and run xfs_repair [ 1004.958830] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1004.965539] 00000000ddbc1f90: 58 46 53 42 00 00 10 00 00 00 24 03 00 00 10 00 XFSB......$..... [ 1004.974414] 0000000006bd8d56: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x80ffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1004.983295] 00000000f6be47eb: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1004.992173] 000000007f9c1ab6: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1005.001050] 00000000b80baa28: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1005.009965] 000000003e50f5b4: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1005.018849] 00000000b3f1568c: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1005.027837] 0000000075711b01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x81000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1005.039190] XFS (loop6): SB validate failed with error -117. [ 1005.050112] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:57:03 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6611, 0x0) 08:57:03 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x805, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23}, 0x10) listen(r0, 0x3) sendto$inet(r0, &(0x7f0000000200)="f1", 0x1, 0x0, &(0x7f0000000100)={0x2, 0x4e23, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) 08:57:03 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000fc030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 1005.081403] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1005.212615] XFS (loop6): SB sanity check failed [ 1005.217449] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1005.228616] XFS (loop6): Unmount and run xfs_repair [ 1005.233699] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1005.240469] 00000000ad631aa9: 58 46 53 42 00 00 10 00 00 00 fc 03 00 00 10 00 XFSB............ [ 1005.249351] 00000000598fdaab: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1005.258297] 0000000010cb8b77: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1005.267160] 0000000029fabad2: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1005.276034] 000000006e1e366b: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1005.284903] 00000000b7113f40: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1005.293767] 00000000633d8151: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1005.302620] 00000000f4d07e1e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1005.311647] XFS (loop6): SB validate failed with error -117. 08:57:03 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6c, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:03 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xfeffffff00000000}, 0x0) 08:57:03 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x6c00000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:03 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xf000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:03 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc0189436, 0x0) 08:57:03 executing program 0: nanosleep(&(0x7f0000000080)={0x77359400}, &(0x7f0000000100)) nanosleep(&(0x7f0000000380)={0x0, 0x1c9c380}, &(0x7f00000000c0)) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x1, 0x0) ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f00000001c0)=""/3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000004, 0x8031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f00001a8000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cuse\x00', 0x10000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000140)={0x100000000, 0xffffffffffffee5a, 0xfffffffffffffff9, {}, 0x888, 0x2}) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, &(0x7f0000000240)) 08:57:03 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="584653420000100000000a000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:04 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc028660f, 0x0) [ 1005.744524] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1005.774275] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1005.817604] XFS (loop6): SB sanity check failed [ 1005.822449] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1005.833597] XFS (loop6): Unmount and run xfs_repair [ 1005.838661] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1005.845384] 00000000e4adf83e: 58 46 53 42 00 00 10 00 00 00 0a 00 00 00 10 00 XFSB............ [ 1005.854268] 00000000c5a50dd4: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:04 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'echainiv(rfc4309(ccm(serpent-generic)))\x00'}, 0x58) socketpair(0x11, 0x80f, 0x8, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000001f3a)="ad56b6", 0x3) 08:57:04 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xd00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xfe80}, 0x0) 08:57:04 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xa], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1005.863157] 00000000606a0801: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1005.872071] 000000007750da04: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1005.880956] 00000000c794e284: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1005.889846] 00000000a49ab66a: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1005.898743] 000000000de9e21b: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1005.907700] 0000000059e66d4d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xf0ffffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xf401000000000000}, 0x0) 08:57:04 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x608], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1005.917585] XFS (loop6): SB validate failed with error -117. 08:57:04 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x6609, 0x0) [ 1005.976358] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1006.039616] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:57:04 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x801c581f, 0x0) 08:57:04 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xe803}, 0x0) 08:57:04 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000003000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:04 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:04 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xf000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 1006.784982] XFS (loop6): SB sanity check failed [ 1006.789803] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1006.801070] XFS (loop6): Unmount and run xfs_repair [ 1006.806139] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1006.812854] 000000008d254dfd: 58 46 53 42 00 00 10 00 00 00 03 00 00 00 10 00 XFSB............ [ 1006.821738] 00000000332f73fa: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1006.830611] 00000000a75fd1e9: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1006.839493] 000000002c1c6509: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1006.848392] 0000000069e91b8a: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1006.857274] 00000000e32764f7: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1006.866152] 0000000086e7632b: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1006.875042] 00000000b39725f1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1006.884065] XFS (loop6): SB validate failed with error -117. 08:57:05 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000002c0)="737461746dc1") preadv(r0, &(0x7f0000000500)=[{&(0x7f00000004c0)=""/35, 0x23}], 0x1, 0x0) 08:57:05 executing program 3: write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, &(0x7f0000000500)={0x16, 0x98, 0xfa00, {&(0x7f0000000780), 0x0, 0xffffffff, 0x10, 0x1300, @in={0x2, 0x0, @dev={0xac, 0x14, 0x14}}}}, 0xa0) 08:57:05 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:05 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x44], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:05 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x3100}, 0x0) 08:57:05 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x8004587d, 0x0) 08:57:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x600000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:05 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000407ff100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:05 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x5421, 0x0) [ 1007.081400] XFS (loop6): SB sanity check failed [ 1007.086265] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1007.097433] XFS (loop6): Unmount and run xfs_repair [ 1007.102494] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1007.109223] 00000000deb22806: 58 46 53 42 00 00 10 00 00 00 00 04 07 ff 10 00 XFSB............ [ 1007.118108] 00000000492d5373: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:05 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x20000, 0x0) splice(0xffffffffffffffff, &(0x7f0000000080)=0xfffffffffffffffe, r0, &(0x7f0000000140), 0x5, 0x8) 08:57:05 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x4000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:05 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xd], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:05 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x500000000000000}, 0x0) [ 1007.127019] 00000000e71d30ad: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1007.135917] 00000000c6f94c0d: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1007.144811] 000000001066b0b3: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1007.153710] 0000000052db182a: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1007.162629] 00000000d842447b: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1007.171512] 00000000295c02f8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:05 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x3c000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1007.180641] XFS (loop6): SB validate failed with error -117. 08:57:05 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000300)=@broute={'broute\x00', 0x20, 0x4, 0x618, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000680], 0x0, &(0x7f0000000080), &(0x7f0000000680)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x2, [{{{0x7, 0x0, 0x60ff, 'dummy0\x00', 'ip_vti0\x00', 'teql0\x00', 'bond0\x00', @empty, [0x0, 0x0, 0x0, 0xff, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0xff, 0xff, 0xff, 0xff, 0xff], 0x70, 0xa8, 0xf0}, [@common=@dnat={'dnat\x00', 0x10, {{@random="92b7bf2ee16e", 0xfffffffffffffffe}}}]}, @common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x92, 0x9, 0x2}}}}, {{{0x3, 0x1, 0x16, "741fb28533191568f6655f310000fe00", 'veth0\x00', 'bond0\x00', 'ip6tnl0\x00', @random="c6bae31ec78d", [0xff, 0x0, 0x4, 0x0, 0xff, 0xfd], @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0xff, 0x0, 0xff, 0xff, 0xff], 0xb0, 0xb0, 0xe0, [@mark_m={'mark_m\x00', 0x18, {{0x400, 0x8, 0x2, 0x2}}}]}}, @common=@STANDARD={'\x00', 0x8, {0xffffffffffffffff}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x2, [{{{0x0, 0x71, 0x22f3, 'teql0\x00', 'ipddp0\x00', 'veth1_to_team\x00', "761c0000e9fff6e3ff00080000000005", @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0xff, 0xff, 0xff, 0x3], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0xff, 0x2000000ff, 0xff, 0xff], 0xa0, 0xa0, 0x118, [@state={'state\x00', 0x8, {{0x5}}}]}}, @common=@NFLOG={'NFLOG\x00', 0x50, {{0xc27, 0x20, 0xffffffffffffffff, 0x0, 0x0, "b5f43ded94d5dba8cf9292a496b394b1789f3491657257a36bfe8b8482e19272753355a65d649f56bcea1faf1da1a6f848c34db924f85b0251f9708bce31838d"}}}}, {{{0x5, 0x40, 0x60ff, 'bridge_slave_0\x00', 'ifb0\x00', 'teql0\x00', 'team_slave_0\x00', @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0xff, 0xff, 0xff, 0x0, 0xff], @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [0x0, 0x0, 0x0, 0x0, 0xff], 0x120, 0x250, 0x2a0, [@statistic={'statistic\x00', 0x18, {{0x1, 0x0, 0x3, 0x9f0, 0x7, 0x1}}}, @stp={'stp\x00', 0x48, {{0x8, {0xff, 0x3, 0x10001, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}, [0x0, 0xff, 0x0, 0xc9a7128517722481, 0xff, 0xff], 0xe55, 0x101, 0x3e08, 0x1, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], 0x4e21, 0x4e20, 0x7f, 0xffff, 0x7, 0x7fffffff, 0xff, 0x2, 0x3ff, 0x4}, 0xb2d, 0x200}}}]}, [@common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0xfffffffffffffffb, 'system_u:object_r:auditd_etc_t:s0\x00'}}}]}, @common=@log={'log\x00', 0x28, {{0xa951, "e32dfdef927e5e48719ef6293992a19ff95c2a09db670a2fb9d8822ff204", 0x8}}}}]}]}, 0x690) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x51d003, 0x0) ioctl$RTC_UIE_OFF(r1, 0x7004) 08:57:05 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f0000000000)="295ee1311f16f477671070") r1 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x1000000, &(0x7f0000000100)="024b32263f43595006364171dc94ee8bfa9721758067c089e9dfef3a7941c1b6fc24380f866059268e937bd1d8e31cf7c22ddd7f1399326756466c95d7c938cb", &(0x7f0000000140), &(0x7f00000001c0), &(0x7f0000000200)="d05a1be45b1d8148b940d6ad0082f6afd6d8f008c0f9f85fec4c51632734bdd592495e2075fd") connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x14, 0x14, 0xbb}}, 0x10) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x3ff, {{0x2, 0x4e20, @loopback=0x7f000001}}}, 0xffffffffffffff95) setsockopt$inet_mreq(r1, 0x0, 0x20, &(0x7f0000000180)={@empty, @multicast1=0xe0000001}, 0x7) 08:57:05 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x401c5820, 0x0) [ 1007.240064] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 08:57:05 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x88caffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1007.333088] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 08:57:06 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x4, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:06 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x6000000}, 0x0) 08:57:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xf0ffff}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:06 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000e00100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:06 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x541b, 0x0) 08:57:06 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x900000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:06 executing program 3: syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x2, 0x100000000) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x20011, r0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/rfcomm\x00') ioctl$RTC_PIE_OFF(r1, 0x7006) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = memfd_create(&(0x7f0000000740)='cpuset.ppp1+,,\x00', 0x2) ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0c63df029ec38550c50000"], 0x29a, 0x0, &(0x7f0000fedffe)}) exit_group(0x29) writev(r1, &(0x7f0000000600)=[{&(0x7f0000000180)="405c785607598d2b063ff6fcdebb6be8518aef68d1e45e12b9d28853730c9f1c70b9a1b448df4abb43e4e9bcaedb4408cf38479faec246ef5272689a176972bc30", 0x41}, {&(0x7f0000000200)="77177e8a395ce9a530064afa826f3ceb02d190cb7e01654904c69f5aa6647997b017d42eea436ba736c15bf3bbc2371a28ccca651eb848cb97d24d2c506971b463f63b53c379b50547ed1f498f8ccd027d74eff7a30fd6d9b57aa01f6de97dd3354e4a2e50", 0x65}, {&(0x7f0000000280)="25e0bfcd92c164d69c958301bdada9b7d33614f95216ab8d8e502026de", 0x1d}, {&(0x7f00000002c0)="61cb61b5018fddb5ede0e8ae9a795edd2d5ef54a271620996257ef2c2afbf27ffc6a673a5f087b3e5149dd0dc7f060eb083281b485c3bb49770d7f295caa33879132559cfb203b703361babecb76e4e3208358df8647d3493451c35d96d2246d63c86cd38cb83ecde682a3d62196542d394dafb458a36385b81523895569e73e8d672315b2b62cde4c4884ea48fc2fb7e3210e22412bbd49baff677ef9d0b1f4aece3fc95f9ab73c11bc56b132747efd3af24263dd21797341", 0xb9}, {&(0x7f0000000380)="38826be441369094cd47489d84cac1f738742f139524256ac5353cfcc1d8d3accd3e7010c6369a7c2e8133aec0c48f558f95e171ab82d6a862be89815852f8df1c823525c17bc4ac57cff9b893ed67c8651e03d5872aa7130df80d54201fd4fe8ff4ff296b9c", 0x66}, {&(0x7f0000000400)="863ce45df8159cc3baee500ea85103e8d171c45b9b3942f0bd01fc17ce6669e2638add0be6604126f934495b6ad1b5a0be6ad88c6f094003819b6d2405d9ea625b7e49cd240ff61296b9f4e5b211600ae57d8a3dd927026666391d0d0851a461d47979e1de6242787192d31fb189faa96bcef3f78956a34fde7774036e", 0x7d}, {&(0x7f0000000480)="ffc98d297d473822d14cdd0c89837c02414c697c0a70ddc60435fbedb762e7f7a01da7e6f1b1bae19f297f72be56aad1a7fe3f0378e7e941d975c2ad8bfd3b552bb5bfb7ac38addba43c98bd7176103a611c882898275875a629bd8025dd52b99803567a4bb9737bc5aa81a1ed6e8c1297fa8420632947505d03b9e27c8b8d71953357879a21239c48ee87970fff4452a81da5a9cddacb4aea0de83e7c2bcd31c3b66432283238cfc5f27aaea5cfa19d7ddcb6a0889975b1614cd8b303bc35326aa24e478e7a4ff1ef9dfbf94b5164ce3589719fe22f7bfe223d92ac73e21c78", 0xe0}, {&(0x7f0000000580)="eef8c98f2205102e569a09153bd258e79734c358ebe16cd51cc55bb0e4de97a48c09642aeb11611a545b5723f205bf85116173b298fc80681e0279ec4ce9d5ce04a74af1f3819c25cc501bf0b096abf9c00b6ba9c6de6bf49266b04bbecde75ab46be1c52f6e2b2272", 0x69}], 0x8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="11634840a7dff334276d7a0100010000000000d77c396bcac12512b5d1067e693665", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000002000)}) dup(r0) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000680)) 08:57:06 executing program 0: r0 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00006dbffc)=0x1, 0x4) bind$inet(r0, &(0x7f00008a5ff0)={0x2, 0x0, @loopback=0x7f000001}, 0xb672b10f31cb69eb) sendto$inet(r0, &(0x7f0000f7db7f), 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback=0x7f000001}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) ioctl(r1, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") getsockopt$bt_hci(r0, 0x0, 0x0, &(0x7f0000000240)=""/207, &(0x7f0000000080)=0xcf) recvmmsg(r0, &(0x7f0000001c80)=[{{&(0x7f00000003c0)=@in6={0x0, 0x0, 0x0, @ipv4}, 0x80, &(0x7f0000000440), 0x0, &(0x7f0000000000)=""/65, 0x41}}], 0x1, 0x0, 0x0) 08:57:06 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40286608, 0x0) 08:57:06 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xe000000}, 0x0) 08:57:06 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x800e], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:06 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x74000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 1008.183819] binder: 19103:19117 ioctl c0306201 20008fd0 returned -14 08:57:06 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1008.261682] XFS (loop6): SB sanity check failed [ 1008.266554] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1008.277806] XFS (loop6): Unmount and run xfs_repair [ 1008.282875] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1008.289588] 0000000023b3496b: 58 46 53 42 00 00 10 00 00 00 00 00 0e 00 10 00 XFSB............ [ 1008.298748] 000000005da44084: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:06 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x9000000}, 0x0) 08:57:06 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x80086601, 0x0) [ 1008.307637] 000000006db09ade: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1008.316530] 0000000064e8c803: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1008.325445] 000000008b964f4d: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1008.334335] 00000000468aa525: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1008.343231] 00000000561d98d9: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1008.352115] 00000000b22b2daf: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:06 executing program 3: r0 = socket$inet6(0xa, 0x1000000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000080)=""/213) r1 = geteuid() syz_mount_image$jfs(&(0x7f0000000000)='jfs\x00', &(0x7f0000000040)='./file0\x00', 0x5, 0x2, &(0x7f00000002c0)=[{&(0x7f0000000180)="926a20da80ef5aeaff027594813fe68b7b2b17ec4827a06f20934df54cd66e3476013d16804fae3b2e64494062b0a268ae4e4e81e39d2465e880e155716dce97f8cb3eb9118da054c5e604490d2e4a9402d112c2122b6e68707e1d36e3c4a31b249a12dba01f772f2c66", 0x6a, 0x200}, {&(0x7f0000000200)="ee92fc887961310e54603ecfde8582a8aa93395c04b48a4d57cf5258428171f459e8d543d9586c95126a2572a2e9cdeb3f50fdc8b21839456739b54eabf538687e4da3967560124f1e1305965ec339890a6137aa96cd2e22869c6d3cc1b0426fe8e422c6559e655770b2", 0x6a, 0x7}], 0x8000, &(0x7f0000000300)={[{@iocharset={'iocharset', 0x3d, 'maccenteuro'}, 0x2c}, {@uid={'uid', 0x3d, r1}, 0x2c}]}) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/mixer\x00', 0x200, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000380)=0x10, 0x4) [ 1008.361139] XFS (loop6): SB validate failed with error -117. 08:57:07 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0xc, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x28], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:07 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x100000}, 0x0) 08:57:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xf000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:07 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x800c6613, 0x0) 08:57:07 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000000e0000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:07 executing program 3: r0 = socket$inet6(0xa, 0x80007, 0x1604000000000000) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000380)='./file0\x00', 0xfffffffffffffffc, 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x2011, r3, 0x0) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000d0fff5)='/dev/audio\x00', 0x42801, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r4, 0x84, 0x6e, &(0x7f0000000340)=[@in6={0xa, 0x4e22, 0xfffffffffffffff9, @dev={0xfe, 0x80, [], 0x1d}, 0x7fff}, @in6={0xa, 0x4e23, 0x6, @remote={0xfe, 0x80, [], 0xbb}, 0x5}], 0x38) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000040)={0x0, 0x18, 0xfa00}, 0x20) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e20, 0x5, @mcast1={0xff, 0x1, [], 0x1}}}}, &(0x7f0000000480)=0x84) syz_open_dev$sndpcmc(&(0x7f0000000540)='/dev/snd/pcmC#D#c\x00', 0x7, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f00000004c0)={0x39, 0x8000, 0xce34, 0x6, r5}, 0xffffffffffffff2e) ioctl$int_in(r4, 0x800000800c5012, &(0x7f00000000c0)) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e20, @loopback=0x7f000001}}, 0x0, 0x8001, 0x0, 0x100000001, 0x8}, &(0x7f0000000080)=0x98) ioctl$VHOST_SET_VRING_BASE(r2, 0x4008af12, &(0x7f0000000580)={0x1, 0x2}) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000100)={r6, 0x4, 0x799}, &(0x7f0000000140)=0x8) ioctl$KDGKBENT(r1, 0x4b46, &(0x7f0000000500)={0x8, 0x1, 0x4}) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r4, 0x84, 0x22, &(0x7f0000000180)={0x2, 0x8002, 0xffff, 0xb13, r6}, 0x10) getsockopt$llc_int(r1, 0x10c, 0x0, &(0x7f00000002c0), &(0x7f0000000300)=0x4) 08:57:07 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x9, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="854000000000000027000000dd0000009500000000400000"], &(0x7f00000002c0)='syzkaller\x00', 0x9, 0x4ae, &(0x7f0000000340)=""/207}, 0x48) 08:57:07 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="02641ab3d2d3110d5f08eb") r1 = socket$inet_smc(0x2b, 0x1, 0x0) listen(r1, 0x0) shutdown(r1, 0x2) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3, 0x31, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0xa000, 0x0) ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000140)) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') accept$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000007c0)={'syz_tun\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f00000009c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000980)={&(0x7f0000000840)={0x140, r3, 0x400, 0x70bd2b, 0x25dfdbfc, {0x3}, [{{0x8, 0x1, r4}, {0x124, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0xfff}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8, 0x3, 0xb}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, 0x101}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8, 0x3, 0x3}, {0x8, 0x4, r6}}}]}}]}, 0x140}, 0x1, 0x0, 0x0, 0x4000010}, 0x40800) 08:57:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x5], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:07 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xf00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:07 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40106614, 0x0) 08:57:07 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xffffffff00000000}, 0x0) [ 1009.442454] XFS (loop6): SB sanity check failed [ 1009.447300] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1009.458474] XFS (loop6): Unmount and run xfs_repair [ 1009.463541] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1009.470250] 000000004ec268cc: 58 46 53 42 00 00 10 00 00 00 00 0e 00 00 10 00 XFSB............ [ 1009.479135] 00000000003fc0e1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x800e000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:07 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xa000000}, 0x0) [ 1009.488018] 000000004ad6e3f1: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1009.496911] 000000009468aedd: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1009.505792] 0000000089674962: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1009.514672] 000000009d2dd9bb: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1009.523547] 0000000053bbb1aa: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1009.532424] 000000008211131e: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:07 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xffffffff00000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1009.544217] XFS (loop6): SB validate failed with error -117. 08:57:08 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0xd, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x48}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:08 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086604, 0x0) 08:57:08 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x7000000}, 0x0) 08:57:08 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000683ff4)={@multicast2=0xe0000002, @loopback=0x7f000001}, 0xc) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000040)=""/246) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000700)=ANY=[@ANYBLOB="010000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000ffffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e6a575e917fd1e63c0324b7f9d0859d378d89bddff4b721948046a2cfb7b2e2221bf7b1db19b63af4c50f9731d23be2885fef412dee26b1f04309a29e6888fd454d96ca2a62d6dfe15d0818184a643a4963f9f91f7ffbbf4c9bba6315c1c5f9fde51746583deee82cbb71e6706365e4e737fe8690d1900ec9c11f7d9f0e8eefc3f763e90d2bf6e650b3237feb6b85fec27a2aef1bf05b89d76fc6b909f51568204949d0d5e0085032350c444032df2d8ba16373798d178f6feaa74ec9ae4a811b5e057cc6b82a3b1bd1ea8cd94c0c68f9e7cc6818ce68e1db61d601d839889c1d937b51d55b1383853223754836e10d57b184ba80c1d14a4002e6ca1965eac9e3f7cf0df7351c7649f349f5d90587771266c83dac36a18c2b7bde824b42e57fdd230430fbff31ad87c395b831ad4631ad49cdcfa9814e1688f32f99559a1e92ecf7a6463a2aa565ffccf7f0ee2d6151fc1df914e72c38f9a6eff2e30a9a3628bc5f200df82ed577cc1805e3d626982032b7d5526"], 0x110) ioctl$KVM_GET_TSC_KHZ(r1, 0xaea3) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000140)={0x2, 'yam0\x00', 0x4}, 0x18) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f00000001c0)={0x1, {{0x2, 0x0, @multicast2=0xe0000002}}, {{0x2, 0x0, @broadcast=0xffffffff}}}, 0x108) 08:57:08 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000280100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 1010.504187] validate_nla: 14 callbacks suppressed [ 1010.504195] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1010.533481] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1010.552016] XFS (loop6): SB sanity check failed [ 1010.557013] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1010.568175] XFS (loop6): Unmount and run xfs_repair [ 1010.573248] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1010.579964] 00000000403ac827: 58 46 53 42 00 00 10 00 00 00 00 00 02 80 10 00 XFSB............ [ 1010.588845] 00000000313b4e54: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:08 executing program 3: r0 = socket$inet6(0xa, 0x10002, 0xffffffffffff8001) ioctl(r0, 0x5, &(0x7f0000000080)="025cc83d6d345f8f762070") r1 = add_key(&(0x7f0000000440)='big_key\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a}, &(0x7f00000004c0)="72f35301a28f8e81154ff105650cd179fdae1ec4d8e782a685afc58fe9a9808cf71e59e86fd4df45d70335465eb3524794820ac7e774134e43463cfcdae5108f849b08b20050e5a7840211e13b702b369442795864a8eb34b2a759698104685e733170b7120d8d607f46e3b2920af45a3aeb2545017faf8f44e37f084d1ce3d8fdae8222ed9d4575d22a81562daf28a141c23eea6b6b077a37f49fdbca0fe36b5cc7031fe62df1f4f7f16400e6b9826413f846e1426ddbf1272c700c8594e41fa3df20af26e5a865583c46330d225e906bf3bb13929c2a2df768c8684ad139eeb33da5cfb760f72584fdcbdc3fde079d4b289088e0166dc679393e8b0cf9621718c71e9d5f86df69d0e569d5712f935c2c3717709269491d97dd820b843c0df080fce0f0194e09d1d22d697e1f11e04a6aa5ec47bafcbab9727c9ea4cbfe5687ff6fb7741801dafce497d75b4de8f6438c03df056a776535100c6fab84d2d5c45ad743fedc3ff058d3ccffc3e1a8546cee79cec1ac31e016e56d0bd938877d3ad09fa0ab30a91c0e57f6dc36725f5fc28927061d84838ee94097521652bb920655e886561e2d7d4ece20b700bd0a4cd8e79e03df72182809f1f73b6200388ac65656ab6725a77acfe6300805e610a46136dfe206c7f9e3339e13f3ae4179e86e82a47b7ab7a2f1c4de29f7455cdf30ee6fd2e4f107f1859e43d3c911f308d73f69dd7390535181ac8907723842b9236c0ed6d2a3213baab88ec8cbf3e3e81c939877f81f7c2448f56f0cdea670c4f72bb7fb80f0a64c6e9c11a187770986993b52d5eb8d98704dac18090aadcaec0f64a9e2a269e9af386543a7f81c9634106836df048194f9f87b850112d4b7564cd272789b1be65ee67608985ce86d62354c8a48613d968c76b8191bb46a8c8bcf11bddb67872043f7605493f3b71b83efe45d92d9066d692a13eb52798d877ef12749ce41ebfe0a612ff6278a39042569c009575615ec0079a84fd5aacd6df493c4b17c9cace7d436bfb265385522c9e9a110b902d0a40c6eb65d206a215e6a1a2930c18fe6e6bf1d29b87d04c1543f4b8db573f2ca1ef9e67c90a7d3afca756cea38afbfb5fe2f43a8d8f913f8cd27d9c74c2e86f889c9a103f4d4fcd91642788886548b8bbba751405e37752978a9b3aa685dcb37519d71f399dc7ec7561024e463e35ecca30537c6e6569417a72c04272cc87f02f0c919084aad7c6a4c29913da04e5097ebdd169059070c9611c546cccf5369b56af02fb9a471167bf94dad9ff277901b3a5046e934b7c08068e212ce81744f7f89fa40dcf72cee409f11c77ce83c97447ed39f3b205afdfe605c424bfe8dcd1d2aef6234fcf5eb6be259915839d8190247cd165f155aaee354eb2f64635228cc5604e38db68f9babb5828c72c816d6865332f6af4eb036bcdcf0706f12b717ae14630eeb4a6f7dc2cca118322bb95264e24702d874cb0ad4e8543bc341e317e55d78ff29d9e0fffa0971880fa62e354ef26dfd3f16e8833d53feb0fa2c01ce422dad6b2f69557dd108a998237d4d4ed229d63cb5c662ed71d02d508dc2d673b21e25b1c0ce598fd7d0ca9912fefe6ba03e9a81a7d015a15f5268bc2ab4986dccbb33d3859d38ae7d5b08f1fdc74f430f01d88c415b2be91f029388ff75de04288c87fd5ef23f658b6c7847bcb123de382fc15f8383f0488575b07afe5bedbe2b3d774f243c", 0x4c9, 0xfffffffffffffffb) keyctl$read(0x3, r1, &(0x7f00000014c0)=""/4096, 0x1000) keyctl$unlink(0x9, r1, r1) 08:57:08 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x4305000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:08 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x5}, 0x0) 08:57:08 executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = fcntl$dupfd(r0, 0x10000000000000, r0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0x7, &(0x7f0000000000)={0x100000001, 0x7, 0x7, 0x4}, 0x10) bind$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, {0xffffffffffffffff, 0xffffffff, 0x3}}, 0xa) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000500)={0x0, @empty, 0x0, 0x0, 'lblc\x00', 0x9}, 0x2c) 08:57:08 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40305828, 0x0) [ 1010.597731] 000000004cb8c00d: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1010.606613] 00000000f1da6ed2: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1010.615564] 000000008832ca9d: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1010.624474] 000000005a46f327: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1010.633355] 0000000026ca09c2: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1010.642249] 0000000052864c7c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:08 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x6c}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:08 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000180)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x40000000b, 0x100087) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r2, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000001}, 0xc) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @loopback=0x7f000001}}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote={0xfe, 0x80, [], 0xbb}, @in=@local={0xac, 0x14, 0x14, 0xaa}, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@mcast2={0xff, 0x2, [], 0x1}, 0x0, 0x2b}, 0x0, @in6=@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x0, 0xf0d0}}, 0xe8) connect$inet6(r1, &(0x7f00000000c0)={0xa}, 0x1c) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x800, 0x0) setsockopt$llc_int(r3, 0x10c, 0x0, &(0x7f0000000100)=0x9, 0x4) [ 1010.651209] XFS (loop6): SB validate failed with error -117. 08:57:08 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x5452, 0x0) 08:57:08 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x2800000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:08 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xffffff7f00000000}, 0x0) [ 1010.746005] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1010.798838] netlink: 'syz-executor5': attribute type 11 has an invalid length. 08:57:09 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x12, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:09 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000023100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:09 executing program 3: r0 = socket$inet(0x10, 0x3, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_ENABLE_CAP(r2, 0x4020ae46, &(0x7f0000000000)={0xf0ffffff7f0000}) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="2400000003061f001cfffd946fa2830020200a000900010011e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40200, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r3, 0x2288, &(0x7f0000000080)) 08:57:09 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x1030000}, 0x0) 08:57:09 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x89060000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:09 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x5450, 0x0) 08:57:09 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0x3ee, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="280000001c00140f0000000000000030f300008024e44a592c4ba4fc888014220e9cf0c11e8d9de7eef9d5d9a1b8571d24adb9f3b3f605777815f5874bff37befef40fa50e0e38775902a8823e3f8a11651a28875884773caf815f22e59fb4c6e105733c3363bdd5564abbcc1ec537a432e1b4c4bc82b8c2c1eb99cbdf2426", @ANYRES32=r2, @ANYBLOB="000000000c000200aaaaaaaaaaaa0000"], 0xffffffffffffff11}, 0x1}, 0x0) 08:57:09 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xfffffffffffff000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:09 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x2, 0x0) 08:57:09 executing program 0: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x10001, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb64c86d6b66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f00000001c0)='./file0/file0\x00', 0x3bffa, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="8d"], 0x1) syz_read_part_table(0xfffffffffffffffe, 0x8, &(0x7f00000015c0)=[{&(0x7f0000000340)="4a5a1bf329d8af1452b8e4f03feb17cc717eac0adf4b7b0869e0b461ac9ca067b157723d75d043c1b226b45053a292e31b26e1ed97aa533e3b968656c906ab03251a04ae6763ff7ad58fd800fef3efac6093e458f6070cc55cb7a70120ee5732", 0x60, 0x8000}, {&(0x7f0000000180)="14e1ac156fbf7e071df1d9e6f5be53", 0xf, 0x40}, {&(0x7f0000000280)="9e240d421b61de49896d655b81aeafb9b5d203", 0x13, 0x20}, {&(0x7f00000003c0)="bb0a8984578277e13548fd97fe8058532aa5d5086e6cf9726bba98c15e28", 0x1e, 0x4}, {&(0x7f0000000440)="30ff7f1170ce20250d4260d5bd", 0xd, 0x8}, {&(0x7f0000000480)="b93b91c17a1954a4c396b76aafeba5faed3f9b07d58c0b23b95238d1a4c2aeeaa004b8ebc4ea2e5ae7a2d76a0463461ebe17524a9144e8756ae9374d", 0x3c, 0x6}, {&(0x7f00000004c0)="701916129fb5035006270d14ca2533466eb9726dd4d9a312cba59e0f23e8213b9bc765c764e5463dd09da7fc253e867944b5d5ad8aba2e983a8cd9dca09b3a555a91c4974f578f7074a54c7c034a51724337ed7a1288d575476312611ed29effa639ba56550dabd56281b12cb32904d0e6c2378e581c1f0d41bbf54a2143d2f0a1f78bef945e417176b643d915015981aa6de5038511839698acdb4e8353f7695eb8ed031398adfc5a85605fdebaf8d90d57b07bdb62e4c3cc5b037d21ece93a16c487893227aa2eea1e64c6de4351db4a2eb13c37e142aa", 0xd8, 0x6}, {&(0x7f00000005c0)="520b6349c1c93f012830ca4dc62b0ead215e02acfb69f93d925efbd91386a186a9d07c6c72189d6ceca798b8ace5a236193cb9768c52460373d8a650e3d932905dd8794f6e3629579265d4b73e69ee480fbd8dc3662540068d819890813bf54a90f0889b47ce56f3933ff88ea03a27fab72d7f3341d9e9083c7faf5fbc19ee82f65b518fb2f5e3f33c3622e3037a137545dc74777d7b097bc2fc2904139548d90af267901675c9efa376d64867f96f3c47805705f605c5243742706aa5ef39a9e5b178b279aa603db885b786040e6f7b90f99538e6fd17f545c36c1a03687cd093dfcecbaae696761ff84a8e6ea1a22e2e059bf40e11f797822bdc9ad71a98e1dcb0a665e8b6a2569d4d330908c3006d939a08fb474221922cce06d3bb32248019dcf7c40b23d1be0ab3fa09091306b3f677f0a27ab578722abf67620e6f225c72abfd348fe0f709992a43563b89d420d0f9df4edc7a5ae3a9ca367879ed548e4dc7a951ad947f27a864ec9df3c759b461e33b19e02f43c1ddcb8cbc4b379f9cd228469546e08eed5842a7bc74873f21c86415c4fc87cf860508dcc0f2266234b0e0a3da3ee1604fb89399d10039d3ce534ea83d3da030f787de02b0250794a991a2111b9c465d5495ace7bde6a9398b1c29e8652d8c3335b2ffe8c9e822e10e7a36324f8f3b0bc2cba7441e47b79181a07aa205590303b68361b440d890e5741fd0fc26e4a3703809f9e22073ed1bf163871e8b686dc726ec35f90f578b16f7d7f252f5fe5bdbcf8f8753663299ec1d592633a83fe785b682d70efe872afff0ed0c3b782bacdc22a014decc28edb27438bcd9af70c6c23ab41eda84dec8e7262b3442a1181b7c83137418fca4889b76ed4f74a5bba6d11285a43d0024954d0284de50ad317d9c3068768439a2ee6db8d88c9ed3e78de301c5ff928a96a7189cf941b484fb26de61ecdac01b2ae16f71f23da409ff7ee7edd151231a0cf68363bfdbe9ef0b9493c436806ca3ea4c014cd610d653f5854e99d4450ca4d6d42b30e76db89b5b1080706cd5e3ec43fb9726ebefaeb0cb98b6cebef4ac58b38f909c74080ab87a23f2a62c5aaa1b3948cc2df476d6f22caac8a77a7963870fac9701a3dc399836c8aa7faba3bcfe1dc707a6f06c2b38f315502092fca156cfaf6980fc28f2dd8fd65da5aecd657da029592ef589014a8a22445f4e7dafb5e7c0cf8e24de21c165131c5f87e727e347de367bc1342f8ae439aea8511a47d32fc908b452e5147fc88d65dcc680ad47132a4843797580ca62aaefc7f0d0d893a9c54ae063d6c02db3df967d2b0955ce136ac8e895d99091fe5509882c22523a097e6fbc389c8f529d7fa69052beef16e165aae546faf5c91f4f55718fc33cb7da89e9d4741da61d348372a7dc7b02812c15f6f495fc31b4232a9786794996d612a52f48068ec9ec912be86f6158c6ad91865ee4ea1c454858ab1a7a842e0acf23cef15ed00692723889ff5d5461364a304938b32a8b4267246afe5d7f936da420ffd681dd23bcba74fed81bc8d61ae90d61300afa9f2d4ce0928ce007630e3e0d859e78fff1b0e6edfa5b4e59309d22a302b23215436a8a2f2c39099481f77e6e5ed60d6e142a2de5bf093e30a4817a6d1be662db858d53674e43e8b3d47f3472131a3650b5eeac773ecd90dcce9d00805b39829c3d8530f3761a4a9b068d3496fa91f41dd77ba9ad7ad81dfc441ff6c2a4f45d0bad414af96f922b3490be13ab2f682fc396a72747bc80bde714fddea54842c26012f08daa188538a66f05982844b2f0354a802cdb018b83603964c0b782172186ab98c96b7919b9c18472d2a314ea1ec0d40c51dcec6f51faf0d2f41c251ac86fa75987f88723d3a260060d1f5c791f20e2279d77a4da6b33637fb09fb825c1708bd387522acd9610742ece799efda4120557a86fd338b83bb17f4786dab392efd5e4dc90b5a2d5c7bcb8accf3a04550f4fdba153d9ace4ac518015467605c67a994d1d4336e09b3bd2fb5029d79ce38ace621c2ac4f4f1b618521f5ecc4210bf51ff78cfbb9e1b0d8b8485c14fea5d61befeea4410d5a232c3e9d413cc7653284d625fe25b23293744174ec0cb594742202d0ad75f4c58ace2d7d23df472e1a544610ad23683718ebfa7a6a3f029a5982040a46d4195b042fc3d1803f12d47c9c6db7f81e48ab7a6b3746d3f273e50bd15fd354911096c78b09a54384efa3118b59e2ba0315dfe1536a8ad7e06f98ee615c48e0b6b2e004fa4e1322315500e1b52974ac70e2a54b4c9399256ce012c4f3a7864b33b992eeed721bf55d883e8c1574daf538a4dbde74581a2167838849981471d668f12f637fe07e8f507ed2ee151b6000b51372b781af5a1141cf7e3ea3653c11c1b52a87156bb09b259e19782b81b43aeb6a5fc55c45760a5fc4441016f38ed722a09f74cabad2787738200a1cc492d167d196a232a425833e9dae467527a471eec9a53ceb8be856aa62d35ccd07394591a47ff2d2b164ae5582ac39793f1d8499fc6603f2cbf2802dc72c6e31d51341b878c31b6cf30d31395e54a1f456f88f95a0287fcc5aa361234844afdff60f6a5db3d3efc36c34684a17ebec8c0dde5e721ef451312154ef5c0c859a1d7a36fa690a3d46f543d0a76d50686589c7f734b53918b8d188af0146ef087d7e704e4deccf45ab361aac4d43ff643bdcda8299cc2dc47adb93a9dc73041a72bf30940a48a63b5573d0c26456f260e1108ee2ea4e6bc6a8ef8ca945a39dd686ebdbea6ebe9b2631ca02434a7affef49cd9618b16e76ee0add40cdd3a588e3416e64cc8a215ffd1b404587d618bc991507c6d9c07c261c6bba43f88ce38b0547db470be7dff87d525c909e75d078ab8032fed9d584d0cfe187f4a75162769e914970bc094e7bbd4ebc4b18178ed3ad484e1079544f12abff49fa444a08ae80e9781a452e31d8339cb14146a026b7bc76a2a093855f133ea20d408013af783230229caaf1c6b927d04bbb8b93e1f66607ae17c10b03c41e5d1ac6d41fba41ccf4c331c0158d60b383e0286c91852beae9dd41d4df6e7386d0b4eb6e313ce710ef95bf9495bfac1f17e5666b8a3c1bf27bcf08114abd38ab25a396f2f3c957d4260a852b63ccf3a7134c78b21635b652da2e72271e18518a13a3e60790c2b98c04cea89b41563a456262e76235672dd28b55e03b358b50b37d0bbed4d844fbaaae3077c79ed3feedae0b04553a4c51b9b8bd1758cd9d0a7f92be0d2bb413e9e0d701f739c54fe4a62c36fdff0715a696a594c847dea9edf077f99eb39f4fbeddba1cd0f1d135d5b4ee937f7d72e7a6e4f6112c9c23e7e7051f28a997f112fa04798debf62529df16016371eee5a65ba1ab6f402134ee2cbd1aac4e3bb96b1e5497ecc1697983d6df7b5018081d6e1ef3c15bcbc165b5a5d07fde83898fd9d9dbcadfecac328342635a4cf943a84918c39cfd641e06a4a3fd40394a45c786c1b61fe5f5f27a54fa7fa079843e604421bd6dfdf1c9e09ce5ac88abeb89f8f53e33d15a7cc003ed6e0cb02e40235b9036e558ef4142677f2ab521061cc3e53971a081bbf9ea73dbc6b6374dde232bdab5dcbb2d235215faaaa7cd2ab459f8d822e8a59497761768b33c4994f157a6b40333be7d1aa8983c3dff736d04d1a48008f7f51a6152793ea70930cd7164dc5be8d3d580e6a16e0752317f228bfc50fdecfec03d1d147c1c553951bfc71f6879be7a477857c18b05f9b09e060ac3416c34ecfb2c1b596fb09b6b7955b455ca8d0856a2a85615a88c2fc62975945200bbef087beb90e9f33df94291b12523a03786407e7b7361fb55c1e4609add0cf3207b48f6399855d4cfcc8438fbc4de27cdecd95427a701063e63578a675d93f8b21126809fce07474150699ca1088d0f24e02811133f4c2e87743eb19b9c716032b1167b0873e6f2139e32aa8761a700013bed7f99cd4497ac86ec69ce40c1ec73aeebd74048872f19a1cde445dcca8faf3b0d1717bba59e68f2c6d02fac922a504017f257186c0ec28190526adf3a38d262844de54596edd9f22414ff9259b9c7f687045d5885856ce4f03c8377c648b2b795abe795eaa1769bf7e76edb8b33525a958c3ea21d016fac15e79c0501e8f7f2ea81c363fa035da11365081943a5795ac26373aa375b7e410e6998f31739b7a0d519a877c4d1ea33187b3b592646aa4c0fce5a61a89bca7bd347e279b2b34ec226b8465add43f17ce72087377e39361284b625812094ed1deea7a26f6af207a5d2724c5123bced21c048103a9856d8f0ab07fdcf61cf60face7baaef44ca79064e03ef268a8b9600ee6be4dd393dc1b74bd3759c4799922c2765edfcb1160e310ce9d90a392414c62a69dfdfd5cfcde30c5783e7cf82fc75a2f52052f832513598f743a97feb2987a2967f2eb473aa72e43047cfc972a4802961e312be247fa4b1b427af6e802004b22ae0dd709e7b9b5d2a436dad5364a2d58ce8b6823f4686190296e73a493f5f2f82fc6da991e1eff7f4e325ed28aa56e1d0d67cf59f8e5d30535a15183eadbfb030e595540526b6711236bce3e1371394c8324ab19ff5249378261becbe958b09d952b5cb1ef83bbd42d39fca9ddf6ce64ce4dd01fb419cb53d1c4b39acc4b337644c047026d10011be03365461b63fb3817d43dadfed297f167b5fcac781555b6948b7d26535c20c87ac34fb4a582a49ea20c2f4f72a9b1b737a7692760ce9b69eb371e5632734b1aca7d0517a748e52cb725cef0aafe5f42f86c00656f73b374e81a1b33ae377b0a17b2a9b83796c223a08162eb5af97e28e0d8c6765f990e9e7b2b50f31d35b7bf20cbede8821fde90807bb6d2fc978a274e5e8fc16462b82f5397ae0d28f5e78701af2f60cdadfb18a5226a67c04663ddd3a7a03b72ade6bd1632026bd9615519dabdf9a75239dfc43b8bbde06bccc5258b8115e5a7d2f0af3a3bd8e13fa8aa0c22a331d5c5aab72a5de649eb311d2cd70a6cd93184ee2c1fe5628727b5613f038d74396b7edd31cd057534e37c7b629ca35c8184e94ceaaeeda938a851becf7c97813fb953354ad4de30b7b21275c7a42d28988fcc73f4ac121aefc2b09af513104ab1b8f93fb81690e1e63fd0909a70e0ddb9d3eac44c672f60aa3c80b4aede1fef88f7741c5b6e22dd66c3c31217b9fc7f5b6319467c807074153f07ceb6b581a4515f99220f6d7e463cb1d72e045550c35e2e34e5c67c8d7dd8b2b02d5c0365cb57bf88be920b35821bd32181845cc199ade2f947d6630b9069a40eef8a6759cf3fcb84744305ef42154966247c9893d1a6fca79d5b8ed21294a59a219f6a5b65564c30d52bbe3ba25fcc4aa039d37b9648c5cbb8a2e6f13880670a309d7a09693f64d7f20b3a86b4bc800d896675a5def823467ae040265ab6874ee48d8507719a94f523986dd399c238fa9bf651de564c281104d3e0ff3ae2a636ce4af4dd2ad176859ad7c2f9e239a4dc7cedc6d7c3e47d032db5fdd6d8e45450d2ac7ba34623d437e5fd643b6d0ea80f17a516941b9b010dcad2f0f9a003ba1fe3db927d4c3300e5bde51f8c9fc387e9b885ee5debccb22d358bfba49d9c6f242248cfd255db067719127da15c6e82b00f6f556f6631c7333b337b2550b5c90a9d8c9b0e6a52e578bb6a77e46e7cc49d8d176b3f20469f649313bf303f35327f1ee49c6481b9291c862ddb0988e4913c2548edc8eb27baaee9057e56e9b087c132283b83aaf71572c6d048095b9f40ae6d0d71", 0x1000, 0x9}]) io_setup(0x5, &(0x7f0000000080)=0x0) fcntl$setstatus(r0, 0x4, 0x6000) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f0000000200)={'broute\x00'}, &(0x7f0000000000)=0x78) io_submit(r1, 0x1, &(0x7f0000000400)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f00000002c0)="80", 0x1}]) 08:57:09 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x5000000}, 0x0) 08:57:09 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xa000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1011.673651] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1011.679421] netlink: 'syz-executor3': attribute type 1 has an invalid length. [ 1011.688530] netlink: 4 bytes leftover after parsing attributes in process `syz-executor3'. [ 1011.708398] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1011.772531] XFS (loop6): SB sanity check failed [ 1011.777386] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1011.788537] XFS (loop6): Unmount and run xfs_repair [ 1011.793598] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1011.796577] netlink: 'syz-executor3': attribute type 1 has an invalid length. [ 1011.800311] 000000004c0af2fa: 58 46 53 42 00 00 10 00 00 00 00 00 00 23 10 00 XFSB.........#.. 08:57:10 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x7914000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:10 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40049409, 0x0) 08:57:10 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x3580], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1011.800328] 0000000096780070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1011.807627] netlink: 4 bytes leftover after parsing attributes in process `syz-executor3'. [ 1011.816493] 000000008857559e: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1011.835697] FAT-fs (loop0): Directory bread(block 128) failed [ 1011.842656] 00000000f2e23a67: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1011.842668] 00000000a9e74434: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1011.842678] 0000000016e546d7: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1011.842695] 00000000ae27e20a: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1011.884078] 0000000085cfd4dc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1011.893066] XFS (loop6): SB validate failed with error -117. [ 1011.899935] FAT-fs (loop0): Directory bread(block 129) failed [ 1011.900203] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1011.912944] FAT-fs (loop0): Directory bread(block 130) failed 08:57:10 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xffffff7f}, 0x0) [ 1011.940469] FAT-fs (loop0): Directory bread(block 131) failed [ 1011.955547] FAT-fs (loop0): Directory bread(block 132) failed [ 1011.962246] FAT-fs (loop0): Directory bread(block 133) failed [ 1011.970575] FAT-fs (loop0): Directory bread(block 134) failed [ 1011.976703] FAT-fs (loop0): Directory bread(block 135) failed [ 1011.983656] FAT-fs (loop0): Directory bread(block 136) failed [ 1011.994467] netlink: 'syz-executor5': attribute type 11 has an invalid length. [ 1012.000405] FAT-fs (loop0): Directory bread(block 137) failed [ 1012.029693] attempt to access beyond end of device [ 1012.034768] loop0: rw=2049, want=310, limit=128 08:57:11 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)={0xaa}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000013000/0x1000)=nil, 0x1000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) setsockopt$inet6_opts(r2, 0x29, 0x4, &(0x7f0000000000), 0x8) close(r2) syz_open_dev$sndseq(&(0x7f0000000040)='/dev/snd/seq\x00', 0x0, 0x121000) close(r1) 08:57:11 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x80087601, 0x0) 08:57:11 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x1100000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:11 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x74, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x6c00}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:11 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000062020000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:11 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x59}, 0x0) 08:57:11 executing program 0: r0 = socket$inet6(0xa, 0x3, 0x100000003) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = open(&(0x7f0000000200)='./file0\x00', 0x14104a, 0x0) r2 = syz_open_dev$evdev(&(0x7f0000974fee)='/dev/input/event#\x00', 0x0, 0x101002) syz_init_net_socket$bt_l2cap(0x1f, 0x7, 0x0) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000001c0)={0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[]}, 0x1}, 0x0) write$evdev(r1, &(0x7f0000000080)=[{{}, 0x1, 0x74, 0x2}, {}], 0xfcf2) sendfile(r2, r1, &(0x7f0000000000), 0x100000001) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f00000000c0)=""/216) 08:57:11 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x600000000000000}, 0x0) 08:57:11 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x5460, 0x0) 08:57:11 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x11000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x300}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) [ 1012.926704] XFS (loop6): SB sanity check failed [ 1012.931536] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1012.942684] XFS (loop6): Unmount and run xfs_repair [ 1012.947759] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1012.954474] 00000000b63660c6: 58 46 53 42 00 00 10 00 00 00 62 02 00 00 10 00 XFSB......b..... [ 1012.963343] 0000000071032cea: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:11 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x4000000}, 0x0) 08:57:11 executing program 0: syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x0, 0x0) ioctl(r1, 0xc00000000, &(0x7f0000000240)="d99c2de8b8b3112d6089d642f27e657e5d69") getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000180), &(0x7f00000001c0)=0x14) tkill(r0, 0x15) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8916, &(0x7f0000000080)="025cc83d6d345f8f762070ab7a330800000000000012d3c82e30c64826ea0d13c462a65561b75b5564b2b9bd25810aef051b7f7a3b11de933d98d3d4ef36579eb021b1521630e78808ba15dbff74da6af7397c627421decc96380ea3c6f1e64b1cdc8add6d00be9229ac8c29c5cbc38041de4c98ee375fee8e44f85da5e38ea955588c1378dc2256891b69ce6c2cf43c7fe0c1740091066df00d608373345fc2b0") close(0xffffffffffffffff) [ 1012.972246] 00000000ea9451e7: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1012.981129] 000000002c759bab: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1012.990015] 000000004dee7363: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1012.998905] 000000008b349f9c: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1013.007792] 00000000c9fc0b77: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1013.016676] 00000000c7cd0e85: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:11 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x4030582a, 0x0) 08:57:11 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x500], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1013.026519] XFS (loop6): SB validate failed with error -117. 08:57:11 executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) r1 = syz_open_dev$adsp(&(0x7f00000000c0)='/dev/adsp#\x00', 0x8, 0x0) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e23, 0x8, @ipv4={[], [0xff, 0xff], @local={0xac, 0x14, 0x14, 0xaa}}, 0xfffffffffffff3e0}}, 0xbc78, 0x5, 0x2, 0x6, 0x50}, 0x98) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x3, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], 'syz_tun\x00'}}, 0x1e) syz_emit_ethernet(0x14, &(0x7f0000000080)={@broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty, [], {@generic={0x8864, "42a703000000"}}}, &(0x7f0000000000)={0x0, 0x4, [0x0, 0xac5]}) 08:57:11 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x74}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:11 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="58465342000010000000fa030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) [ 1013.742238] XFS (loop6): SB sanity check failed [ 1013.747064] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1013.758214] XFS (loop6): Unmount and run xfs_repair [ 1013.763277] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1013.770072] 00000000aa4c9174: 58 46 53 42 00 00 10 00 00 00 fa 03 00 00 10 00 XFSB............ [ 1013.778967] 000000000a1269a5: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1013.787859] 00000000f52ff510: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1013.796750] 00000000a48bb07f: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1013.805613] 000000002bdac2b0: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1013.814486] 00000000da5bb339: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1013.823344] 00000000304cb4d5: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1013.832217] 00000000d0271174: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1013.841125] XFS (loop6): SB validate failed with error -117. 08:57:12 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x76, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:12 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x5451, 0x0) 08:57:12 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x1100}, 0x0) 08:57:12 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x700], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x4}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:12 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000078030000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:12 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x1) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") socketpair(0x0, 0x0, 0x0, &(0x7f0000000140)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)={0x12, 0xc, 0x4, 0x962}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r1, &(0x7f0000000000), &(0x7f0000000140)}, 0x20) 08:57:12 executing program 0: r0 = memfd_create(&(0x7f0000000140)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x2) fallocate(r0, 0xfffffffffffffffe, 0x20, 0x2) rt_sigprocmask(0x1, &(0x7f0000000080)={0xffffffffffffffbe}, 0x0, 0xfffffffffffffef7) epoll_create1(0x80000) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f00000000c0)={0xbea, 0xd0, 0x100}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000), &(0x7f0000000040)=0x4) 08:57:12 executing program 0: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100, 0x0, 0x0, 0x0, 0x0, 0x2a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0xa00, 0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0xc05c5340, &(0x7f0000000180)={0xfffffffffffffff9, 0x8001, 0xffffffffffffff92, {r1, r2+10000000}, 0x3ff, 0xfe}) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000000)='configfs\x00', 0x0, &(0x7f0000000040)) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) close(r3) 08:57:12 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x2}, 0x0) 08:57:12 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x80086603, 0x0) 08:57:12 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x9], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x700000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:12 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0x300000000000000}, 0x0) [ 1014.149454] XFS (loop6): SB sanity check failed [ 1014.154303] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1014.165486] XFS (loop6): Unmount and run xfs_repair [ 1014.170564] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1014.177307] 000000004b4262a1: 58 46 53 42 00 00 10 00 00 00 78 03 00 00 10 00 XFSB......x..... [ 1014.186200] 000000007c25bda9: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:12 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xe], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1014.195108] 00000000b6e88b1f: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1014.204015] 0000000000cc3f6a: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1014.212959] 00000000742e1ac3: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1014.221877] 0000000013f53688: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1014.230784] 000000004a112e92: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1014.239696] 000000000cf2172a: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:12 executing program 0: munlockall() pselect6(0x22, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)={0xffffffff}, &(0x7f0000000140), &(0x7f00000001c0)={&(0x7f0000000180), 0x8}) syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x40000) [ 1014.250246] XFS (loop6): SB validate failed with error -117. 08:57:13 executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000080)="0f", 0x1, 0x0, &(0x7f0000000040)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff, 0xaa}}, 0x10) mkdir(&(0x7f0000c92000)='./file0\x00', 0x0) r1 = creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r2 = open$dir(&(0x7f0000000180)='./file0/bus\x00', 0x0, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f00007fbf5f)="b7", 0x1}], 0x1) r3 = dup(r2) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x2011, r3, 0x0) sendto$inet(r0, &(0x7f0000029000)="c6", 0x1, 0x0, &(0x7f0000007ff0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff, 0xbb}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x1e, &(0x7f0000018000)={0x0, @in6={{0xa}}}, &(0x7f0000000000)=0x8c) 08:57:13 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200), 0x0, 0xa00000000000000}, 0x0) 08:57:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x500000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:13 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x0) 08:57:13 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xffffff87], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:13 executing program 3: r0 = socket$inet6(0xa, 0x1000000000042, 0x31) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000040)={0x0, 0x1, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff4c67, 0x1f}) r2 = syz_open_pts(r1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) wait4(r3, &(0x7f0000000100), 0x20000000, &(0x7f0000000180)) read(r2, &(0x7f0000000280)=""/1, 0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000fd0ffc)) ioctl$TCSETAF(r2, 0x5457, &(0x7f0000000000)) r4 = gettid() timer_create(0x0, &(0x7f0000066000)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x9}}, &(0x7f0000040000)) tkill(r4, 0x1000000000016) 08:57:13 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = socket$inet6(0xa, 0x1, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f00000000c0)) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000080)="5afbf1a90996b508525f940beed23043", 0x10) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net\x00') setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x73, 0x80, 0xa11e, 0x5, 0xffffffffffffffc0, 0x3, 0x2, 0x7ff, 0x9, 0x5, 0xffffffffffffffe4}, 0xb) ioctl$TCSBRK(r2, 0x5409, 0x100000000) close(r1) 08:57:13 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000000262100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:13 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x4020940d, 0x0) 08:57:13 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x400000000000000], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0x4800000000000000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:13 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200)}, 0x0) 08:57:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00009e3ff6)='/dev/ptmx\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x40, 0x20) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x840, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_loose='cache=loose', 0x2c}]}}) ioctl$TCFLSH(r0, 0x5413, 0x701000) [ 1015.293190] XFS (loop6): SB sanity check failed [ 1015.298025] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1015.309250] XFS (loop6): Unmount and run xfs_repair [ 1015.314316] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1015.321051] 000000009d37cd9d: 58 46 53 42 00 00 10 00 00 00 00 00 02 62 10 00 XFSB.........b.. [ 1015.329941] 00000000edf60014: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 08:57:13 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc0c0583b, 0x0) 08:57:13 executing program 0: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mkdir(&(0x7f000000dff6)='./control\x00', 0x0) r1 = open(&(0x7f0000039000)='./control\x00', 0x0, 0x0) mkdirat(r1, &(0x7f000002cff6)='./control\x00', 0x0) mkdirat(r1, &(0x7f0000000000)='./file0\x00', 0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x43}) r2 = openat(r1, &(0x7f0000025000)='./file0\x00', 0x0, 0x0) symlinkat(&(0x7f0000023ff8)='./control\x00', r2, &(0x7f0000012ff6)='./control\x00') renameat2(r2, &(0x7f0000bee000)='./control\x00', r1, &(0x7f000003a000)='./control\x00', 0x2) lgetxattr(&(0x7f0000000080)='./control\x00', &(0x7f00000000c0)=@random={'btrfs.', ':keyring.]\x00'}, &(0x7f00000002c0)=""/4096, 0x1000) 08:57:13 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0x8dffffff], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) [ 1015.338815] 00000000ce7a175e: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1015.347698] 0000000065c0dfb7: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1015.356579] 0000000095a971ee: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1015.365469] 000000009151a91f: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1015.374350] 00000000dd9a0de9: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1015.383268] 000000002a2bb230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1015.392187] XFS (loop6): SB validate failed with error -117. 08:57:14 executing program 2: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @broadcast=[0xff, 0xff, 0xff, 0xff, 0xff, 0xff], [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0xffffff87, 0x0, @local={0xfe, 0x80, [], 0xaa}, @local={0xfe, 0x80, [0x0, 0xa00], 0xaa}, {[], @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000002c0)) 08:57:14 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f000000bfc8)={&(0x7f0000000000)=@nl=@proc={0x10, 0x0, 0x0, 0xfffff000}, 0x80, &(0x7f0000002000)=[{&(0x7f0000001000)="5500000018007fafb72d1cb2a4a280930206020200a84309c026236925000b0000c90200f0ff56039848a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220000bf0cec6bab91d4", 0x55}], 0x1, &(0x7f0000004000)}, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 08:57:14 executing program 1: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}, 0x6}, 0x80, &(0x7f0000000180), 0x0, &(0x7f0000000140)}, 0x0) r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f0000000400)={&(0x7f0000000040)=@un=@abs, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000001700)}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000640)={&(0x7f0000001b00)=@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80}}, 0x80, &(0x7f0000000540)=[{&(0x7f0000000380)="c9", 0x1}], 0x1, &(0x7f0000000200)}, 0x0) 08:57:14 executing program 6: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f00000002c0)="025cc83d6d345f8f762070") syz_mount_image$xfs(&(0x7f0000000040)='xfs\x00', &(0x7f0000000300)='./file0\x00', 0xfffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="5846534200001000000000740000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c034a402", 0x67}], 0x0, &(0x7f0000000180)=ANY=[]) 08:57:14 executing program 7: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2ce15b26e518a4cb3a9cd12dcea440d899c22c652b3a471b4a7db7f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c3408000000000000000000000000000000", 0x2761, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0xc0045877, 0x0) [ 1016.382045] XFS (loop6): SB sanity check failed [ 1016.386891] XFS (loop6): Metadata corruption detected at xfs_sb_read_verify+0x3df/0x4e0, xfs_sb block 0xffffffffffffffff [ 1016.398039] XFS (loop6): Unmount and run xfs_repair [ 1016.403083] XFS (loop6): First 128 bytes of corrupted metadata buffer: [ 1016.409784] 00000000b30d7ded: 58 46 53 42 00 00 10 00 00 00 00 74 00 00 10 00 XFSB.......t.... [ 1016.418743] 000000005ff2db5f: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1016.427599] 00000000472c48c0: 98 4f 0b 50 42 b6 4b 06 bc 86 cb a3 e6 cc 3f 80 .O.PB.K.......?. [ 1016.436448] 00000000acb1e819: 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 80 .......@........ [ 1016.445350] 0000000059d17629: 00 00 00 00 00 00 00 81 00 00 00 00 00 00 00 82 ................ [ 1016.454213] 00000000d3a22622: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 1016.463067] 000000003d39cbfa: 00 00 06 c0 34 a4 02 00 00 00 00 00 00 00 00 00 ....4........... [ 1016.471941] 0000000052cb304d: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 1016.480895] XFS (loop6): SB validate failed with error -117. 08:57:16 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008912, &(0x7f00000000c0)="295ee1311f16f477671070") recvmmsg(r0, &(0x7f0000000740), 0x330, 0x0, &(0x7f0000000700)) rt_sigprocmask(0x3, &(0x7f0000000080)={0x146}, &(0x7f00000005c0), 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x1, 0x2c, &(0x7f00000009c0)=ANY=[@ANYBLOB="9c60b8ae3a76a11dd11ea2bc3394e82331cc871b5f030004edffffffffffff046f474f0400000000fa71f3319e13bfcdd658ae0347cb0d899781c22888a20e2d09000000000000007bfd276e060633b8975c44697c28eef3322f7afe8043d6afacdff435c9dffb886c4ab97303f97540921f8bdda9e028c070488d7cda13d7dc3d9d3d1a0000a7d3931eab99e6836f3520fbb8b515e4903462acd83e1a5638bd7161172acb536ab73e3bdee08a19bfd4607267629c1385d580d632ef9efd4502d063e01cd7dd44764dfb04e7b7e09b70de3ebf98d5a0b74f68b2a5097af70a176c4702524924aebc1a270bc7f14c556f1bc2536867991f7c2df6c917790e6f6d8a08dfa1bdea2317e485f85e9896a086cc48b53473a460b2e98891f07726c8f1874e9eefe9cd0009220cd6306a7908cc1a30d613c264ec8ce787277893c13c454ac67acc512dd71e6355b90f42cd5945c189dbbf0e62d3e7ec02599a225730a59df64b"], &(0x7f0000e6bffc)='GPL\x00', 0x0, 0x99, &(0x7f000000d000)=""/153}, 0x48) r2 = socket(0x0, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000540)=@file={0x0, './file0\x00'}, 0x6e) mkdir(&(0x7f00000002c0)='./file0\x00', 0x20) r3 = add_key(&(0x7f0000000140)='cifs.spnego\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000940)="f2ad594f5334f2d4423c1c2a91f4cb19d178b124a8f5eb0bee785172b0a14ff3d9bcdac1e17c7b06d24befc49a199d8192d4b5199be81c369fe175aa554a957a837037ea4c51e5f490b69dd015664fed25a27e9e0ec9a0e2100443570bc94f6c83dc544edafcca4941ff8ed5a58fb1b27545e961d23979", 0x77, 0xfffffffffffffff8) request_key(&(0x7f0000000200)='trusted\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000480)='/dev/qat_adf_ctl\x00', 0xffffffffffffffff) keyctl$negate(0xd, r3, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000180)) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f0000000780)={0xd11f, 0xe7}, 0x13d) r4 = socket(0xa, 0x1, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x73, &(0x7f0000000240)={0x0, 0xdd0d, 0x20, 0x5, 0x9}, &(0x7f0000000280)=0x18) setsockopt$inet_sctp6_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000300)=@int=0x2, 0x4) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000006c0)=0x0) perf_event_open(&(0x7f0000000640)={0x4, 0x70, 0x7f, 0x9, 0x81, 0xfffffffffffffff9, 0x0, 0xe4a2, 0x200, 0x7, 0x2, 0x0, 0x2, 0x5, 0x400, 0x6, 0x5, 0x2, 0x8000, 0x3a52, 0x0, 0x5, 0x10001, 0x1511, 0x8, 0x3, 0x10000, 0x1ecd, 0x5, 0x0, 0x6, 0x6, 0x1, 0x3, 0x8, 0x1, 0xffff, 0x4, 0x0, 0x8ad8, 0x0, @perf_bp={&(0x7f0000000600), 0x4}, 0xa2, 0x8001, 0x10000, 0x4, 0x3, 0xcc, 0x8}, r5, 0x6, 0xffffffffffffffff, 0x1) r6 = socket$inet6(0xa, 0x202000000802, 0x0) r7 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x10002, 0x0) ioctl$TUNSETLINK(r7, 0x400454cd, 0x207) getsockopt$IP_VS_SO_GET_SERVICES(r2, 0x0, 0x482, &(0x7f0000000740)=""/39, &(0x7f0000000500)=0xfffffffffffffdfa) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000100)=0x5, 0x4) ioctl$TIOCPKT(r7, 0x5420, &(0x7f0000000000)=0x104) fcntl$setlease(r1, 0x400, 0x200000000003) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f00000003c0)={@remote={0xfe, 0x80, [], 0xbb}, 0x0, 0x0, 0x3, 0x80000000000041}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@loopback={0x0, 0x1}, 0x1000000800, 0x2}, 0x20) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000000840)=ANY=[]) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip6_flowlabel\x00') sendfile(r6, r8, &(0x7f0000000340)=0x201, 0x7ffffffe) 08:57:16 executing program 3: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") r1 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x1f, 0x40) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000140)) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/ipc\x00') getsockopt$inet6_dccp_int(r0, 0x21, 0x1f, &(0x7f0000000080), &(0x7f00000000c0)=0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000180)=ANY=[@ANYRES32=0x0, @ANYBLOB="02000200000009ba"], &(0x7f00000001c0)=0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000200)={0x0, 0x2, 0x20, 0x7, r2}, &(0x7f0000000240)=0x10) [ 1291.232156] INFO: task rs:main Q:Reg:4394 blocked for more than 140 seconds. [ 1291.239440] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1291.245093] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1291.253067] rs:main Q:Reg D22448 4394 1 0x00000000 [ 1291.258735] Call Trace: [ 1291.261341] __schedule+0x87c/0x1ed0 [ 1291.265094] ? __sched_text_start+0x8/0x8 [ 1291.269265] ? lock_acquire+0x1e4/0x540 [ 1291.273257] ? __fdget_pos+0x1bb/0x200 [ 1291.277181] ? lock_release+0xa30/0xa30 [ 1291.281167] ? check_same_owner+0x340/0x340 [ 1291.285514] ? rcu_note_context_switch+0x730/0x730 [ 1291.290461] schedule+0xfb/0x450 [ 1291.293849] ? lock_downgrade+0x8f0/0x8f0 [ 1291.298015] ? __schedule+0x1ed0/0x1ed0 [ 1291.302014] ? kasan_check_read+0x11/0x20 [ 1291.306208] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1291.310632] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1291.315224] ? kasan_check_write+0x14/0x20 [ 1291.319484] ? do_raw_spin_lock+0xc1/0x200 [ 1291.323821] rwsem_down_read_failed+0x362/0x600 [ 1291.328506] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1291.334051] ? lock_acquire+0x1e4/0x540 [ 1291.338026] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1291.342248] ? lock_downgrade+0x8f0/0x8f0 [ 1291.346398] ? lock_release+0xa30/0xa30 [ 1291.350372] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1291.355908] ? rcuwait_wake_up+0x1cc/0x2f0 [ 1291.360147] call_rwsem_down_read_failed+0x18/0x30 [ 1291.365087] ? rcuwait_wake_up+0x186/0x2f0 [ 1291.369317] __percpu_down_read+0x1a0/0x290 [ 1291.373642] ? percpu_free_rwsem+0xa0/0xa0 [ 1291.377904] __sb_start_write+0x2d7/0x300 [ 1291.382062] vfs_write+0x42a/0x560 [ 1291.385614] ksys_write+0x101/0x260 [ 1291.389274] ? __ia32_sys_read+0xb0/0xb0 [ 1291.393335] __x64_sys_write+0x73/0xb0 [ 1291.397227] do_syscall_64+0x1b9/0x820 [ 1291.401105] ? syscall_slow_exit_work+0x500/0x500 [ 1291.405945] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1291.410864] ? syscall_return_slowpath+0x31d/0x5e0 [ 1291.415795] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1291.420876] ? perf_trace_sys_enter+0xb10/0xb10 [ 1291.425546] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1291.430386] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1291.435574] RIP: 0033:0x7fcb1aa7b19d [ 1291.439273] Code: Bad RIP value. [ 1291.442646] RSP: 002b:00007fcb1901c000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1291.450351] RAX: ffffffffffffffda RBX: 000000000000014d RCX: 00007fcb1aa7b19d [ 1291.457638] RDX: 000000000000014d RSI: 0000000001369a90 RDI: 0000000000000005 [ 1291.465033] RBP: 0000000001369a90 R08: 0000000001369b84 R09: 00007fcb1a3f89d7 [ 1291.472884] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 1291.480149] R13: 00007fcb1901c480 R14: 0000000000000003 R15: 0000000001369890 [ 1291.487441] percpu_rw_semaphore(00000000d9df82f9) [ 1291.492284] ->rw_sem.count=0xfffffffe00000001 [ 1291.496972] ->rss.gp_state=2 [ 1291.500156] ->rss.gp_count=1 [ 1291.503340] ->rss.cb_state=0 [ 1291.506529] ->rss.gp_type=1 [ 1291.509634] ->readers_block=1 [ 1291.512905] ->read_count=0 [ 1291.515923] ->list_empty(rw_sem.wait_list)=0 [ 1291.520496] ->writer.task= (null) [ 1291.524920] INFO: task syz-fuzzer:4512 blocked for more than 140 seconds. [ 1291.531843] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1291.537455] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1291.545406] syz-fuzzer D19984 4512 4508 0x00000000 [ 1291.551032] Call Trace: [ 1291.553615] __schedule+0x87c/0x1ed0 [ 1291.557340] ? __sched_text_start+0x8/0x8 [ 1291.561484] ? trace_hardirqs_on+0x10/0x10 [ 1291.565715] ? select_task_rq_fair+0x73b/0x32a0 [ 1291.570374] ? lock_downgrade+0x8f0/0x8f0 [ 1291.574521] ? account_entity_enqueue+0x3ec/0x700 [ 1291.579357] ? __enqueue_entity+0x10d/0x1f0 [ 1291.583679] schedule+0xfb/0x450 [ 1291.587041] ? lock_downgrade+0x8f0/0x8f0 [ 1291.591204] ? __schedule+0x1ed0/0x1ed0 [ 1291.595177] ? kasan_check_read+0x11/0x20 [ 1291.599326] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1291.603725] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1291.608303] ? kasan_check_write+0x14/0x20 [ 1291.612537] ? do_raw_spin_lock+0xc1/0x200 [ 1291.616772] rwsem_down_read_failed+0x362/0x600 [ 1291.621450] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1291.627017] ? lock_acquire+0x1e4/0x540 [ 1291.631001] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1291.635243] ? lock_downgrade+0x8f0/0x8f0 [ 1291.639385] ? lock_release+0xa30/0xa30 [ 1291.643367] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1291.648899] ? trace_find_filtered_pid.part.61+0x50/0x50 [ 1291.654367] call_rwsem_down_read_failed+0x18/0x30 [ 1291.659299] ? rcuwait_wake_up+0x186/0x2f0 [ 1291.663533] __percpu_down_read+0x1a0/0x290 [ 1291.667846] ? percpu_free_rwsem+0xa0/0xa0 [ 1291.672086] __sb_start_write+0x2d7/0x300 [ 1291.676227] ext4_page_mkwrite+0x1d0/0x1430 [ 1291.680567] ? ext4_change_inode_journal_flag+0x3e0/0x3e0 [ 1291.686116] ? migrate_swap_stop+0x850/0x850 [ 1291.690521] ? lock_release+0xa30/0xa30 [ 1291.694496] ? do_wp_page+0xf54/0x1670 [ 1291.698381] do_page_mkwrite+0x14e/0x520 [ 1291.702437] ? print_bad_pte+0x5f0/0x5f0 [ 1291.706502] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1291.710898] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1291.715488] ? __pte_alloc_kernel+0x2e0/0x2e0 [ 1291.719991] do_wp_page+0xf5c/0x1670 [ 1291.723709] ? finish_mkwrite_fault+0x610/0x610 [ 1291.728368] ? trace_hardirqs_on+0x10/0x10 [ 1291.732600] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1291.737606] ? lock_acquire+0x1e4/0x540 [ 1291.741576] ? __handle_mm_fault+0x1cff/0x44a0 [ 1291.746179] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1291.751731] ? lock_release+0xa30/0xa30 [ 1291.755707] ? generic_update_time+0x26a/0x450 [ 1291.760286] ? may_umount_tree+0x220/0x220 [ 1291.764521] ? pmd_val+0x88/0x100 [ 1291.767976] ? add_mm_counter_fast+0xd0/0xd0 [ 1291.772381] ? kasan_check_write+0x14/0x20 [ 1291.776614] ? do_raw_spin_lock+0xc1/0x200 [ 1291.780838] __handle_mm_fault+0x2abf/0x44a0 [ 1291.785253] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 1291.790090] ? lock_acquire+0x1e4/0x540 [ 1291.794071] ? handle_mm_fault+0x417/0xc80 [ 1291.798306] ? lock_downgrade+0x8f0/0x8f0 [ 1291.802450] ? lock_release+0xa30/0xa30 [ 1291.806414] ? lock_release+0xa30/0xa30 [ 1291.810389] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1291.815925] ? mem_cgroup_from_task+0xcb/0x1f0 [ 1291.820511] ? mem_cgroup_css_online+0x3c0/0x3c0 [ 1291.825277] handle_mm_fault+0x53e/0xc80 [ 1291.829338] ? __handle_mm_fault+0x44a0/0x44a0 [ 1291.833922] ? find_vma+0x34/0x190 [ 1291.837480] __do_page_fault+0x620/0xe50 [ 1291.841547] ? mm_fault_error+0x380/0x380 [ 1291.845717] ? __ia32_sys_read+0xb0/0xb0 [ 1291.849786] do_page_fault+0xf6/0x8c0 [ 1291.853598] ? vmalloc_sync_all+0x30/0x30 [ 1291.857738] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1291.863279] ? do_syscall_64+0x497/0x820 [ 1291.867342] ? syscall_slow_exit_work+0x500/0x500 [ 1291.872183] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1291.877106] ? syscall_return_slowpath+0x31d/0x5e0 [ 1291.882040] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1291.887047] ? page_fault+0x8/0x30 [ 1291.890581] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1291.895412] ? page_fault+0x8/0x30 [ 1291.898947] page_fault+0x1e/0x30 [ 1291.902393] RIP: 0033:0x70b5e1 [ 1291.905586] Code: Bad RIP value. [ 1291.908971] RSP: 002b:000000c42756b538 EFLAGS: 00010212 [ 1291.914335] RAX: 000000c42756b878 RBX: 000000c42756b880 RCX: 00007f23cd179000 [ 1291.921602] RDX: 0000000000000745 RSI: 0000000000000000 RDI: 0000000000000360 [ 1291.928877] RBP: 000000c42756b548 R08: 0000000000000000 R09: 0000000000000000 [ 1291.936138] R10: 000000000095bb32 R11: 0000000000000004 R12: 0000000000000000 [ 1291.943500] R13: 0000000000000020 R14: 0000000000000013 R15: 0000000000000002 [ 1291.950765] percpu_rw_semaphore(00000000082ac9da) [ 1291.955599] ->rw_sem.count=0xfffffffe00000001 [ 1291.960254] ->rss.gp_state=2 [ 1291.963438] ->rss.gp_count=1 [ 1291.966611] ->rss.cb_state=0 [ 1291.969792] ->rss.gp_type=1 [ 1291.972903] ->readers_block=1 [ 1291.976185] ->read_count=0 [ 1291.979186] ->list_empty(rw_sem.wait_list)=0 [ 1291.983761] ->writer.task= (null) [ 1291.988161] INFO: task syz-fuzzer:9955 blocked for more than 140 seconds. [ 1291.995087] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1292.000695] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1292.008653] syz-fuzzer D20928 9955 4508 0x00000000 [ 1292.014285] Call Trace: [ 1292.016899] __schedule+0x87c/0x1ed0 [ 1292.020630] ? __sched_text_start+0x8/0x8 [ 1292.024780] ? trace_hardirqs_on+0x10/0x10 [ 1292.029016] ? __enqueue_entity+0x10d/0x1f0 [ 1292.033355] ? enqueue_entity+0x34b/0x2130 [ 1292.037598] ? put_prev_task_fair+0x80/0x80 [ 1292.041922] schedule+0xfb/0x450 [ 1292.045299] ? lock_downgrade+0x8f0/0x8f0 [ 1292.049451] ? __schedule+0x1ed0/0x1ed0 [ 1292.053428] ? kasan_check_read+0x11/0x20 [ 1292.057577] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1292.061983] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1292.066563] ? kasan_check_write+0x14/0x20 [ 1292.070792] ? do_raw_spin_lock+0xc1/0x200 [ 1292.075027] rwsem_down_read_failed+0x362/0x600 [ 1292.079704] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1292.085239] ? lock_acquire+0x1e4/0x540 [ 1292.089219] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1292.093444] ? lock_downgrade+0x8f0/0x8f0 [ 1292.097591] ? lock_release+0xa30/0xa30 [ 1292.101572] ? tracing_record_taskinfo+0x73/0x220 [ 1292.106425] ? try_to_wake_up+0x10a/0x12b0 [ 1292.110651] ? lock_downgrade+0x8f0/0x8f0 [ 1292.114800] call_rwsem_down_read_failed+0x18/0x30 [ 1292.119726] ? rcuwait_wake_up+0x186/0x2f0 [ 1292.123967] __percpu_down_read+0x1a0/0x290 [ 1292.128286] ? percpu_free_rwsem+0xa0/0xa0 [ 1292.132522] __sb_start_write+0x2d7/0x300 [ 1292.136670] ext4_page_mkwrite+0x1d0/0x1430 [ 1292.140994] ? ext4_change_inode_journal_flag+0x3e0/0x3e0 [ 1292.146539] ? lock_acquire+0x1e4/0x540 [ 1292.150511] ? mem_cgroup_id_get_many+0x160/0x160 [ 1292.155351] ? do_wp_page+0xf54/0x1670 [ 1292.159245] do_page_mkwrite+0x14e/0x520 [ 1292.163303] ? print_bad_pte+0x5f0/0x5f0 [ 1292.167359] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1292.171772] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1292.176366] ? __pte_alloc_kernel+0x2e0/0x2e0 [ 1292.180860] do_wp_page+0xf5c/0x1670 [ 1292.184586] ? finish_mkwrite_fault+0x610/0x610 [ 1292.189249] ? trace_hardirqs_on+0x10/0x10 [ 1292.193482] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1292.198500] ? lock_acquire+0x1e4/0x540 [ 1292.202472] ? __handle_mm_fault+0x1cff/0x44a0 [ 1292.207046] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1292.211448] ? lock_release+0xa30/0xa30 [ 1292.215414] ? pmd_val+0x88/0x100 [ 1292.218896] ? add_mm_counter_fast+0xd0/0xd0 [ 1292.223344] ? kasan_check_write+0x14/0x20 [ 1292.227592] ? do_raw_spin_lock+0xc1/0x200 [ 1292.231819] __handle_mm_fault+0x2abf/0x44a0 [ 1292.236267] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 1292.241260] ? lock_acquire+0x1e4/0x540 [ 1292.245248] ? handle_mm_fault+0x417/0xc80 [ 1292.249478] ? lock_downgrade+0x8f0/0x8f0 [ 1292.253620] ? lock_release+0xa30/0xa30 [ 1292.257592] ? lock_release+0xa30/0xa30 [ 1292.261845] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1292.267384] ? mem_cgroup_from_task+0xcb/0x1f0 [ 1292.271963] ? mem_cgroup_css_online+0x3c0/0x3c0 [ 1292.276725] handle_mm_fault+0x53e/0xc80 [ 1292.280786] ? __handle_mm_fault+0x44a0/0x44a0 [ 1292.285363] ? find_vma+0x34/0x190 [ 1292.288900] __do_page_fault+0x620/0xe50 [ 1292.292955] ? mm_fault_error+0x380/0x380 [ 1292.297112] ? __ia32_sys_read+0xb0/0xb0 [ 1292.301173] do_page_fault+0xf6/0x8c0 [ 1292.304970] ? vmalloc_sync_all+0x30/0x30 [ 1292.309109] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1292.314659] ? do_syscall_64+0x497/0x820 [ 1292.318719] ? syscall_slow_exit_work+0x500/0x500 [ 1292.323567] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1292.328510] ? syscall_return_slowpath+0x31d/0x5e0 [ 1292.333438] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1292.338457] ? page_fault+0x8/0x30 [ 1292.342256] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1292.347100] ? page_fault+0x8/0x30 [ 1292.350634] page_fault+0x1e/0x30 [ 1292.354077] RIP: 0033:0x70b5e1 [ 1292.357280] Code: Bad RIP value. [ 1292.360673] RSP: 002b:000000c42b017538 EFLAGS: 00010212 [ 1292.366047] RAX: 000000c42b017878 RBX: 000000c42b017880 RCX: 00007f23c9b79000 [ 1292.373311] RDX: 0000000000000745 RSI: 0000000000000000 RDI: 0000000000000020 [ 1292.380578] RBP: 000000c42b017548 R08: 0000000000000000 R09: 0000000000000000 [ 1292.387834] R10: 000000000095bb32 R11: 0000000000000004 R12: 0000000000000000 [ 1292.395099] R13: 0000000000000020 R14: 0000000000000013 R15: 000000c42b0179f8 [ 1292.402362] percpu_rw_semaphore(00000000082ac9da) [ 1292.407206] ->rw_sem.count=0xfffffffe00000001 [ 1292.411863] ->rss.gp_state=2 [ 1292.415045] ->rss.gp_count=1 [ 1292.418240] ->rss.cb_state=0 [ 1292.421422] ->rss.gp_type=1 [ 1292.424513] ->readers_block=1 [ 1292.427786] ->read_count=0 [ 1292.430789] ->list_empty(rw_sem.wait_list)=0 [ 1292.435374] ->writer.task= (null) [ 1292.439787] INFO: task syz-executor1:4538 blocked for more than 140 seconds. [ 1292.446969] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1292.452577] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1292.460549] syz-executor1 D21232 4538 4530 0x00000000 [ 1292.466180] Call Trace: [ 1292.468778] __schedule+0x87c/0x1ed0 [ 1292.472494] ? kasan_check_read+0x11/0x20 [ 1292.476641] ? __sched_text_start+0x8/0x8 [ 1292.480782] ? is_bpf_text_address+0xd7/0x170 [ 1292.485278] ? path_init+0x2340/0x2340 [ 1292.489159] ? path_parentat.isra.43+0x20/0x160 [ 1292.493836] ? trace_hardirqs_on+0x10/0x10 [ 1292.498071] schedule+0xfb/0x450 [ 1292.501434] ? lock_downgrade+0x8f0/0x8f0 [ 1292.505586] ? __schedule+0x1ed0/0x1ed0 [ 1292.509570] ? kasan_check_read+0x11/0x20 [ 1292.513716] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1292.518133] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1292.522710] ? kasan_check_write+0x14/0x20 [ 1292.526941] ? do_raw_spin_lock+0xc1/0x200 [ 1292.531179] rwsem_down_read_failed+0x362/0x600 [ 1292.535867] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1292.541396] ? lock_acquire+0x1e4/0x540 [ 1292.545367] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1292.549591] ? lock_downgrade+0x8f0/0x8f0 [ 1292.553738] ? lock_release+0xa30/0xa30 [ 1292.557703] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1292.562719] ? mntput+0x74/0xa0 [ 1292.565995] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1292.571559] ? terminate_walk+0x20a/0x5e0 [ 1292.575702] ? rcuwait_wake_up+0x1cc/0x2f0 [ 1292.579936] call_rwsem_down_read_failed+0x18/0x30 [ 1292.584862] ? rcuwait_wake_up+0x186/0x2f0 [ 1292.589096] __percpu_down_read+0x1a0/0x290 [ 1292.593421] ? percpu_free_rwsem+0xa0/0xa0 [ 1292.597673] __sb_start_write+0x2d7/0x300 [ 1292.601818] mnt_want_write+0x3f/0xc0 [ 1292.605618] do_unlinkat+0x2b7/0xa30 [ 1292.609331] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1292.613737] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1292.618318] ? __ia32_sys_rmdir+0x40/0x40 [ 1292.622465] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1292.628047] ? strncpy_from_user+0x3be/0x510 [ 1292.632452] ? mpi_free.cold.1+0x19/0x19 [ 1292.636520] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1292.642059] ? getname_flags+0x26e/0x5a0 [ 1292.646121] __x64_sys_unlink+0x42/0x50 [ 1292.650101] do_syscall_64+0x1b9/0x820 [ 1292.653985] ? syscall_slow_exit_work+0x500/0x500 [ 1292.658825] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1292.663769] ? syscall_return_slowpath+0x31d/0x5e0 [ 1292.668690] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1292.673707] ? perf_trace_sys_enter+0xb10/0xb10 [ 1292.678392] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1292.683240] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1292.688428] RIP: 0033:0x455b77 [ 1292.691609] Code: Bad RIP value. [ 1292.694980] RSP: 002b:00007ffd95b6fc48 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 1292.702687] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000455b77 [ 1292.709948] RDX: 00007ffd95b6fc50 RSI: 00007ffd95b6fce0 RDI: 00007ffd95b6fce0 [ 1292.717214] RBP: 00007ffd95b719f0 R08: 0000000000000000 R09: 0000000000000011 [ 1292.724489] R10: 000000000000000a R11: 0000000000000206 R12: 0000000002846940 [ 1292.731765] R13: 0000000000000000 R14: 00007ffd95b713c0 R15: 0000000000702140 [ 1292.739041] percpu_rw_semaphore(00000000d9df82f9) [ 1292.743874] ->rw_sem.count=0xfffffffe00000001 [ 1292.748529] ->rss.gp_state=2 [ 1292.751713] ->rss.gp_count=1 [ 1292.754895] ->rss.cb_state=0 [ 1292.758078] ->rss.gp_type=1 [ 1292.761166] ->readers_block=1 [ 1292.764440] ->read_count=0 [ 1292.767441] ->list_empty(rw_sem.wait_list)=0 [ 1292.772115] ->writer.task= (null) [ 1292.776523] INFO: task syz-executor4:4541 blocked for more than 140 seconds. [ 1292.783709] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1292.789324] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1292.797287] syz-executor4 D21232 4541 4532 0x00000000 [ 1292.802915] Call Trace: [ 1292.805502] __schedule+0x87c/0x1ed0 [ 1292.809217] ? __sched_text_start+0x8/0x8 [ 1292.813365] ? trace_hardirqs_on+0x10/0x10 [ 1292.817596] ? finish_task_switch+0x1d3/0x870 [ 1292.822084] ? finish_task_switch+0x18a/0x870 [ 1292.826584] ? trace_find_filtered_pid.part.61+0x50/0x50 [ 1292.832034] ? path_init+0x2340/0x2340 [ 1292.835920] ? path_parentat.isra.43+0x20/0x160 [ 1292.840595] ? lock_downgrade+0x8f0/0x8f0 [ 1292.844756] schedule+0xfb/0x450 [ 1292.848117] ? lock_downgrade+0x8f0/0x8f0 [ 1292.852264] ? __schedule+0x1ed0/0x1ed0 [ 1292.856233] ? kasan_check_read+0x11/0x20 [ 1292.860392] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1292.864790] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1292.869379] ? kasan_check_write+0x14/0x20 [ 1292.873601] ? do_raw_spin_lock+0xc1/0x200 [ 1292.877831] rwsem_down_read_failed+0x362/0x600 [ 1292.882493] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1292.888031] ? lock_acquire+0x1e4/0x540 [ 1292.892174] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1292.896403] ? lock_downgrade+0x8f0/0x8f0 [ 1292.900552] ? lock_release+0xa30/0xa30 [ 1292.904533] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1292.909541] ? mntput+0x74/0xa0 [ 1292.912817] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1292.918350] ? terminate_walk+0x20a/0x5e0 [ 1292.922505] ? rcuwait_wake_up+0x1cc/0x2f0 [ 1292.926743] call_rwsem_down_read_failed+0x18/0x30 [ 1292.931681] ? rcuwait_wake_up+0x186/0x2f0 [ 1292.935907] __percpu_down_read+0x1a0/0x290 [ 1292.940224] ? percpu_free_rwsem+0xa0/0xa0 [ 1292.944455] __sb_start_write+0x2d7/0x300 [ 1292.948600] mnt_want_write+0x3f/0xc0 [ 1292.952408] filename_create+0x13e/0x5b0 [ 1292.956476] ? kern_path_mountpoint+0x40/0x40 [ 1292.960975] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1292.966523] ? getname_flags+0x26e/0x5a0 [ 1292.970590] ? task_work_cancel+0x250/0x250 [ 1292.974909] do_mkdirat+0xda/0x310 [ 1292.978466] ? __ia32_sys_mknod+0xb0/0xb0 [ 1292.982625] ? syscall_slow_exit_work+0x500/0x500 [ 1292.987468] __x64_sys_mkdir+0x5c/0x80 [ 1292.991354] do_syscall_64+0x1b9/0x820 [ 1292.995264] ? syscall_slow_exit_work+0x500/0x500 [ 1293.000147] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1293.005097] ? syscall_return_slowpath+0x31d/0x5e0 [ 1293.010045] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1293.015084] ? perf_trace_sys_enter+0xb10/0xb10 [ 1293.019779] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1293.024643] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1293.029835] RIP: 0033:0x455267 [ 1293.033019] Code: Bad RIP value. [ 1293.036396] RSP: 002b:00007ffff45f15b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000053 [ 1293.044105] RAX: ffffffffffffffda RBX: 00007ffff45f15e0 RCX: 0000000000455267 [ 1293.051375] RDX: 00007ffff45f2296 RSI: 00000000000001ff RDI: 00007ffff45f2290 [ 1293.058655] RBP: 0000000000000013 R08: 0000000000000000 R09: 0000000000000006 [ 1293.065927] R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000000000 [ 1293.073195] R13: 0000000000001380 R14: 00007ffff45f1c60 R15: 00000000007034c0 [ 1293.080465] percpu_rw_semaphore(00000000d9df82f9) [ 1293.085301] ->rw_sem.count=0xfffffffe00000001 [ 1293.089962] ->rss.gp_state=2 [ 1293.093138] ->rss.gp_count=1 [ 1293.096348] ->rss.cb_state=0 [ 1293.099526] ->rss.gp_type=1 [ 1293.102617] ->readers_block=1 [ 1293.105879] ->read_count=0 [ 1293.108888] ->list_empty(rw_sem.wait_list)=0 [ 1293.113456] ->writer.task= (null) [ 1293.117887] INFO: task syz-executor2:1134 blocked for more than 140 seconds. [ 1293.125058] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1293.130681] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1293.138630] syz-executor2 D21232 1134 1133 0x00000000 [ 1293.144255] Call Trace: [ 1293.146840] __schedule+0x87c/0x1ed0 [ 1293.150567] ? kasan_check_read+0x11/0x20 [ 1293.154708] ? __sched_text_start+0x8/0x8 [ 1293.158858] ? is_bpf_text_address+0xd7/0x170 [ 1293.163345] ? path_init+0x2340/0x2340 [ 1293.167231] ? path_parentat.isra.43+0x20/0x160 [ 1293.171890] ? trace_hardirqs_on+0x10/0x10 [ 1293.176121] schedule+0xfb/0x450 [ 1293.179477] ? lock_downgrade+0x8f0/0x8f0 [ 1293.183633] ? __schedule+0x1ed0/0x1ed0 [ 1293.187600] ? kasan_check_read+0x11/0x20 [ 1293.191739] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1293.196134] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1293.200712] ? kasan_check_write+0x14/0x20 [ 1293.204932] ? do_raw_spin_lock+0xc1/0x200 [ 1293.209162] rwsem_down_read_failed+0x362/0x600 [ 1293.213816] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1293.219374] ? lock_acquire+0x1e4/0x540 [ 1293.223375] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1293.227621] ? lock_downgrade+0x8f0/0x8f0 [ 1293.231761] ? lock_release+0xa30/0xa30 [ 1293.235732] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1293.240745] ? mntput+0x74/0xa0 [ 1293.244022] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1293.249544] ? terminate_walk+0x20a/0x5e0 [ 1293.253686] ? rcuwait_wake_up+0x1cc/0x2f0 [ 1293.257912] call_rwsem_down_read_failed+0x18/0x30 [ 1293.262849] ? rcuwait_wake_up+0x186/0x2f0 [ 1293.267075] __percpu_down_read+0x1a0/0x290 [ 1293.271392] ? percpu_free_rwsem+0xa0/0xa0 [ 1293.275616] __sb_start_write+0x2d7/0x300 [ 1293.279766] mnt_want_write+0x3f/0xc0 [ 1293.283656] do_unlinkat+0x2b7/0xa30 [ 1293.287373] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1293.291768] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1293.296352] ? __ia32_sys_rmdir+0x40/0x40 [ 1293.300849] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1293.306407] ? strncpy_from_user+0x3be/0x510 [ 1293.310812] ? mpi_free.cold.1+0x19/0x19 [ 1293.314888] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1293.320762] ? getname_flags+0x26e/0x5a0 [ 1293.324846] __x64_sys_unlink+0x42/0x50 [ 1293.328844] do_syscall_64+0x1b9/0x820 [ 1293.332730] ? syscall_slow_exit_work+0x500/0x500 [ 1293.337569] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1293.342491] ? syscall_return_slowpath+0x31d/0x5e0 [ 1293.347416] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1293.352424] ? perf_trace_sys_enter+0xb10/0xb10 [ 1293.357081] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1293.361936] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1293.367127] RIP: 0033:0x455b77 [ 1293.370310] Code: Bad RIP value. [ 1293.373682] RSP: 002b:00007ffdac9cb1d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 1293.381391] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000455b77 [ 1293.388666] RDX: 00007ffdac9cb1e0 RSI: 00007ffdac9cb270 RDI: 00007ffdac9cb270 [ 1293.395935] RBP: 00007ffdac9ccf80 R08: 0000000000000000 R09: 0000000000000011 [ 1293.403209] R10: 000000000000000a R11: 0000000000000206 R12: 0000000000c57940 [ 1293.410492] R13: 0000000000000000 R14: 00007ffdac9cc950 R15: 0000000000702140 [ 1293.417769] percpu_rw_semaphore(00000000d9df82f9) [ 1293.422614] ->rw_sem.count=0xfffffffe00000001 [ 1293.427265] ->rss.gp_state=2 [ 1293.430452] ->rss.gp_count=1 [ 1293.433625] ->rss.cb_state=0 [ 1293.436830] ->rss.gp_type=1 [ 1293.439923] ->readers_block=1 [ 1293.443203] ->read_count=0 [ 1293.446228] ->list_empty(rw_sem.wait_list)=0 [ 1293.450809] ->writer.task= (null) [ 1293.455228] INFO: task syz-executor3:4018 blocked for more than 140 seconds. [ 1293.462413] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1293.468030] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1293.475997] syz-executor3 D21232 4018 4017 0x00000000 [ 1293.481629] Call Trace: [ 1293.484226] __schedule+0x87c/0x1ed0 [ 1293.487944] ? kasan_check_read+0x11/0x20 [ 1293.492099] ? __sched_text_start+0x8/0x8 [ 1293.496247] ? is_bpf_text_address+0xd7/0x170 [ 1293.500740] ? path_init+0x2340/0x2340 [ 1293.504626] ? path_parentat.isra.43+0x20/0x160 [ 1293.509296] ? trace_hardirqs_on+0x10/0x10 [ 1293.513546] schedule+0xfb/0x450 [ 1293.516912] ? lock_downgrade+0x8f0/0x8f0 [ 1293.521047] ? __schedule+0x1ed0/0x1ed0 [ 1293.525022] ? kasan_check_read+0x11/0x20 [ 1293.529163] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1293.533564] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1293.538136] ? kasan_check_write+0x14/0x20 [ 1293.542368] ? do_raw_spin_lock+0xc1/0x200 [ 1293.546607] rwsem_down_read_failed+0x362/0x600 [ 1293.551279] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1293.556805] ? lock_acquire+0x1e4/0x540 [ 1293.560784] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1293.565014] ? lock_downgrade+0x8f0/0x8f0 [ 1293.569192] ? lock_release+0xa30/0xa30 [ 1293.573213] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 1293.578243] ? mntput+0x74/0xa0 [ 1293.581520] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1293.587054] ? terminate_walk+0x20a/0x5e0 [ 1293.591197] ? rcuwait_wake_up+0x1cc/0x2f0 [ 1293.595443] call_rwsem_down_read_failed+0x18/0x30 [ 1293.600373] ? rcuwait_wake_up+0x186/0x2f0 [ 1293.604606] __percpu_down_read+0x1a0/0x290 [ 1293.608923] ? percpu_free_rwsem+0xa0/0xa0 [ 1293.613155] __sb_start_write+0x2d7/0x300 [ 1293.617306] mnt_want_write+0x3f/0xc0 [ 1293.621100] do_unlinkat+0x2b7/0xa30 [ 1293.624818] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1293.629219] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1293.633825] ? __ia32_sys_rmdir+0x40/0x40 [ 1293.637973] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1293.643511] ? strncpy_from_user+0x3be/0x510 [ 1293.647916] ? mpi_free.cold.1+0x19/0x19 [ 1293.652437] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1293.657971] ? getname_flags+0x26e/0x5a0 [ 1293.662031] __x64_sys_unlink+0x42/0x50 [ 1293.666008] do_syscall_64+0x1b9/0x820 [ 1293.669897] ? syscall_slow_exit_work+0x500/0x500 [ 1293.674734] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1293.679652] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1293.684664] ? perf_trace_sys_enter+0xb10/0xb10 [ 1293.689331] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1293.694176] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 1293.699361] RIP: 0033:0x455b77 [ 1293.702544] Code: Bad RIP value. [ 1293.705920] RSP: 002b:00007fff87c98d78 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 1293.713624] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000455b77 [ 1293.720891] RDX: 00007fff87c98d80 RSI: 00007fff87c98e10 RDI: 00007fff87c98e10 [ 1293.728157] RBP: 00007fff87c9ab20 R08: 0000000000000000 R09: 0000000000000011 [ 1293.735417] R10: 000000000000000a R11: 0000000000000206 R12: 0000000001c93940 [ 1293.742678] R13: 0000000000000000 R14: 00007fff87c9a4f0 R15: 0000000000702140 [ 1293.749942] percpu_rw_semaphore(00000000d9df82f9) [ 1293.754788] ->rw_sem.count=0xfffffffe00000001 [ 1293.759454] ->rss.gp_state=2 [ 1293.762633] ->rss.gp_count=1 [ 1293.765813] ->rss.cb_state=0 [ 1293.768992] ->rss.gp_type=1 [ 1293.772084] ->readers_block=1 [ 1293.775352] ->read_count=0 [ 1293.778355] ->list_empty(rw_sem.wait_list)=0 [ 1293.782936] ->writer.task= (null) [ 1293.787354] INFO: task syz-executor6:19633 blocked for more than 140 seconds. [ 1293.794620] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1293.800227] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1293.808185] syz-executor6 D24904 19633 4535 0x00000004 [ 1293.813815] Call Trace: [ 1293.816420] __schedule+0x87c/0x1ed0 [ 1293.820141] ? __sched_text_start+0x8/0x8 [ 1293.824287] ? trace_hardirqs_on+0x10/0x10 [ 1293.828514] ? trace_hardirqs_on+0x10/0x10 [ 1293.832748] ? __update_load_avg_se.isra.35+0x630/0x990 [ 1293.838114] ? task_fork_fair+0x680/0x680 [ 1293.842276] schedule+0xfb/0x450 [ 1293.845634] ? lock_downgrade+0x8f0/0x8f0 [ 1293.849779] ? __schedule+0x1ed0/0x1ed0 [ 1293.853752] ? kasan_check_read+0x11/0x20 [ 1293.857899] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1293.862306] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1293.866919] ? kasan_check_write+0x14/0x20 [ 1293.871146] ? do_raw_spin_lock+0xc1/0x200 [ 1293.875383] rwsem_down_read_failed+0x362/0x600 [ 1293.880053] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1293.885597] ? lock_acquire+0x1e4/0x540 [ 1293.889561] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1293.893802] ? lock_downgrade+0x8f0/0x8f0 [ 1293.897943] ? lock_release+0xa30/0xa30 [ 1293.901914] ? __free_object+0x173/0x340 [ 1293.905971] call_rwsem_down_read_failed+0x18/0x30 [ 1293.910895] ? rcuwait_wake_up+0x186/0x2f0 [ 1293.915120] __percpu_down_read+0x1a0/0x290 [ 1293.919434] ? percpu_free_rwsem+0xa0/0xa0 [ 1293.923661] __sb_start_write+0x2d7/0x300 [ 1293.927808] ext4_page_mkwrite+0x1d0/0x1430 [ 1293.932136] ? run_rebalance_domains+0x4c0/0x4c0 [ 1293.936888] ? ext4_change_inode_journal_flag+0x3e0/0x3e0 [ 1293.942417] ? lock_downgrade+0x8f0/0x8f0 [ 1293.946560] ? finish_task_switch+0x18a/0x870 [ 1293.951048] ? do_wp_page+0xf54/0x1670 [ 1293.954936] do_page_mkwrite+0x14e/0x520 [ 1293.958985] ? print_bad_pte+0x5f0/0x5f0 [ 1293.963043] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1293.967440] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1293.972030] ? __pte_alloc_kernel+0x2e0/0x2e0 [ 1293.976511] ? finish_task_switch+0x1d3/0x870 [ 1293.981017] ? trace_find_filtered_pid.part.61+0x50/0x50 [ 1293.986462] do_wp_page+0xf5c/0x1670 [ 1293.990235] ? lock_repin_lock+0x430/0x430 [ 1293.994507] ? finish_mkwrite_fault+0x610/0x610 [ 1293.999194] ? trace_hardirqs_on+0x10/0x10 [ 1294.003444] ? __schedule+0x884/0x1ed0 [ 1294.007343] ? debug_object_assert_init+0x4b0/0x4b0 [ 1294.012374] ? lock_acquire+0x1e4/0x540 [ 1294.016367] ? lock_acquire+0x1e4/0x540 [ 1294.020353] ? __handle_mm_fault+0x1cff/0x44a0 [ 1294.024945] ? lock_release+0xa30/0xa30 [ 1294.028931] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1294.033518] ? pmd_val+0x88/0x100 [ 1294.036982] ? add_mm_counter_fast+0xd0/0xd0 [ 1294.041432] ? kasan_check_write+0x14/0x20 [ 1294.045682] ? do_raw_spin_lock+0xc1/0x200 [ 1294.049951] __handle_mm_fault+0x2abf/0x44a0 [ 1294.054377] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 1294.059231] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1294.063833] ? kasan_check_write+0x14/0x20 [ 1294.068084] ? do_raw_spin_lock+0xc1/0x200 [ 1294.072334] ? lock_acquire+0x1e4/0x540 [ 1294.076318] ? handle_mm_fault+0x417/0xc80 [ 1294.080555] ? lock_downgrade+0x8f0/0x8f0 [ 1294.084709] ? lock_release+0xa30/0xa30 [ 1294.088693] ? lock_release+0xa30/0xa30 [ 1294.092674] ? do_raw_spin_lock+0xc1/0x200 [ 1294.096918] ? mem_cgroup_from_task+0xcb/0x1f0 [ 1294.101502] ? mem_cgroup_css_online+0x3c0/0x3c0 [ 1294.106266] handle_mm_fault+0x53e/0xc80 [ 1294.110339] ? __handle_mm_fault+0x44a0/0x44a0 [ 1294.114936] ? find_vma+0x34/0x190 [ 1294.118486] __do_page_fault+0x620/0xe50 [ 1294.122553] ? clock_was_set_work+0x30/0x30 [ 1294.126883] ? mm_fault_error+0x380/0x380 [ 1294.131052] ? __x64_sys_nanosleep+0x1f8/0x280 [ 1294.135643] ? hrtimer_nanosleep+0x620/0x620 [ 1294.140061] do_page_fault+0xf6/0x8c0 [ 1294.143870] ? vmalloc_sync_all+0x30/0x30 [ 1294.148038] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1294.153586] ? do_syscall_64+0x497/0x820 [ 1294.157655] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1294.162595] ? syscall_return_slowpath+0x31d/0x5e0 [ 1294.167537] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1294.172564] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1294.177599] ? page_fault+0x8/0x30 [ 1294.181153] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1294.186014] ? page_fault+0x8/0x30 [ 1294.189585] page_fault+0x1e/0x30 [ 1294.193050] RIP: 0033:0x4084b0 [ 1294.196241] Code: 00 00 2e 23 40 00 00 00 00 00 3e 23 40 00 00 00 00 00 4e 23 40 00 00 00 00 00 5e 23 40 00 00 00 00 00 6e 23 40 00 00 00 00 00 <7e> 23 40 00 00 00 00 00 8e 23 40 00 00 00 00 00 9e 23 40 00 00 00 [ 1294.215423] RSP: 002b:00007ffdb9fbab80 EFLAGS: 00010287 [ 1294.220811] RAX: 0000001b2ed2146c RBX: 0000000000000000 RCX: 0000001b2fd20000 [ 1294.228090] RDX: 0000001b2ed21470 RSI: 0000000000000003 RDI: 0000000000000003 [ 1294.235398] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1294.242674] R10: 00007ffdb9fbabc0 R11: 0000000000000000 R12: 0000000000000075 [ 1294.249949] R13: 0000000000000002 R14: 000000000072bea0 R15: 000000000072bea0 [ 1294.257242] percpu_rw_semaphore(00000000082ac9da) [ 1294.262112] ->rw_sem.count=0xfffffffe00000001 [ 1294.266802] ->rss.gp_state=2 [ 1294.270000] ->rss.gp_count=1 [ 1294.273201] ->rss.cb_state=0 [ 1294.276388] ->rss.gp_type=1 [ 1294.279487] ->readers_block=1 [ 1294.282764] ->read_count=0 [ 1294.285785] ->list_empty(rw_sem.wait_list)=0 [ 1294.290367] ->writer.task= (null) [ 1294.294777] INFO: task syz-executor7:19634 blocked for more than 140 seconds. [ 1294.302080] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1294.307741] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1294.315742] syz-executor7 D25056 19634 4539 0x00000004 [ 1294.321386] Call Trace: [ 1294.323989] __schedule+0x87c/0x1ed0 [ 1294.327732] ? __sched_text_start+0x8/0x8 [ 1294.331895] ? trace_hardirqs_on+0x10/0x10 [ 1294.336149] ? debug_object_activate+0x41a/0x690 [ 1294.340921] ? update_blocked_averages+0xcee/0x1770 [ 1294.345950] ? lock_downgrade+0x8f0/0x8f0 [ 1294.350122] ? trace_hardirqs_on+0x10/0x10 [ 1294.354373] schedule+0xfb/0x450 [ 1294.357747] ? lock_downgrade+0x8f0/0x8f0 [ 1294.361902] ? __schedule+0x1ed0/0x1ed0 [ 1294.365891] ? kasan_check_read+0x11/0x20 [ 1294.370054] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1294.374481] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1294.379092] ? kasan_check_write+0x14/0x20 [ 1294.383338] ? do_raw_spin_lock+0xc1/0x200 [ 1294.387588] rwsem_down_read_failed+0x362/0x600 [ 1294.392269] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1294.397813] ? lock_acquire+0x1e4/0x540 [ 1294.401798] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1294.406047] ? lock_downgrade+0x8f0/0x8f0 [ 1294.410215] ? lock_release+0xa30/0xa30 [ 1294.414207] ? __free_object+0x173/0x340 [ 1294.418305] call_rwsem_down_read_failed+0x18/0x30 [ 1294.423246] ? rcuwait_wake_up+0x186/0x2f0 [ 1294.427489] __percpu_down_read+0x1a0/0x290 [ 1294.431819] ? percpu_free_rwsem+0xa0/0xa0 [ 1294.436069] __sb_start_write+0x2d7/0x300 [ 1294.440231] ext4_page_mkwrite+0x1d0/0x1430 [ 1294.444565] ? ext4_change_inode_journal_flag+0x3e0/0x3e0 [ 1294.450111] ? lock_downgrade+0x8f0/0x8f0 [ 1294.454270] ? finish_task_switch+0x18a/0x870 [ 1294.458773] ? do_wp_page+0xf54/0x1670 [ 1294.462666] do_page_mkwrite+0x14e/0x520 [ 1294.466732] ? print_bad_pte+0x5f0/0x5f0 [ 1294.470799] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1294.475210] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1294.479801] ? __pte_alloc_kernel+0x2e0/0x2e0 [ 1294.484301] ? finish_task_switch+0x1d3/0x870 [ 1294.488805] ? trace_find_filtered_pid.part.61+0x50/0x50 [ 1294.494268] do_wp_page+0xf5c/0x1670 [ 1294.497992] ? lock_repin_lock+0x430/0x430 [ 1294.502248] ? finish_mkwrite_fault+0x610/0x610 [ 1294.506929] ? trace_hardirqs_on+0x10/0x10 [ 1294.511174] ? __schedule+0x884/0x1ed0 [ 1294.515069] ? debug_object_assert_init+0x4b0/0x4b0 [ 1294.520094] ? lock_acquire+0x1e4/0x540 [ 1294.524084] ? lock_acquire+0x1e4/0x540 [ 1294.528076] ? __handle_mm_fault+0x1cff/0x44a0 [ 1294.532666] ? lock_release+0xa30/0xa30 [ 1294.536665] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1294.541259] ? pmd_val+0x88/0x100 [ 1294.544722] ? add_mm_counter_fast+0xd0/0xd0 [ 1294.549141] ? kasan_check_write+0x14/0x20 [ 1294.553384] ? do_raw_spin_lock+0xc1/0x200 [ 1294.557624] __handle_mm_fault+0x2abf/0x44a0 [ 1294.562052] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 1294.566898] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1294.571503] ? kasan_check_write+0x14/0x20 [ 1294.575748] ? do_raw_spin_lock+0xc1/0x200 [ 1294.579995] ? lock_acquire+0x1e4/0x540 [ 1294.583984] ? handle_mm_fault+0x417/0xc80 [ 1294.588232] ? lock_downgrade+0x8f0/0x8f0 [ 1294.592384] ? lock_release+0xa30/0xa30 [ 1294.596365] ? lock_release+0xa30/0xa30 [ 1294.600341] ? do_raw_spin_lock+0xc1/0x200 [ 1294.604583] ? mem_cgroup_from_task+0xcb/0x1f0 [ 1294.609170] ? mem_cgroup_css_online+0x3c0/0x3c0 [ 1294.613937] handle_mm_fault+0x53e/0xc80 [ 1294.618018] ? __handle_mm_fault+0x44a0/0x44a0 [ 1294.622623] ? find_vma+0x34/0x190 [ 1294.626170] __do_page_fault+0x620/0xe50 [ 1294.630241] ? clock_was_set_work+0x30/0x30 [ 1294.634573] ? mm_fault_error+0x380/0x380 [ 1294.638728] ? __x64_sys_nanosleep+0x1f8/0x280 [ 1294.643317] ? hrtimer_nanosleep+0x620/0x620 [ 1294.647727] do_page_fault+0xf6/0x8c0 [ 1294.651530] ? vmalloc_sync_all+0x30/0x30 [ 1294.655698] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1294.661247] ? do_syscall_64+0x497/0x820 [ 1294.665320] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1294.670257] ? syscall_return_slowpath+0x31d/0x5e0 [ 1294.675197] ? prepare_exit_to_usermode+0x3b0/0x3b0 [ 1294.680226] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1294.685250] ? page_fault+0x8/0x30 [ 1294.688801] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1294.693651] ? page_fault+0x8/0x30 [ 1294.697194] page_fault+0x1e/0x30 [ 1294.700668] RIP: 0033:0x4084b0 [ 1294.703855] Code: 00 00 2e 23 40 00 00 00 00 00 3e 23 40 00 00 00 00 00 4e 23 40 00 00 00 00 00 5e 23 40 00 00 00 00 00 6e 23 40 00 00 00 00 00 <7e> 23 40 00 00 00 00 00 8e 23 40 00 00 00 00 00 9e 23 40 00 00 00 [ 1294.723083] RSP: 002b:00007ffcf482d3e0 EFLAGS: 00010287 [ 1294.728447] RAX: 0000001b2ef2129c RBX: 0000000000000000 RCX: 0000001b2ff20000 [ 1294.735722] RDX: 0000001b2ef212a0 RSI: 0000000000730180 RDI: 0000000000000001 [ 1294.743004] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1294.750306] R10: 00007ffcf482d420 R11: 0000000000000000 R12: 0000000000000000 [ 1294.757592] R13: 0000000000000002 R14: 000000000072bea0 R15: 000000000072bea0 [ 1294.766352] percpu_rw_semaphore(00000000082ac9da) [ 1294.771194] ->rw_sem.count=0xfffffffe00000001 [ 1294.775866] ->rss.gp_state=2 [ 1294.779062] ->rss.gp_count=1 [ 1294.782252] ->rss.cb_state=0 [ 1294.785440] ->rss.gp_type=1 [ 1294.788543] ->readers_block=1 [ 1294.791819] ->read_count=0 [ 1294.794837] ->list_empty(rw_sem.wait_list)=0 [ 1294.799418] ->writer.task= (null) [ 1294.803826] INFO: task syz-executor5:19638 blocked for more than 140 seconds. [ 1294.811099] Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1294.816719] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1294.824685] syz-executor5 D24904 19638 4540 0x00000004 [ 1294.830331] Call Trace: [ 1294.832948] __schedule+0x87c/0x1ed0 [ 1294.836673] ? __sched_text_start+0x8/0x8 [ 1294.840830] ? trace_hardirqs_on+0x10/0x10 [ 1294.845096] ? trace_hardirqs_on+0x10/0x10 [ 1294.849339] ? trace_hardirqs_on+0x10/0x10 [ 1294.853584] ? finish_task_switch+0x1d3/0x870 [ 1294.858089] ? finish_task_switch+0x18a/0x870 [ 1294.862609] ? trace_find_filtered_pid.part.61+0x50/0x50 [ 1294.868073] ? preempt_notifier_register+0x200/0x200 [ 1294.873206] ? lock_repin_lock+0x430/0x430 [ 1294.877454] schedule+0xfb/0x450 [ 1294.880829] ? lock_downgrade+0x8f0/0x8f0 [ 1294.884988] ? __schedule+0x1ed0/0x1ed0 [ 1294.888978] ? kasan_check_read+0x11/0x20 [ 1294.893144] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1294.897560] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1294.902171] ? kasan_check_write+0x14/0x20 [ 1294.906420] ? do_raw_spin_lock+0xc1/0x200 [ 1294.910667] rwsem_down_read_failed+0x362/0x600 [ 1294.915347] ? rwsem_down_write_failed_killable+0x10/0x10 [ 1294.920892] ? lock_acquire+0x1e4/0x540 [ 1294.924873] ? rcuwait_wake_up+0x1a3/0x2f0 [ 1294.929116] ? lock_downgrade+0x8f0/0x8f0 [ 1294.933285] ? lock_release+0xa30/0xa30 [ 1294.937269] ? __free_object+0x173/0x340 [ 1294.941343] ? kasan_check_read+0x11/0x20 [ 1294.945507] call_rwsem_down_read_failed+0x18/0x30 [ 1294.950444] ? rcuwait_wake_up+0x186/0x2f0 [ 1294.954700] __percpu_down_read+0x1a0/0x290 [ 1294.959037] ? percpu_free_rwsem+0xa0/0xa0 [ 1294.963289] __sb_start_write+0x2d7/0x300 [ 1294.967449] ext4_page_mkwrite+0x1d0/0x1430 [ 1294.971778] ? ext4_change_inode_journal_flag+0x3e0/0x3e0 [ 1294.977322] ? destroy_hrtimer_on_stack+0x1c/0x20 [ 1294.982177] ? futex_wait+0x5d2/0xa20 [ 1294.985991] ? do_wp_page+0xf54/0x1670 [ 1294.989892] do_page_mkwrite+0x14e/0x520 [ 1294.993960] ? print_bad_pte+0x5f0/0x5f0 [ 1294.998033] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1295.002446] ? do_raw_spin_trylock+0x1c0/0x1c0 [ 1295.007068] ? __pte_alloc_kernel+0x2e0/0x2e0 [ 1295.011574] do_wp_page+0xf5c/0x1670 [ 1295.015294] ? finish_mkwrite_fault+0x610/0x610 [ 1295.019971] ? trace_hardirqs_on+0x10/0x10 [ 1295.024220] ? lock_acquire+0x1e4/0x540 [ 1295.028211] ? __handle_mm_fault+0x1cff/0x44a0 [ 1295.032801] ? lock_release+0xa30/0xa30 [ 1295.036784] ? pmd_val+0x88/0x100 [ 1295.040245] ? add_mm_counter_fast+0xd0/0xd0 [ 1295.044664] ? kasan_check_write+0x14/0x20 [ 1295.048906] ? do_raw_spin_lock+0xc1/0x200 [ 1295.053149] __handle_mm_fault+0x2abf/0x44a0 [ 1295.057564] ? vmf_insert_mixed_mkwrite+0xa0/0xa0 [ 1295.062421] ? fault_create_debugfs_attr+0x1f0/0x1f0 [ 1295.067529] ? to_ratio+0x20/0x20 [ 1295.071010] ? lock_acquire+0x1e4/0x540 [ 1295.075012] ? handle_mm_fault+0x417/0xc80 [ 1295.079269] ? lock_downgrade+0x8f0/0x8f0 [ 1295.083423] ? lock_release+0xa30/0xa30 [ 1295.087399] ? lock_release+0xa30/0xa30 [ 1295.091379] ? lock_acquire+0x1e4/0x540 [ 1295.095364] ? mem_cgroup_from_task+0xcb/0x1f0 [ 1295.099951] ? mem_cgroup_css_online+0x3c0/0x3c0 [ 1295.104714] handle_mm_fault+0x53e/0xc80 [ 1295.108783] ? __handle_mm_fault+0x44a0/0x44a0 [ 1295.113366] ? find_vma+0x34/0x190 [ 1295.116916] __do_page_fault+0x620/0xe50 [ 1295.120987] ? mm_fault_error+0x380/0x380 [ 1295.125149] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1295.130696] ? __x64_sys_clock_gettime+0x170/0x250 [ 1295.135636] ? __ia32_sys_clock_settime+0x290/0x290 [ 1295.140681] do_page_fault+0xf6/0x8c0 [ 1295.144491] ? vmalloc_sync_all+0x30/0x30 [ 1295.148648] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1295.154195] ? do_syscall_64+0x497/0x820 [ 1295.158271] ? syscall_slow_exit_work+0x500/0x500 [ 1295.163123] ? syscall_return_slowpath+0x5e0/0x5e0 [ 1295.168324] ? syscall_return_slowpath+0x31d/0x5e0 [ 1295.173264] ? prepare_exit_to_usermode+0x291/0x3b0 [ 1295.178293] ? page_fault+0x8/0x30 [ 1295.181846] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 1295.186703] ? page_fault+0x8/0x30 [ 1295.190316] page_fault+0x1e/0x30 [ 1295.193783] RIP: 0033:0x4084b0 [ 1295.196983] Code: 00 00 2e 23 40 00 00 00 00 00 3e 23 40 00 00 00 00 00 4e 23 40 00 00 00 00 00 5e 23 40 00 00 00 00 00 6e 23 40 00 00 00 00 00 <7e> 23 40 00 00 00 00 00 8e 23 40 00 00 00 00 00 9e 23 40 00 00 00 [ 1295.216272] RSP: 002b:00007ffd4fa13540 EFLAGS: 00010287 [ 1295.221663] RAX: 0000001b2f1212f0 RBX: 0000000000000000 RCX: 0000001b30120000 [ 1295.228941] RDX: 0000001b2f1212f4 RSI: 0000000000730998 RDI: 0000000000000002 [ 1295.236215] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1295.243508] R10: 00007ffd4fa13580 R11: 0000000000000246 R12: 0000000000000000 [ 1295.250796] R13: 0000000000000002 R14: 000000000072bea0 R15: 000000000072bea0 [ 1295.258108] percpu_rw_semaphore(00000000082ac9da) [ 1295.262985] ->rw_sem.count=0xfffffffe00000001 [ 1295.267681] ->rss.gp_state=2 [ 1295.270875] ->rss.gp_count=1 [ 1295.274074] ->rss.cb_state=0 [ 1295.277264] ->rss.gp_type=1 [ 1295.280367] ->readers_block=1 [ 1295.283649] ->read_count=0 [ 1295.286663] ->list_empty(rw_sem.wait_list)=0 [ 1295.291240] ->writer.task= (null) [ 1295.295643] INFO: lockdep is turned off. [ 1295.299701] NMI backtrace for cpu 0 [ 1295.303334] CPU: 0 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1295.311295] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1295.320632] Call Trace: [ 1295.323207] dump_stack+0x1c9/0x2b4 [ 1295.326818] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1295.331992] ? vprintk_default+0x28/0x30 [ 1295.336057] ? lapic_can_unplug_cpu.cold.28+0x3f/0x3f [ 1295.341232] nmi_cpu_backtrace.cold.3+0x48/0x88 [ 1295.345883] ? lapic_can_unplug_cpu.cold.28+0x3f/0x3f [ 1295.351063] nmi_trigger_cpumask_backtrace+0x151/0x192 [ 1295.356323] arch_trigger_cpumask_backtrace+0x14/0x20 [ 1295.361501] watchdog+0xb81/0x10f0 [ 1295.365043] ? reset_hung_task_detector+0xd0/0xd0 [ 1295.369877] ? find_held_lock+0x36/0x1c0 [ 1295.373931] ? kasan_check_read+0x11/0x20 [ 1295.378070] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1295.382472] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 1295.387559] ? __kthread_parkme+0x58/0x1b0 [ 1295.391792] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1295.396795] ? trace_hardirqs_on+0xd/0x10 [ 1295.400938] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1295.406461] ? __kthread_parkme+0x106/0x1b0 [ 1295.410764] kthread+0x345/0x410 [ 1295.414116] ? reset_hung_task_detector+0xd0/0xd0 [ 1295.418952] ? kthread_bind+0x40/0x40 [ 1295.422743] ret_from_fork+0x3a/0x50 [ 1295.426492] Sending NMI from CPU 0 to CPUs 1: [ 1295.431040] NMI backtrace for cpu 1 skipped: idling at native_safe_halt+0x6/0x10 [ 1295.432003] Kernel panic - not syncing: hung_task: blocked tasks [ 1295.444729] CPU: 0 PID: 901 Comm: khungtaskd Not tainted 4.18.0-rc4-next-20180711+ #4 [ 1295.452676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1295.462025] Call Trace: [ 1295.464615] dump_stack+0x1c9/0x2b4 [ 1295.468227] ? dump_stack_print_info.cold.2+0x52/0x52 [ 1295.473970] ? printk_safe_log_store+0x2f0/0x2f0 [ 1295.478721] panic+0x238/0x4e7 [ 1295.481899] ? add_taint.cold.5+0x16/0x16 [ 1295.486044] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1295.491576] ? nmi_trigger_cpumask_backtrace+0x13a/0x192 [ 1295.497013] ? printk_safe_flush+0xd7/0x130 [ 1295.501329] watchdog+0xb92/0x10f0 [ 1295.504860] ? reset_hung_task_detector+0xd0/0xd0 [ 1295.509692] ? find_held_lock+0x36/0x1c0 [ 1295.513744] ? kasan_check_read+0x11/0x20 [ 1295.517874] ? do_raw_spin_unlock+0xa7/0x2f0 [ 1295.522282] ? _raw_spin_unlock_irqrestore+0x74/0xc0 [ 1295.527369] ? __kthread_parkme+0x58/0x1b0 [ 1295.531590] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 1295.536592] ? trace_hardirqs_on+0xd/0x10 [ 1295.540727] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 1295.546245] ? __kthread_parkme+0x106/0x1b0 [ 1295.550550] kthread+0x345/0x410 [ 1295.553901] ? reset_hung_task_detector+0xd0/0xd0 [ 1295.558727] ? kthread_bind+0x40/0x40 [ 1295.562511] ret_from_fork+0x3a/0x50 [ 1295.566786] Dumping ftrace buffer: [ 1295.570312] (ftrace buffer empty) [ 1295.574017] Kernel Offset: disabled [ 1295.577627] Rebooting in 86400 seconds..