00 00 01 00 00 00 00 ................ [ 3239.176054][ T2404] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3239.186474][ T2404] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3239.195774][ T2404] XFS (loop5): SB validate failed with error -117. 22:00:51 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000254000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:00:51 executing program 0: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x83000000) 22:00:51 executing program 1: 22:00:51 executing program 2: 22:00:51 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:00:51 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:00:52 executing program 1: [ 3239.570772][ T2455] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:00:52 executing program 2: 22:00:52 executing program 0: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x83000000) 22:00:52 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:00:52 executing program 1: [ 3239.836415][ T2466] XFS (loop5): realtime geometry sanity check failed [ 3239.855517][ T2461] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3239.869072][ T2466] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:00:52 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3239.950002][ T2466] XFS (loop5): Unmount and run xfs_repair [ 3239.958024][ T2466] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3239.966514][ T2466] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3239.978626][ T2466] 00000010: 00 00 00 00 00 00 02 54 00 00 00 00 00 00 00 00 .......T........ [ 3239.995741][ T2466] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3240.016322][ T2466] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3240.041540][ T2466] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3240.058915][ T2466] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3240.086136][ T2466] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3240.103891][ T2466] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3240.109679][ T2494] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3240.117935][ T2466] XFS (loop5): SB validate failed with error -117. [ 3240.194086][ T2496] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3240.475953][T19694] XFS (loop5): realtime geometry sanity check failed [ 3240.482982][T19694] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3240.496269][T19694] XFS (loop5): Unmount and run xfs_repair [ 3240.504194][T19694] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3240.513035][T19694] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3240.524175][T19694] 00000010: 00 00 00 00 00 00 02 54 00 00 00 00 00 00 00 00 .......T........ [ 3240.534154][T19694] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3240.543990][T19694] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3240.553538][T19694] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3240.563145][T19694] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3240.572736][T19694] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3240.582356][T19694] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3240.592050][ T2466] XFS (loop5): SB validate failed with error -117. 22:00:53 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000060000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:00:53 executing program 2: 22:00:53 executing program 0: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x83000000) 22:00:53 executing program 1: 22:00:53 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:00:53 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:00:53 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3240.948295][ T2525] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:00:53 executing program 0: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) 22:00:53 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:00:53 executing program 1: 22:00:53 executing program 2: 22:00:53 executing program 1: [ 3241.264146][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3241.275573][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3241.287683][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3241.293565][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3241.301673][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3241.310925][ T3182] 00000010: 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 00 .......`........ [ 3241.320036][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3241.329154][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3241.338388][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3241.347548][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3241.356664][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3241.365730][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3241.374911][ T2537] XFS (loop5): SB validate failed with error -117. [ 3241.700490][T19694] XFS (loop5): realtime geometry sanity check failed [ 3241.711277][T19694] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3241.732128][T19694] XFS (loop5): Unmount and run xfs_repair [ 3241.739232][T19694] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3241.755622][T19694] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3241.770774][T19694] 00000010: 00 00 00 00 00 00 00 60 00 00 00 00 00 00 00 00 .......`........ [ 3241.782143][T19694] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3241.807394][T19694] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3241.816785][T19694] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3241.826098][T19694] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3241.835494][T19694] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3241.844373][T19694] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3241.854927][ T2537] XFS (loop5): SB validate failed with error -117. 22:00:54 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000260000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:00:54 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:00:54 executing program 1: 22:00:54 executing program 0: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) 22:00:54 executing program 2: 22:00:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:00:54 executing program 0: syz_open_dev$sndpcmc(&(0x7f0000000180)='/dev/snd/pcmC#D#c\x00', 0x0, 0x0) r0 = syz_open_dev$sndpcmc(0x0, 0x0, 0x0) mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) 22:00:54 executing program 2: 22:00:54 executing program 1: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x2, 0x2812, r0, 0x0) r1 = open(&(0x7f0000000240)='./bus\x00', 0x141042, 0x0) write$FUSE_DIRENTPLUS(r1, &(0x7f0000000040)=ANY=[], 0xfd30) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpuacct.usage_user\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x10012, r2, 0x0) [ 3242.268974][ T2582] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:00:54 executing program 0: [ 3242.414275][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3242.441983][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:00:54 executing program 2: [ 3242.516562][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3242.556291][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:00:55 executing program 0: [ 3242.596533][ T2584] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3242.599983][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3242.650634][ T3182] 00000010: 00 00 00 00 00 00 02 60 00 00 00 00 00 00 00 00 .......`........ [ 3242.682794][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3242.712014][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3242.741765][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3242.757560][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3242.775823][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3242.789774][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3242.813941][ T2585] XFS (loop5): SB validate failed with error -117. 22:00:55 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000064000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3243.461219][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3243.474921][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3243.488430][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3243.494184][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3243.502974][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3243.512601][ T3182] 00000010: 00 00 00 00 00 00 00 64 00 00 00 00 00 00 00 00 .......d........ [ 3243.522203][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3243.531917][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3243.541552][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3243.551281][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3243.561055][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3243.570856][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3243.580609][ T2623] XFS (loop5): SB validate failed with error -117. [ 3243.930046][ T2623] XFS (loop5): realtime geometry sanity check failed [ 3243.939490][ T2623] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3243.958177][ T2623] XFS (loop5): Unmount and run xfs_repair [ 3243.964159][ T2623] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3243.973646][ T2623] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3243.985070][ T2623] 00000010: 00 00 00 00 00 00 00 64 00 00 00 00 00 00 00 00 .......d........ [ 3243.994185][ T2623] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3244.004528][ T2623] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3244.014381][ T2623] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3244.025025][ T2623] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3244.034081][ T2623] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3244.044225][ T2623] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3244.053960][ T2623] XFS (loop5): SB validate failed with error -117. 22:00:57 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:00:57 executing program 2: 22:00:57 executing program 0: 22:00:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:00:57 executing program 1: 22:00:57 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000068000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:00:57 executing program 1: [ 3245.235476][ T2654] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:00:57 executing program 2: 22:00:57 executing program 0: [ 3245.306519][ T2653] XFS (loop5): realtime geometry sanity check failed [ 3245.320241][ T2653] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3245.336069][ T2653] XFS (loop5): Unmount and run xfs_repair [ 3245.342103][ T2653] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3245.351623][ T2653] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3245.362426][ T2653] 00000010: 00 00 00 00 00 00 00 68 00 00 00 00 00 00 00 00 .......h........ [ 3245.372957][ T2653] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3245.382915][ T2653] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3245.394051][ T2653] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3245.404201][ T2653] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3245.422928][ T2653] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3245.446065][ T2653] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:00:57 executing program 1: 22:00:57 executing program 2: [ 3245.456760][ T2653] XFS (loop5): SB validate failed with error -117. 22:00:57 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r1) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) bind$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', r2}) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000080)={0xfffffc01, 0x7, 0x75c, 0xfff, 0x1}, 0x14) r3 = gettid() tkill(r3, 0x16) tkill(r3, 0x9) [ 3245.544936][ T2664] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3245.626204][ T2687] ptrace attach of "/root/syz-executor.0"[2686] was attempted by "/root/syz-executor.0"[2687] [ 3245.781810][T19694] XFS (loop5): realtime geometry sanity check failed [ 3245.792768][T19694] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3245.819272][T19694] XFS (loop5): Unmount and run xfs_repair [ 3245.826316][T19694] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3245.833922][T19694] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3245.845107][T19694] 00000010: 00 00 00 00 00 00 00 68 00 00 00 00 00 00 00 00 .......h........ [ 3245.865937][T19694] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3245.882968][T19694] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3245.904076][T19694] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3245.918942][T19694] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3245.929164][T19694] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3245.939326][T19694] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3245.949339][ T2653] XFS (loop5): SB validate failed with error -117. 22:01:00 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:00 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000080)='.', 0x0, 0x0, 0x0) 22:01:00 executing program 1: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x114, 0x114, 0x2, [@const, @array, @enum={0x0, 0x6, 0x0, 0x6, 0x4, [{}, {}, {}, {}, {}, {}]}, @union={0x0, 0x9, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}]}]}}, 0x0, 0x12e}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:00 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:00 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000000000000006a000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:00 executing program 1: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6c, 0x6c, 0x3, [@enum={0x0, 0x6, 0x0, 0x6, 0x4, [{}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @ptr]}, {0x0, [0x0]}}, 0x0, 0x87}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3248.312887][ T2713] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3248.331233][ T2716] ptrace attach of "/root/syz-executor.1"[2714] was attempted by "/root/syz-executor.1"[2716] 22:01:00 executing program 2: unshare(0x600) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0) [ 3248.393913][T31280] XFS (loop5): realtime geometry sanity check failed [ 3248.408240][T31280] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3248.433507][ T2735] ptrace attach of "/root/syz-executor.1"[2734] was attempted by "/root/syz-executor.1"[2735] 22:01:00 executing program 1: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xf4, 0xf4, 0x3, [@const, @enum={0x0, 0x6, 0x0, 0x6, 0x4, [{}, {}, {}, {}, {}, {}]}, @union={0x0, 0x9, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x5, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}]}]}, {0x0, [0x0]}}, 0x0, 0x10f}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3248.448132][T31280] XFS (loop5): Unmount and run xfs_repair [ 3248.467261][T31280] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:01:00 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3248.503335][T31280] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3248.528752][T31280] 00000010: 00 00 00 00 00 00 00 6a 00 00 00 00 00 00 00 00 .......j........ 22:01:00 executing program 2: 22:01:01 executing program 0: [ 3248.561749][T31280] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3248.599426][ T2744] ptrace attach of "/root/syz-executor.1"[2743] was attempted by "/root/syz-executor.1"[2744] 22:01:01 executing program 1: [ 3248.600604][ T2745] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3248.610026][T31280] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3248.679478][T31280] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3248.703702][T31280] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3248.716052][T31280] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3248.746926][T31280] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3248.792319][ T2717] XFS (loop5): SB validate failed with error -117. [ 3249.105533][ T2717] XFS (loop5): realtime geometry sanity check failed [ 3249.114611][ T2717] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3249.135328][ T2717] XFS (loop5): Unmount and run xfs_repair [ 3249.141164][ T2717] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3249.149252][ T2717] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3249.158793][ T2717] 00000010: 00 00 00 00 00 00 00 6a 00 00 00 00 00 00 00 00 .......j........ [ 3249.171332][ T2717] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3249.180906][ T2717] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3249.191378][ T2717] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3249.201657][ T2717] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3249.241907][ T2717] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3249.276280][ T2717] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3249.296229][ T2717] XFS (loop5): SB validate failed with error -117. 22:01:03 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:03 executing program 2: 22:01:03 executing program 0: 22:01:03 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:03 executing program 1: 22:01:03 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000000000000006c000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:03 executing program 1: 22:01:03 executing program 0: [ 3251.424454][ T2780] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3251.461208][ T2777] XFS (loop5): realtime geometry sanity check failed 22:01:03 executing program 2: [ 3251.474088][ T2777] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:01:03 executing program 1: 22:01:03 executing program 1: [ 3251.522289][ T2777] XFS (loop5): Unmount and run xfs_repair [ 3251.562193][ T2777] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:01:04 executing program 2: [ 3251.601695][ T2777] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3251.612040][ T2777] 00000010: 00 00 00 00 00 00 00 6c 00 00 00 00 00 00 00 00 .......l........ [ 3251.623154][ T2777] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3251.632885][ T2777] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3251.642198][ T2777] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3251.651473][ T2777] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3251.660806][ T2777] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3251.670037][ T2777] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3251.680370][ T2777] XFS (loop5): SB validate failed with error -117. [ 3251.763062][ T2780] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3251.982391][ T2777] XFS (loop5): realtime geometry sanity check failed [ 3251.998667][ T2777] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3252.031309][ T2777] XFS (loop5): Unmount and run xfs_repair [ 3252.037958][ T2777] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3252.046428][ T2777] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3252.056179][ T2777] 00000010: 00 00 00 00 00 00 00 6c 00 00 00 00 00 00 00 00 .......l........ [ 3252.066150][ T2777] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3252.075949][ T2777] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3252.100456][ T2777] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3252.119733][ T2777] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3252.129970][ T2777] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3252.140630][ T2777] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3252.150603][ T2777] XFS (loop5): SB validate failed with error -117. 22:01:06 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:06 executing program 0: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f00000001c0)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setreuid(0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB], 0x1}}, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x40, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x10040}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000200)={[0x42, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0x40240}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='rdma.current\x00', 0x275a, 0x0) ioctl$KVM_SET_TSS_ADDR(0xffffffffffffffff, 0xae47, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r3, 0x0) 22:01:06 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:01:06 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc804}, 0x0) socket$inet6(0xa, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) writev(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x400000000010, 0x2, 0x0) recvmsg(r1, &(0x7f0000001800)={0x0, 0x0, 0x0, 0x0, &(0x7f00000017c0)}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f00000000c0)=0x3, 0x4) write(r1, &(0x7f0000000000)="2400000021002551071c0165ff00fc020200000000100f000ee1000c08000b0000000000", 0x24) r2 = socket$inet6(0xa, 0x2, 0x0) sysfs$3(0x3) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_inet_SIOCDELRT(r3, 0x890c, &(0x7f0000000140)={0x0, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e22, @private=0x1}, {0x2, 0x4e24, @local}, 0x0, 0x0, 0x0, 0x0, 0x32be, &(0x7f0000000040)='virt_wifi0\x00', 0x7, 0x8, 0x6}) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000240)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x14400000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a4000000", @ANYRES16=r4, @ANYBLOB="000125bd7000fcdbdf2506000000140002000000000000000000000000000000000114000300fc006190651d02df000000000000000000000000000014000200fc00000000000000000000000000000114000200ff0100000000000000000000000000011400060062617461647630000000000000000000080004007f00000108c905d91eaa9b07125a436c3d000500e00000011400030000000000000000000000ffffac3e00010800050064010102"], 0xa4}, 0x1, 0x0, 0x0, 0x1812}, 0x400c005) 22:01:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:06 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000074000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3254.503589][ T2821] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3254.575975][ T2824] XFS (loop5): realtime geometry sanity check failed [ 3254.586007][ T2824] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3254.626370][ T2824] XFS (loop5): Unmount and run xfs_repair [ 3254.640912][ T2821] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3254.659430][ T2824] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3254.672417][ T2824] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3254.752344][ T2824] 00000010: 00 00 00 00 00 00 00 74 00 00 00 00 00 00 00 00 .......t........ 22:01:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3254.864968][ T2824] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:01:07 executing program 2: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc804}, 0x0) socket$inet6(0xa, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) writev(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x400000000010, 0x2, 0x0) recvmsg(r1, &(0x7f0000001800)={0x0, 0x0, 0x0, 0x0, &(0x7f00000017c0)}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x22, &(0x7f00000000c0)=0x3, 0x4) write(r1, &(0x7f0000000000)="2400000021002551071c0165ff00fc020200000000100f000ee1000c08000b0000000000", 0x24) r2 = socket$inet6(0xa, 0x2, 0x0) sysfs$3(0x3) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_inet_SIOCDELRT(r3, 0x890c, &(0x7f0000000140)={0x0, {0x2, 0x4e22, @multicast1}, {0x2, 0x4e22, @private=0x1}, {0x2, 0x4e24, @local}, 0x0, 0x0, 0x0, 0x0, 0x32be, &(0x7f0000000040)='virt_wifi0\x00', 0x7, 0x8, 0x6}) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000240)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x14400000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a4000000", @ANYRES16=r4, @ANYBLOB="000125bd7000fcdbdf2506000000140002000000000000000000000000000000000114000300fc006190651d02df000000000000000000000000000014000200fc00000000000000000000000000000114000200ff0100000000000000000000000000011400060062617461647630000000000000000000080004007f00000108c905d91eaa9b07125a436c3d000500e00000011400030000000000000000000000ffffac3e00010800050064010102"], 0xa4}, 0x1, 0x0, 0x0, 0x1812}, 0x400c005) [ 3254.955731][ T2824] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3254.964627][ T2824] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3254.975259][ T2824] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3255.031894][ T2824] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3255.079970][ T2824] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3255.094451][ T2872] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3255.122468][ T2824] XFS (loop5): SB validate failed with error -117. 22:01:07 executing program 2: ioctl$VHOST_SET_VRING_ERR(0xffffffffffffffff, 0x4008af22, &(0x7f00000004c0)={0x3}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getpeername$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0xa) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000240)={@ipv4={[], [], @private}, @private2, @initdev={0xfe, 0x88, [0x0, 0x8, 0x96, 0x2, 0x0, 0x0, 0x7, 0xfc], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24c20082, r3}) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0) exit_group(0x82) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r6, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1a, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r7}, 0x78) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x3, &(0x7f0000000000)=@raw=[@initr0={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x5}, @call={0x85, 0x0, 0x0, 0x65}], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x6, [], r3, 0x1b, r4, 0x8, &(0x7f00000000c0)={0x2, 0x2}, 0x8, 0x10, &(0x7f0000000100)={0x1, 0x7, 0xfffff800, 0x2}, 0x10, r7}, 0x78) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) write$FUSE_POLL(r9, &(0x7f0000000500)={0x18, 0x0, 0x8, {0x2d}}, 0x18) [ 3255.235821][ T2872] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3255.249923][ T2822] syz-executor.1: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 22:01:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000000ff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3255.343873][ T2822] CPU: 1 PID: 2822 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3255.352493][ T2822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3255.362560][ T2822] Call Trace: [ 3255.365876][ T2822] dump_stack+0x18f/0x20d [ 3255.370250][ T2822] warn_alloc.cold+0x87/0x17a [ 3255.374939][ T2822] ? zone_watermark_ok_safe+0x260/0x260 [ 3255.380507][ T2822] ? wait_for_completion+0x260/0x260 [ 3255.385813][ T2822] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 22:01:07 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c0000006800b595000006000000f60000000000", @ANYRES32=0x0, @ANYBLOB="14"], 0x3}}, 0x0) close(r4) socket$inet(0x10, 0x3, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) splice(r2, 0x0, r4, 0x0, 0x4ff60, 0x0) [ 3255.392430][ T2822] ? warn_alloc+0x120/0x120 [ 3255.396948][ T2822] ? __alloc_pages_nodemask+0x3e5/0x930 [ 3255.402512][ T2822] ? lock_is_held_type+0xb0/0xe0 [ 3255.407463][ T2822] ? find_held_lock+0x2d/0x110 [ 3255.412248][ T2822] __alloc_pages_nodemask+0x68f/0x930 [ 3255.414980][ T2893] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3255.417625][ T2822] ? __zone_watermark_ok+0x370/0x370 [ 3255.417647][ T2822] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3255.417664][ T2822] ? lock_is_held_type+0xb0/0xe0 [ 3255.417686][ T2822] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 3255.449463][ T2822] ? __alloc_pages_nodemask+0x6b1/0x930 [ 3255.455022][ T2822] alloc_pages_current+0x187/0x280 [ 3255.460142][ T2822] alloc_mmu_pages+0x7f/0x170 [ 3255.464828][ T2822] kvm_mmu_create+0x3cb/0x560 [ 3255.469513][ T2822] kvm_arch_vcpu_create+0x16d/0xb70 [ 3255.474719][ T2822] kvm_vm_ioctl+0x1547/0x23c0 [ 3255.479405][ T2822] ? lock_downgrade+0x820/0x820 [ 3255.484296][ T2822] ? kvm_unregister_device_ops+0x60/0x60 [ 3255.489943][ T2822] ? kfree+0x1e0/0x2c0 [ 3255.494032][ T2822] ? tomoyo_path_number_perm+0x244/0x4d0 [ 3255.499700][ T2822] ? tomoyo_execute_permission+0x470/0x470 [ 3255.505526][ T2822] ? __lockdep_free_key_range+0x110/0x110 [ 3255.511263][ T2822] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 3255.517162][ T2822] ? do_vfs_ioctl+0x27d/0x1090 [ 3255.521936][ T2822] ? generic_block_fiemap+0x60/0x60 [ 3255.527138][ T2822] ? selinux_inode_getsecctx+0x90/0x90 [ 3255.532596][ T2822] ? __might_fault+0x190/0x1d0 [ 3255.537363][ T2822] ? _copy_to_user+0x126/0x160 [ 3255.542157][ T2822] ? __fget_files+0x294/0x400 [ 3255.546848][ T2822] ? kvm_unregister_device_ops+0x60/0x60 [ 3255.552507][ T2822] ksys_ioctl+0x11a/0x180 [ 3255.556845][ T2822] __x64_sys_ioctl+0x6f/0xb0 [ 3255.561445][ T2822] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3255.566559][ T2822] do_syscall_64+0x60/0xe0 [ 3255.570976][ T2822] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3255.576865][ T2822] RIP: 0033:0x45cba9 [ 3255.580751][ T2822] Code: Bad RIP value. [ 3255.584818][ T2822] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 22:01:08 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3255.593231][ T2822] RAX: ffffffffffffffda RBX: 00000000004e85c0 RCX: 000000000045cba9 [ 3255.601217][ T2822] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000004 [ 3255.609204][ T2822] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3255.617176][ T2822] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 3255.625152][ T2822] R13: 00000000000003a3 R14: 00000000004c652f R15: 00007f48031b46d4 [ 3255.670742][ T2822] Mem-Info: [ 3255.674052][ T2822] active_anon:399635 inactive_anon:10289 isolated_anon:0 [ 3255.674052][ T2822] active_file:4701 inactive_file:26489 isolated_file:0 [ 3255.674052][ T2822] unevictable:0 dirty:165 writeback:0 [ 3255.674052][ T2822] slab_reclaimable:22477 slab_unreclaimable:316221 [ 3255.674052][ T2822] mapped:63441 shmem:10516 pagetables:59470 bounce:0 [ 3255.674052][ T2822] free:626286 free_pcp:493 free_cma:0 [ 3255.746489][ T2822] Node 0 active_anon:1315176kB inactive_anon:16508kB active_file:12kB inactive_file:20kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:217120kB dirty:8kB writeback:0kB shmem:17396kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 1003520kB writeback_tmp:0kB all_unreclaimable? no [ 3255.777330][ T2908] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3255.785383][ T2822] Node 1 active_anon:283364kB inactive_anon:24648kB active_file:18792kB inactive_file:105936kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:36644kB dirty:652kB writeback:0kB shmem:24668kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 3255.925364][ T2822] Node 0 DMA free:10128kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:2976kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:140kB pagetables:500kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3255.967659][ T2908] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3256.032901][ T2822] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 3256.045701][ T2822] Node 0 DMA32 free:28400kB min:74828kB low:83804kB high:92780kB reserved_highatomic:2048KB active_anon:1312200kB inactive_anon:16508kB active_file:12kB inactive_file:20kB unevictable:0kB writepending:8kB present:3129332kB managed:2578196kB mlocked:0kB kernel_stack:22576kB pagetables:50772kB bounce:0kB free_pcp:716kB local_pcp:240kB free_cma:0kB [ 3256.148309][ T2822] lowmem_reserve[]: 0 0 0 0 0 [ 3256.153058][ T2822] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3256.194329][ T2822] lowmem_reserve[]: 0 0 0 0 0 [ 3256.199236][ T2822] Node 1 Normal free:2466100kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:283564kB inactive_anon:24648kB active_file:18792kB inactive_file:105936kB unevictable:0kB writepending:504kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:58024kB pagetables:186608kB bounce:0kB free_pcp:2204kB local_pcp:944kB free_cma:0kB [ 3256.249471][ T2822] lowmem_reserve[]: 0 0 0 0 0 [ 3256.254210][ T2822] Node 0 DMA: 16*4kB (UME) 4*8kB (UM) 17*16kB (UME) 9*32kB (U) 6*64kB (UE) 1*128kB (U) 1*256kB (E) 1*512kB (E) 2*1024kB (ME) 3*2048kB (UME) 0*4096kB = 10128kB [ 3256.277171][ T2822] Node 0 DMA32: 1790*4kB (MEH) 1339*8kB (UMEH) 468*16kB (UMEH) 89*32kB (UMEH) 3*64kB (ME) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 28400kB [ 3256.315789][ T2822] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 3256.333255][ T2822] Node 1 Normal: 45*4kB (UME) 157*8kB (UME) 35*16kB (UE) 20*32kB (UE) 6*64kB (UE) 1*128kB (U) 2*256kB (UM) 1*512kB (U) 1*1024kB (M) 2*2048kB (U) 600*4096kB (UM) = 2466892kB [ 3256.351031][ T2822] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3256.388014][ T2822] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3256.406299][ T2822] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3256.416879][ T2822] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3256.427058][ T2822] 22953 total pagecache pages [ 3256.431748][ T2822] 0 pages in swap cache [ 3256.437029][ T2822] Swap cache stats: add 0, delete 0, find 0/0 [ 3256.443140][ T2822] Free swap = 0kB [ 3256.447988][ T2822] Total swap = 0kB [ 3256.451778][ T2822] 1965979 pages RAM [ 3256.456882][ T2822] 0 pages HighMem/MovableOnly [ 3256.461600][ T2822] 349903 pages reserved [ 3256.466994][ T2822] 0 pages cma reserved 22:01:09 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:09 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000374000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:09 executing program 0: socket$packet(0x11, 0x0, 0x300) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000780)={@in={{0x2, 0x0, @local}}, 0x0, 0x9, 0x6}, 0xd8) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x5, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r0, &(0x7f0000000600)=ANY=[@ANYRESDEC, @ANYRESDEC], 0x1000001bd) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 22:01:09 executing program 2: 22:01:09 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 3257.668975][ T2938] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:10 executing program 2: 22:01:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 3257.782377][ T2930] XFS (loop5): realtime geometry sanity check failed [ 3257.791759][ T2930] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3257.820021][ T2930] XFS (loop5): Unmount and run xfs_repair [ 3257.827927][ T2930] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3257.836500][ T2930] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:01:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3257.896272][ T2930] 00000010: 00 00 00 00 00 00 03 74 00 00 00 00 00 00 00 00 .......t........ [ 3257.943861][ T2930] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3257.954170][ T2962] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:10 executing program 2: [ 3258.010334][ T2930] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3258.083640][ T2930] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:01:10 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 3258.135415][ T2930] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:01:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3258.179857][ T2930] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3258.229655][ T2930] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3258.256416][ T2982] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3258.288811][ T2930] XFS (loop5): SB validate failed with error -117. 22:01:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:01:13 executing program 2: 22:01:13 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:13 executing program 0: 22:01:13 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000000000000007a000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:13 executing program 2: 22:01:13 executing program 0: r0 = creat(&(0x7f00000002c0)='./file1\x00', 0x0) setns(0xffffffffffffffff, 0x0) fdatasync(r0) syz_genetlink_get_family_id$devlink(0x0) sched_setscheduler(0x0, 0x0, 0x0) [ 3260.719768][ T3006] __nla_validate_parse: 1 callbacks suppressed [ 3260.719782][ T3006] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 3260.820799][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3260.850353][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3260.933602][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3260.968619][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:01:13 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0xcdd, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f00000003c0)=ANY=[@ANYBLOB="070f29fd"]) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 3261.009527][ T3014] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3261.012095][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:01:13 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket(0x10, 0x80002, 0x0) writev(r2, &(0x7f0000000600)=[{&(0x7f0000000040)="3100000013000900690006342fc56aef40be44081000000046000107000000540d0003c02564daf0bd6239d79d8f25459f", 0x31}], 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 22:01:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) ioctl$KVM_RUN(r2, 0xae80, 0x0) 22:01:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3261.075543][ T2595] 00000010: 00 00 00 00 00 00 00 7a 00 00 00 00 00 00 00 00 .......z........ [ 3261.135309][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3261.171412][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3261.210613][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3261.211256][ T3053] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.0'. [ 3261.240114][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3261.277618][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3261.297221][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3261.314889][ T3055] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3261.345137][ T3007] XFS (loop5): SB validate failed with error -117. 22:01:13 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) [ 3261.455472][ T3053] netlink: 1 bytes leftover after parsing attributes in process `syz-executor.0'. [ 3261.494418][ T3055] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:16 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:16 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='ramfs\x00', 0x0, 0x0) chdir(&(0x7f0000000280)='./file0\x00') r2 = open(&(0x7f0000000140)='./bus\x00', 0x159042, 0x0) write$UHID_INPUT(r2, &(0x7f0000001440), 0xfffffc41) fadvise64(r2, 0x0, 0x0, 0x4) 22:01:16 executing program 0: clone(0x2102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigsuspend(&(0x7f00000000c0), 0x8) 22:01:16 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) 22:01:16 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000080000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3263.809924][ T3099] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:16 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) [ 3263.933077][ T9252] XFS (loop5): realtime geometry sanity check failed [ 3263.970357][ T9252] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3264.019445][ T9252] XFS (loop5): Unmount and run xfs_repair [ 3264.032327][ T9252] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3264.043571][ T9252] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3264.066438][ T9252] 00000010: 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 ................ [ 3264.083366][ T9252] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3264.101896][ T9252] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3264.135641][ T9252] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:01:16 executing program 2: syz_mount_image$vfat(&(0x7f0000000440)='vfat\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x2, &(0x7f0000000040)=[{&(0x7f0000000140)="eb3c906d6b66732e666174000204010002000270fff8f27b", 0x18}, {&(0x7f0000000a80)="e744df7230d9627318729511681067c7654b695f41d862c01eb9306d87208d7abf3a722417b3b3572d72ed6c8ac46840f02aa8ce737bdeec7f2c46ef109ece60c40eb71599854b37c6ed2a3acc58a61080426e086f92ac8522e7245df293772ebf2093bd670a553714ac153028d5706dbb32b002d11ca3ae0d877415ec3b3961c7918e5806e5990d8faae8afde2303111c54b609654e4ab6d764db80ee42cd34dd1726f57353daf8a5ab97150b5844ca3b6e928dae517e8c838a7a5897b8f42fd376401e9f040c830fac64eae1bb7715b845f6e710f9940940d288226c6bff9c3c0321afca4ac9eddf0055d95008d94845f2588ed442a24fcd2f0f77ceba3f892b0c88bf82b4beedb42bf4155ece987808ee561de56007604dc8f848714b8af4417d65fa7d7f16be29ba3925681f1a032eabbae26e918ca1fbe102a3c8ca0f7b925c7612921d9ff2408002bc1a60ee04d896c4468ac394018b65e7f5fdd884e15d88c1947435fd52fc12dac76be19d54a85a0617e5a79279b364474d9145ae4aec", 0x181, 0x7f}], 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 3264.185066][ T9252] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:01:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3264.234038][ T9252] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3264.251821][ T9252] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3264.263599][ T3096] XFS (loop5): SB validate failed with error -117. 22:01:16 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 22:01:16 executing program 2: sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000280)=ANY=[], 0x1) fallocate(0xffffffffffffffff, 0x3, 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) recvmmsg(r1, &(0x7f0000005540)=[{{0x0, 0xe0040000, &(0x7f0000000240)=[{&(0x7f0000001340)=""/4067, 0x20002323}], 0x4, 0x0, 0x2000000, 0x1f4}}], 0x1, 0x100, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000600), 0x4) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967480a41ba7860f46ef65ac618ded8974895abeaf4b4834ffa22b3f1e0b02bd67aa03059bcecc7a95c25a34ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0xc091, 0x0, 0xf7) r2 = open(0x0, 0x40c5, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(0xffffffffffffffff, 0xc004aea7, &(0x7f0000000000)) write$9p(0xffffffffffffffff, 0x0, 0x0) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$TIOCSERGETLSR(r2, 0x5459, &(0x7f0000000080)) [ 3264.402899][ T3147] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:17 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 22:01:19 executing program 0: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x110) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x807284, 0x0) r1 = open(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000080), 0x12) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, 0x0) 22:01:19 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:19 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000180000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:19 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket(0x1, 0x5, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) setresuid(0x0, r3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x15) 22:01:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:19 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) [ 3266.890889][ T3196] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3266.961428][ T3192] XFS (loop5): realtime geometry sanity check failed [ 3266.969660][ T3192] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3266.988195][ T3193] warn_alloc: 10 callbacks suppressed [ 3266.988371][ T3193] syz-executor.1: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3267.078213][ T3192] XFS (loop5): Unmount and run xfs_repair 22:01:19 executing program 0: getpid() r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000740)={0x3, 0x2, 0xf000, 0x1000, &(0x7f0000000000/0x1000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket(0x11, 0x800000003, 0x0) [ 3267.146239][ T3192] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3267.187890][ T3193] CPU: 0 PID: 3193 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3267.196779][ T3193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3267.206844][ T3193] Call Trace: [ 3267.210151][ T3193] dump_stack+0x18f/0x20d [ 3267.210643][ T3192] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3267.214513][ T3193] warn_alloc.cold+0x87/0x17a [ 3267.214538][ T3193] ? zone_watermark_ok_safe+0x260/0x260 [ 3267.214572][ T3193] ? wait_for_completion+0x260/0x260 [ 3267.214601][ T3193] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 [ 3267.245560][ T3193] ? warn_alloc+0x120/0x120 [ 3267.250083][ T3193] ? __alloc_pages_nodemask+0x3e5/0x930 [ 3267.255653][ T3193] ? lock_is_held_type+0xb0/0xe0 [ 3267.260613][ T3193] ? find_held_lock+0x2d/0x110 [ 3267.265400][ T3193] __alloc_pages_nodemask+0x68f/0x930 [ 3267.270801][ T3193] ? __zone_watermark_ok+0x370/0x370 [ 3267.276149][ T3193] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3267.282976][ T3193] ? lock_is_held_type+0xb0/0xe0 [ 3267.287974][ T3193] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 3267.293573][ T3193] ? __alloc_pages_nodemask+0x6b1/0x930 [ 3267.299174][ T3193] alloc_pages_current+0x187/0x280 [ 3267.304321][ T3193] alloc_mmu_pages+0x7f/0x170 [ 3267.309454][ T3193] kvm_mmu_create+0x3cb/0x560 [ 3267.314152][ T3193] kvm_arch_vcpu_create+0x16d/0xb70 [ 3267.319366][ T3193] kvm_vm_ioctl+0x1547/0x23c0 [ 3267.324051][ T3193] ? lock_downgrade+0x820/0x820 [ 3267.325372][ T3192] 00000010: 00 00 00 00 00 00 01 80 00 00 00 00 00 00 00 00 ................ [ 3267.328906][ T3193] ? kvm_unregister_device_ops+0x60/0x60 [ 3267.328924][ T3193] ? trace_hardirqs_on+0x5f/0x220 [ 3267.328943][ T3193] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3267.328966][ T3193] ? tomoyo_path_number_perm+0x244/0x4d0 [ 3267.328984][ T3193] ? tomoyo_execute_permission+0x470/0x470 [ 3267.329008][ T3193] ? __lockdep_free_key_range+0x110/0x110 [ 3267.370806][ T3193] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 3267.376716][ T3193] ? do_vfs_ioctl+0x27d/0x1090 [ 3267.381490][ T3193] ? generic_block_fiemap+0x60/0x60 [ 3267.386707][ T3193] ? selinux_inode_getsecctx+0x90/0x90 [ 3267.392175][ T3193] ? __might_fault+0x190/0x1d0 [ 3267.396957][ T3193] ? _copy_to_user+0x126/0x160 [ 3267.401743][ T3193] ? __fget_files+0x294/0x400 [ 3267.406445][ T3193] ? kvm_unregister_device_ops+0x60/0x60 [ 3267.412091][ T3193] ksys_ioctl+0x11a/0x180 [ 3267.416433][ T3193] __x64_sys_ioctl+0x6f/0xb0 [ 3267.421038][ T3193] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3267.426180][ T3193] do_syscall_64+0x60/0xe0 [ 3267.430602][ T3193] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3267.436499][ T3193] RIP: 0033:0x45cba9 [ 3267.440385][ T3193] Code: Bad RIP value. [ 3267.444453][ T3193] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3267.452895][ T3193] RAX: ffffffffffffffda RBX: 00000000004e85c0 RCX: 000000000045cba9 [ 3267.456230][ T3192] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3267.460868][ T3193] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000004 [ 3267.460878][ T3193] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3267.460886][ T3193] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 3267.460896][ T3193] R13: 00000000000003a3 R14: 00000000004c652f R15: 00007f48031b46d4 22:01:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:20 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0xa00, 0x0) ioctl$BLKPG(r2, 0x932, 0x0) [ 3267.638086][ T3192] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3267.679762][ T3254] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3267.694863][ T3192] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3267.729902][ T3192] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3267.762675][ T3193] Mem-Info: [ 3267.769389][ T3192] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3267.770590][ T3193] active_anon:399703 inactive_anon:10310 isolated_anon:0 [ 3267.770590][ T3193] active_file:4772 inactive_file:26502 isolated_file:0 [ 3267.770590][ T3193] unevictable:0 dirty:114 writeback:0 [ 3267.770590][ T3193] slab_reclaimable:22763 slab_unreclaimable:315827 [ 3267.770590][ T3193] mapped:63633 shmem:10563 pagetables:59559 bounce:0 [ 3267.770590][ T3193] free:625467 free_pcp:865 free_cma:0 [ 3267.816319][ T3192] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:01:20 executing program 2: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000019500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd8, 0xd8, 0x4, [@const, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {0x0, 0x1}, {}]}, @union={0x0, 0x9, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}]}, @ptr]}, {0x0, [0x0, 0x0]}}, 0x0, 0xf4}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3267.816365][ T3192] XFS (loop5): SB validate failed with error -117. [ 3267.856930][ T3265] md: md0 stopped. [ 3267.891014][ T3193] Node 0 active_anon:1315196kB inactive_anon:16508kB active_file:4kB inactive_file:8kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:217120kB dirty:8kB writeback:0kB shmem:17396kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 1003520kB writeback_tmp:0kB all_unreclaimable? no [ 3267.925293][ T3270] ptrace attach of "/root/syz-executor.2"[3268] was attempted by "/root/syz-executor.2"[3270] 22:01:20 executing program 2: [ 3267.929738][ T3193] Node 1 active_anon:283716kB inactive_anon:24732kB active_file:19084kB inactive_file:106000kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:37412kB dirty:448kB writeback:0kB shmem:24756kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 3267.971741][ T3258] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3268.035295][ T3281] md: md0 stopped. 22:01:20 executing program 2: [ 3268.080114][ T3193] Node 0 DMA free:10128kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:2976kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:140kB pagetables:500kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3268.166353][ T3193] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 3268.172478][ T3193] Node 0 DMA32 free:27168kB min:35916kB low:44892kB high:53868kB reserved_highatomic:2048KB active_anon:1312220kB inactive_anon:16508kB active_file:4kB inactive_file:8kB unevictable:0kB writepending:8kB present:3129332kB managed:2578196kB mlocked:0kB kernel_stack:22576kB pagetables:50772kB bounce:0kB free_pcp:936kB local_pcp:468kB free_cma:0kB [ 3268.207053][ T3193] lowmem_reserve[]: 0 0 0 0 0 [ 3268.212072][ T3193] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 22:01:20 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000084000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3268.333085][ T3193] lowmem_reserve[]: 0 0 0 0 0 [ 3268.346001][ T3193] Node 1 Normal free:2463832kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:283816kB inactive_anon:24732kB active_file:19084kB inactive_file:106000kB unevictable:0kB writepending:448kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:58008kB pagetables:186964kB bounce:0kB free_pcp:2776kB local_pcp:1516kB free_cma:0kB [ 3268.397126][ T3193] lowmem_reserve[]: 0 0 0 0 0 [ 3268.402087][ T3193] Node 0 DMA: 16*4kB (UME) 4*8kB (UM) 17*16kB (UME) 9*32kB (U) 6*64kB (UE) 1*128kB (U) 1*256kB (E) 1*512kB (E) 2*1024kB (ME) 3*2048kB (UME) 0*4096kB = 10128kB [ 3268.423809][ T3193] Node 0 DMA32: 1784*4kB (UMEH) 1200*8kB (UMEH) 460*16kB (UMEH) 89*32kB (UMEH) 3*64kB (ME) 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 27136kB [ 3268.435346][ T3290] XFS (loop5): realtime geometry sanity check failed [ 3268.461820][ T3290] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3268.464006][ T3193] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 3268.480463][ T3290] XFS (loop5): Unmount and run xfs_repair [ 3268.488204][ T3193] Node 1 Normal: 219*4kB (UME) 78*8kB (UM) 73*16kB (UME) 22*32kB (UME) 24*64kB (UME) 17*128kB (UM) 11*256kB (UM) 8*512kB (UM) 3*1024kB (ME) 3*2048kB (UE) 596*4096kB (UM) = 2464428kB [ 3268.491153][ T3290] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3268.491169][ T3290] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3268.491189][ T3290] 00000010: 00 00 00 00 00 00 00 84 00 00 00 00 00 00 00 00 ................ [ 3268.491202][ T3290] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3268.491213][ T3290] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3268.491229][ T3290] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3268.521165][ T3193] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3268.526729][ T3290] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3268.543795][ T3193] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3268.552789][ T3290] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3268.552803][ T3290] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3268.552864][ T3290] XFS (loop5): SB validate failed with error -117. [ 3268.614896][ T3193] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3268.624466][ T3193] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3268.635355][ T3193] 23050 total pagecache pages [ 3268.640053][ T3193] 0 pages in swap cache [ 3268.644202][ T3193] Swap cache stats: add 0, delete 0, find 0/0 [ 3268.651954][ T3193] Free swap = 0kB [ 3268.656381][ T3193] Total swap = 0kB [ 3268.660110][ T3193] 1965979 pages RAM [ 3268.663911][ T3193] 0 pages HighMem/MovableOnly [ 3268.670389][ T3193] 349903 pages reserved [ 3268.674547][ T3193] 0 pages cma reserved [ 3268.842620][ T3290] XFS (loop5): realtime geometry sanity check failed [ 3268.849698][ T3290] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3268.862869][ T3290] XFS (loop5): Unmount and run xfs_repair [ 3268.869308][ T3290] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3268.877549][ T3290] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3268.887684][ T3290] 00000010: 00 00 00 00 00 00 00 84 00 00 00 00 00 00 00 00 ................ [ 3268.897468][ T3290] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3268.907547][ T3290] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3268.917226][ T3290] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3268.928373][ T3290] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3268.939413][ T3290] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3268.949078][ T3290] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3268.958825][ T3290] XFS (loop5): SB validate failed with error -117. 22:01:22 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:22 executing program 2: 22:01:22 executing program 0: 22:01:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:22 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 22:01:22 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000085000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:22 executing program 0: [ 3269.963964][ T3322] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:22 executing program 2: [ 3270.096570][ T3331] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:22 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) [ 3270.150307][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3270.168087][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3270.186237][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3270.193215][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:01:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3270.201028][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3270.210454][ T3182] 00000010: 00 00 00 00 00 00 00 85 00 00 00 00 00 00 00 00 ................ [ 3270.220714][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3270.233238][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3270.242468][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3270.251735][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3270.260900][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3270.270100][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3270.279827][ T3325] XFS (loop5): SB validate failed with error -117. 22:01:22 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) write$tun(r0, &(0x7f00000002c0)={@void, @val, @mpls={[], @ipv4=@gre={{0x5, 0x4, 0x0, 0x0, 0x5d, 0x0, 0x0, 0x0, 0x6, 0x0, @dev, @empty=0xffffffff}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x880b, 0x1, 0x0, [0x0, 0x0], "f5"}, {0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x21}, {}, {0x8, 0x88be, 0x0, {{}, 0x5700}}, {0x2c}}}}}, 0xfdef) [ 3270.426361][ T3356] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:22 executing program 2: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x3}, 0x0) r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) sched_setscheduler(0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x80000101005, 0x0) listen(r0, 0x1d7) r1 = socket$inet_sctp(0x2, 0x801, 0x84) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg(r1, &(0x7f0000000180)={&(0x7f00000009c0)=@in={0x2, 0x4e23, @local}, 0x80, &(0x7f0000000980)=[{&(0x7f0000000a40)="b2", 0x25}], 0x1, 0x0, 0x0, 0x9000004}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000200)="69b194da93e54177477fd4124dfd737e84bbbae45d49319d958dd24f4a7d8e8258496be2280c583e5f1380db06746ed557effe2bff2cec232c8a3fc13cde2a67d83e73715cb79b82746a48a417624395b3eab4087ee37906e565dd5a048d7ddcc202e0e4a7b831e070de23833dd1b4a62bf94e0916fd4c5fe678455383a2bc919882b506210e19c80728e1b39f46a972b03bec1b030d431ce544c8e72b7c47aa013444c6c6c4db9e42f7a253301e5b21e0d156527ae4b1983f42f5b3", 0xbc}, {&(0x7f00000002c0)="4f5c856ad891368811307df5cdda6927d10d11bcd32e2d5d4f91d626a0bfaaa9e6965c41d2fd8e100fb72859fc350b8850edeab0750464db6566caf9beb9b4e179ff8ff6f526b68b2c907a915ed2e6db7f59b1111fdf6e60a35e15c3498dafac3b797ad9b31285654374155b6407a1785ddb2f99d80cb980c684217ee6bb2e7dc172caad1660583f0eab5d72d48f08e1a71dadc4d3f283b6b297fddc928b136c116098439b777cf77c51fc8c199572f2181c0a98a6b078d28c8c2cc94692e4a93f7a40f394937aa51d6e8d1353365d09b3eaa1b8fd1fd4fc84f5b69e736ee4705f0fb5f17390b8f015a00226020e6dcbc1361d", 0xf3}], 0x2, 0xd) fsetxattr(r2, &(0x7f0000000000)=@random={'security.', ']\x00'}, &(0x7f0000000040)=')\'[-%/(^!]\x00', 0xb, 0x4) [ 3270.625888][ T9252] XFS (loop5): realtime geometry sanity check failed [ 3270.632950][ T9252] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3270.672407][ T9252] XFS (loop5): Unmount and run xfs_repair [ 3270.687741][ T3364] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3270.706128][ T9252] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3270.737185][ T9252] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3270.762129][ T9252] 00000010: 00 00 00 00 00 00 00 85 00 00 00 00 00 00 00 00 ................ [ 3270.785855][ T9252] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3270.842263][ T9252] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3270.909672][ T9252] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3270.963428][ T9252] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3270.973285][ T9252] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3270.986974][ T9252] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3270.996760][ T3325] XFS (loop5): SB validate failed with error -117. 22:01:25 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:25 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 22:01:25 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000000ff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:25 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:01:25 executing program 0: inotify_init() syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x200, 0x0) syz_open_dev$vcsa(&(0x7f0000000200)='/dev/vcsa#\x00', 0x2, 0x0) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x12, 0x5, 0x8, 0x6, 0x0, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x40) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f00000006c0)=0x2000000000000001, 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000001c0)='syz_tun\x00', 0x10) connect$inet(r1, &(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000080)={r0, &(0x7f0000000340), &(0x7f0000000100)=@tcp=r1}, 0x20) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f0000000140)={0x1ff}, 0x0, 0x0) 22:01:25 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000ffffff8b000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3273.062243][ T3445] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:25 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 3273.134409][ T3447] XFS (loop5): realtime geometry sanity check failed [ 3273.143763][ T3447] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3273.172261][ T3447] XFS (loop5): Unmount and run xfs_repair 22:01:25 executing program 0: syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000000)="0201a6ff0a004552ff45", 0xa, 0x1c0}]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 3273.194410][ T3447] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3273.203691][ T3447] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3273.214007][ T3447] 00000010: 00 00 00 00 ff ff ff 8b 00 00 00 00 00 00 00 00 ................ [ 3273.223941][ T3447] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3273.233832][ T3447] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:01:25 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 3273.243912][ T3447] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3273.256853][ T3447] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3273.298014][ T3447] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3273.317276][ T3465] Dev loop0: unable to read RDB block 1 [ 3273.327346][ T3465] loop0: AHDI p1 22:01:25 executing program 1: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) [ 3273.341220][ T3447] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3273.353240][ T3465] loop0: partition table partially beyond EOD, truncated [ 3273.366921][ T3453] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3273.403876][ T3447] XFS (loop5): SB validate failed with error -117. 22:01:25 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000ffffffffff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:25 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3273.596961][ T3485] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3273.681567][ T3485] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3273.792114][ T3447] XFS (loop5): realtime geometry sanity check failed [ 3273.799122][ T3447] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3273.812065][ T3447] XFS (loop5): Unmount and run xfs_repair [ 3273.818508][ T3447] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3273.827785][ T3447] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3273.837300][ T3447] 00000010: 00 00 00 00 ff ff ff 8b 00 00 00 00 00 00 00 00 ................ [ 3273.846736][ T3447] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3273.856352][ T3447] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3273.866042][ T3447] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3273.875448][ T3447] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3273.884442][ T3447] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3273.893904][ T3447] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3273.903299][ T3447] XFS (loop5): SB validate failed with error -117. 22:01:28 executing program 0: syz_read_part_table(0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000000000)="0201a6ff0a004552ff45", 0xa, 0x1c0}]) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 22:01:28 executing program 1: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) 22:01:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:28 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000ffffff8c000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:28 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:28 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:01:28 executing program 1: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) [ 3276.188891][ T3518] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3276.198799][ T3512] Dev loop0: unable to read RDB block 1 [ 3276.204523][ T3512] loop0: AHDI p1 [ 3276.220975][ T3512] loop0: partition table partially beyond EOD, truncated [ 3276.261351][ T3515] XFS (loop5): realtime geometry sanity check failed [ 3276.268649][ T3515] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3276.287004][ T3515] XFS (loop5): Unmount and run xfs_repair 22:01:28 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3276.324027][ T3515] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3276.378037][ T3515] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3276.406608][ T3515] 00000010: 00 00 00 00 ff ff ff 8c 00 00 00 00 00 00 00 00 ................ [ 3276.416734][ T3515] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3276.428441][ T3515] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3276.438622][ T3515] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3276.448576][ T3515] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3276.458560][ T3515] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3276.468637][ T3515] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:01:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) [ 3276.479318][ T3515] XFS (loop5): SB validate failed with error -117. [ 3276.515612][ T3527] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:28 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000100)=0xd) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$inet(0xa, 0x3, 0x3) r6 = dup2(r4, r5) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = dup2(r7, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) dup2(r3, r6) syz_kvm_setup_cpu$x86(r6, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 22:01:28 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 22:01:29 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) [ 3276.805094][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3276.815262][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3276.828505][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3276.834417][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3276.842408][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3276.851890][ T3182] 00000010: 00 00 00 00 ff ff ff 8c 00 00 00 00 00 00 00 00 ................ [ 3276.861287][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3276.870657][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3276.887404][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3276.896780][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:01:29 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) 22:01:29 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3276.906172][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3276.915988][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3276.927098][ T3515] XFS (loop5): SB validate failed with error -117. 22:01:29 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3277.117675][ T3590] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3277.285058][ T3590] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:31 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f", 0x1}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:31 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) 22:01:31 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x121041) write$evdev(r0, &(0x7f00000000c0)=[{{}, 0x4, 0x101}], 0x10) 22:01:31 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000292000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:31 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:31 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3279.236851][ T3616] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:31 executing program 1: openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) [ 3279.299166][ T3614] XFS (loop5): realtime geometry sanity check failed [ 3279.313189][ T3614] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:01:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 3279.364263][ T3614] XFS (loop5): Unmount and run xfs_repair [ 3279.386992][ T3614] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3279.406533][ T3614] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:01:31 executing program 0: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000016c0)=ANY=[@ANYBLOB="1802000000000000000000000001000085000000170000009500b0df000000005882b5f04138e0dd81a2068ca29b5e6e498f4f49f5d712099ac3647a6e59c137444a7a7f8f7e16faf795fab6057514aa3f8e02000000000000007039b0936ff7d86b648892f919a9003ce578497bc1dcd5fdb11d652ee7b5e8ba477be571e2a78f51018fac8bcbd141090f08597b633629b94e6fc2930a2a9479d430ca2fa71f17b5e0fb3d31509d5b208e70a2c3a20bd7ba15940900000000000000e7ac03bcac03371979e54eb1c3837912cbeef206c77e0bb565e52a4f1df85fd5754d961cdc17959253811c95df4fd1a19945a8ca7ce331c23b336adfa1fa00f0442be910c07833c2d17e9ec0178e5cf98e6a350d031e05a8c8c9b2d7851df23526b77561efc022d744c77c82eda1a3d63949b16ca2390600000000000000a557c5f23c80cfecc0aff9b14e45f16b4b0907e992ed8174dd14f1eb2a1effc3f9197359b7553527eb4533ab9ec458bb31e4705e93338f6d9c1e8b6e73798b5cbc2e0223540200351ba5cfa4bb0be3c6bfab329e607b54b6000000df5d84bd6dc77ed3d5488b9807bdc3a6d9284d24661ce4d6d4fbf4bb25c745fe60d6b4bff613214dbe0982c7c2a8396c3675cbf3bf659560ea30bcc30a8c12460cb3d02eee708103a23fa7b68d107394807d8c7374ef4f1606253d238cfc369896c8dd748e14e535e5631c233ed0c787e515932677d59ca96e27218581407ea2a63feaa976461805d310f70ae30091ef0bc55d2c4e8c6acdc073d2ba366bb8575697d51e1d72a20a107b72c1f352fc1803c0fa4abbf36549dc6e3b712c492e54114b19b018b543a07abae1e5f656"], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x3b) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xc00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 22:01:31 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) [ 3279.455531][ T3614] 00000010: 00 00 00 00 00 00 02 92 00 00 00 00 00 00 00 00 ................ [ 3279.478030][ T3614] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3279.532324][ T3616] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3279.547272][ T3614] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3279.567370][ T3614] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:01:32 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3279.594566][ T3614] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3279.619195][ T3614] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:01:32 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3279.650384][ T3614] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3279.712996][ T3614] XFS (loop5): SB validate failed with error -117. [ 3279.758415][ T3660] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:34 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f", 0x1}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:34 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 22:01:34 executing program 0: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) io_setup(0x83, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, 0x0, 0x0) r1 = socket(0x10, 0x800, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000740)={0x0}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000180)={@mcast1, @dev, @dev={0xfe, 0x80, [], 0x1f}, 0x68b0, 0x0, 0x5, 0x0, 0xfff, 0x42a00000}) r2 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002) write(r2, &(0x7f0000000340)="b63db85e000000210000000000000000007063bf0fbb069c8da9ce2be9fb42072f04f478eaa7e7d41226c1f3f604d4c1926fad3636003b5ecd0bd48f4835f70c9db983b08879b4d03a8b33b351c4e30120ff588ce431472fe017161d72420c427ff52f286fc89f1264d20223279e92ec002d32048658a7792a69a5e9c795eea92210c747c45636c0eb9ebaf41f907a9b8cc5a4f112ab73ef48c94b5b1844e576ebb80d1bce66ef6b408b6ef0d96b1b153ccbdb755190039a4458a4b55b1cb1c3208a66d79318f35197f3a2d2b2328de54d5bbf982b3c3508878e72e0233b7d3d2bbfc32bfe3a230815f82bbed27e134a220d3faa1fcefb09", 0xf8) readv(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000000100)={0x0, 0xf6, &(0x7f00000000c0)=[{&(0x7f0000000200)="5500000018007fd500fe01b2a4d180930a06000000a843089100fe803900080008000a0000dc13382d0010009b7a136ef75afbc9bff7de5cf25fa8e183f5448daa72540d8102d2c55327c43ab82286ef1fdd206523", 0x55}], 0x1}, 0x0) r4 = socket(0x10, 0x802, 0x0) r5 = dup3(r4, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 22:01:34 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:34 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:01:34 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000001b0000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3282.329920][ T3697] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3282.349851][ T3702] sg_write: data in/out 553648092/202 bytes for SCSI command 0xea-- guessing data in; [ 3282.349851][ T3702] program syz-executor.0 not setting count and/or reply_len properly 22:01:34 executing program 1: perf_event_open(&(0x7f0000000440)={0x2, 0x70, 0xa3, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_FREEZE(0x16, 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000080)={{0x0, @broadcast, 0x0, 0x0, 'lblcr\x00', 0x0, 0x1}, {@empty}}, 0x44) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f0000000380)='./file0\x00', 0x1000000, 0x1, &(0x7f0000000000)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000204010002000270fff8", 0x268}], 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f00000003c0)='./bus\x00', 0x0) getsockopt$IPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x40, 0x0, &(0x7f0000000100)) setrlimit(0x0, 0x0) lseek(r1, 0x4200, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x141042, 0x0) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000140)="bf", 0x1}], 0x1) r3 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) ioctl$RTC_UIE_OFF(0xffffffffffffffff, 0x7004) sendfile(r1, r3, 0x0, 0x8400fffffffb) bind$alg(0xffffffffffffffff, 0x0, 0x0) [ 3282.396479][ T9252] XFS (loop5): realtime geometry sanity check failed [ 3282.431022][ T9252] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3282.517497][ T9252] XFS (loop5): Unmount and run xfs_repair [ 3282.532579][ T3697] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:35 executing program 0: perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) io_setup(0x83, 0x0) r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, 0x0, 0x0) r1 = socket(0x10, 0x800, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000740)={0x0}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000180)={@mcast1, @dev, @dev={0xfe, 0x80, [], 0x1f}, 0x68b0, 0x0, 0x5, 0x0, 0xfff, 0x42a00000}) r2 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x0, 0x10008002) write(r2, &(0x7f0000000340)="b63db85e000000210000000000000000007063bf0fbb069c8da9ce2be9fb42072f04f478eaa7e7d41226c1f3f604d4c1926fad3636003b5ecd0bd48f4835f70c9db983b08879b4d03a8b33b351c4e30120ff588ce431472fe017161d72420c427ff52f286fc89f1264d20223279e92ec002d32048658a7792a69a5e9c795eea92210c747c45636c0eb9ebaf41f907a9b8cc5a4f112ab73ef48c94b5b1844e576ebb80d1bce66ef6b408b6ef0d96b1b153ccbdb755190039a4458a4b55b1cb1c3208a66d79318f35197f3a2d2b2328de54d5bbf982b3c3508878e72e0233b7d3d2bbfc32bfe3a230815f82bbed27e134a220d3faa1fcefb09", 0xf8) readv(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r3, &(0x7f0000000100)={0x0, 0xf6, &(0x7f00000000c0)=[{&(0x7f0000000200)="5500000018007fd500fe01b2a4d180930a06000000a843089100fe803900080008000a0000dc13382d0010009b7a136ef75afbc9bff7de5cf25fa8e183f5448daa72540d8102d2c55327c43ab82286ef1fdd206523", 0x55}], 0x1}, 0x0) r4 = socket(0x10, 0x802, 0x0) r5 = dup3(r4, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 3282.558190][ T9252] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3282.571686][ T28] audit: type=1804 audit(1594591294.966:208): pid=3724 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir356292184/syzkaller.3BWdCB/5522/bus" dev="sda1" ino=18249 res=1 22:01:35 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3282.651208][ T9252] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3282.699894][ T9252] 00000010: 00 00 00 00 00 00 01 b0 00 00 00 00 00 00 00 00 ................ 22:01:35 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3282.746289][ T9252] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3282.803056][ T9252] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3282.847101][ T3734] sg_write: data in/out 553648092/202 bytes for SCSI command 0xea-- guessing data in; [ 3282.847101][ T3734] program syz-executor.0 not setting count and/or reply_len properly [ 3282.848087][ T9252] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3282.940155][ T3743] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:35 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3282.984011][ T9252] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:01:35 executing program 0: r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x3, 0x0) ioctl$EVIOCSREP(r0, 0x80084503, &(0x7f0000000000)) [ 3283.033855][ T9252] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3283.074147][ T9252] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3283.127266][ T3693] XFS (loop5): SB validate failed with error -117. [ 3283.405142][ T28] audit: type=1804 audit(1594591295.796:209): pid=3762 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir356292184/syzkaller.3BWdCB/5522/bus" dev="sda1" ino=18249 res=1 [ 3283.533884][ T28] audit: type=1804 audit(1594591295.926:210): pid=3724 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir356292184/syzkaller.3BWdCB/5522/bus" dev="sda1" ino=18249 res=1 [ 3283.567646][ T28] audit: type=1804 audit(1594591295.956:211): pid=3767 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir356292184/syzkaller.3BWdCB/5522/bus" dev="sda1" ino=18249 res=1 22:01:37 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f", 0x1}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:37 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID(r2, 0x4008ae8a, &(0x7f0000000280)=ANY=[@ANYBLOB="030000000000000000000000000600007f00fa0000e3b3618bcfce08bb00000001000000000000006e394400ff"]) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000000000008b04"]) 22:01:37 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:37 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:01:37 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168b6000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:37 executing program 1: [ 3285.475015][ T3780] warn_alloc: 4 callbacks suppressed [ 3285.475040][ T3780] syz-executor.0: page allocation failure: order:0, mode:0x400cc4(GFP_KERNEL_ACCOUNT|GFP_DMA32), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 3285.516793][ T3805] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3285.546707][ T3780] CPU: 1 PID: 3780 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0 [ 3285.555330][ T3780] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3285.565387][ T3780] Call Trace: [ 3285.568703][ T3780] dump_stack+0x18f/0x20d [ 3285.573051][ T3780] warn_alloc.cold+0x87/0x17a [ 3285.577770][ T3780] ? zone_watermark_ok_safe+0x260/0x260 [ 3285.583370][ T3780] ? wait_for_completion+0x260/0x260 [ 3285.588686][ T3780] __alloc_pages_slowpath.constprop.0+0x2197/0x2780 [ 3285.595308][ T3780] ? warn_alloc+0x120/0x120 [ 3285.599822][ T3780] ? __alloc_pages_nodemask+0x3e5/0x930 [ 3285.605389][ T3780] ? lock_is_held_type+0xb0/0xe0 [ 3285.610343][ T3780] ? find_held_lock+0x2d/0x110 [ 3285.615131][ T3780] __alloc_pages_nodemask+0x68f/0x930 [ 3285.620610][ T3780] ? __zone_watermark_ok+0x370/0x370 [ 3285.625920][ T3780] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3285.632691][ T3780] ? lock_is_held_type+0xb0/0xe0 [ 3285.637649][ T3780] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 3285.643210][ T3780] ? __alloc_pages_nodemask+0x6b1/0x930 [ 3285.648840][ T3780] alloc_pages_current+0x187/0x280 [ 3285.653984][ T3780] alloc_mmu_pages+0x7f/0x170 [ 3285.658683][ T3780] kvm_mmu_create+0x3cb/0x560 [ 3285.663369][ T3780] kvm_arch_vcpu_create+0x16d/0xb70 [ 3285.668581][ T3780] kvm_vm_ioctl+0x1547/0x23c0 [ 3285.673269][ T3780] ? lock_downgrade+0x820/0x820 [ 3285.678144][ T3780] ? kvm_unregister_device_ops+0x60/0x60 [ 3285.683790][ T3780] ? trace_hardirqs_on+0x5f/0x220 [ 3285.688828][ T3780] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3285.693949][ T3780] ? tomoyo_path_number_perm+0x244/0x4d0 [ 3285.699673][ T3780] ? tomoyo_execute_permission+0x470/0x470 [ 3285.705495][ T3780] ? __lockdep_free_key_range+0x110/0x110 [ 3285.711236][ T3780] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 3285.717139][ T3780] ? do_vfs_ioctl+0x27d/0x1090 [ 3285.721908][ T3780] ? generic_block_fiemap+0x60/0x60 [ 3285.727111][ T3780] ? selinux_inode_getsecctx+0x90/0x90 [ 3285.732576][ T3780] ? __might_fault+0x190/0x1d0 [ 3285.737340][ T3780] ? _copy_to_user+0x126/0x160 [ 3285.742119][ T3780] ? __fget_files+0x294/0x400 [ 3285.746812][ T3780] ? kvm_unregister_device_ops+0x60/0x60 [ 3285.752447][ T3780] ksys_ioctl+0x11a/0x180 [ 3285.756779][ T3780] __x64_sys_ioctl+0x6f/0xb0 [ 3285.761373][ T3780] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3285.766486][ T3780] do_syscall_64+0x60/0xe0 [ 3285.770910][ T3780] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3285.776813][ T3780] RIP: 0033:0x45cba9 [ 3285.780701][ T3780] Code: Bad RIP value. [ 3285.784767][ T3780] RSP: 002b:00007f3a97ec9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3285.793184][ T3780] RAX: ffffffffffffffda RBX: 00000000004e85c0 RCX: 000000000045cba9 [ 3285.801172][ T3780] RDX: 0000000000000000 RSI: 000000000000ae41 RDI: 0000000000000004 [ 3285.809183][ T3780] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 22:01:38 executing program 1: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000180)='./bus\x00', 0x1fb842, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/key-users\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x4000000000010046) [ 3285.817273][ T3780] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 3285.825246][ T3780] R13: 00000000000003a3 R14: 00000000004c652f R15: 00007f3a97eca6d4 [ 3285.876513][ T9252] XFS (loop5): realtime geometry sanity check failed [ 3285.885473][ T3805] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3285.887925][ T9252] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3285.910273][ T9252] XFS (loop5): Unmount and run xfs_repair [ 3285.917042][ T9252] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:01:38 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3285.924895][ T9252] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3285.934227][ T9252] 00000010: 00 00 00 00 00 01 68 b6 00 00 00 00 00 00 00 00 ......h......... [ 3285.943692][ T9252] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3285.953184][ T9252] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3285.963921][ T9252] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:01:38 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3285.992243][ T9252] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3286.008495][ T9252] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3286.026357][ T9252] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3286.037778][ T3819] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3286.048326][ T3783] XFS (loop5): SB validate failed with error -117. [ 3286.071023][ T3780] Mem-Info: [ 3286.074610][ T3780] active_anon:399671 inactive_anon:10291 isolated_anon:0 [ 3286.074610][ T3780] active_file:4783 inactive_file:26511 isolated_file:0 [ 3286.074610][ T3780] unevictable:0 dirty:19 writeback:0 [ 3286.074610][ T3780] slab_reclaimable:23010 slab_unreclaimable:316461 [ 3286.074610][ T3780] mapped:63494 shmem:10516 pagetables:59536 bounce:0 [ 3286.074610][ T3780] free:625950 free_pcp:663 free_cma:0 [ 3286.127791][ T3780] Node 0 active_anon:1315196kB inactive_anon:16508kB active_file:8kB inactive_file:4kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:217120kB dirty:8kB writeback:0kB shmem:17396kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 1003520kB writeback_tmp:0kB all_unreclaimable? yes [ 3286.149957][ T3819] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:38 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3286.171413][ T3780] Node 1 active_anon:283488kB inactive_anon:24656kB active_file:19124kB inactive_file:106040kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:36856kB dirty:68kB writeback:0kB shmem:24668kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB all_unreclaimable? no [ 3286.202588][ T3780] Node 0 DMA free:10132kB min:220kB low:272kB high:324kB reserved_highatomic:0KB active_anon:2976kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB kernel_stack:140kB pagetables:500kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB 22:01:38 executing program 1: r0 = open(&(0x7f0000000040)='./file0\x00', 0x80440, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f0000ac5000)='./file0\x00', 0xa400295c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) creat(&(0x7f0000000180)='./bus\x00', 0x0) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000001c0)='./bus\x00') 22:01:38 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3286.295125][ T3780] lowmem_reserve[]: 0 2515 2515 2515 2515 [ 3286.300918][ T3780] Node 0 DMA32 free:26092kB min:35916kB low:44892kB high:53868kB reserved_highatomic:2048KB active_anon:1312220kB inactive_anon:16508kB active_file:8kB inactive_file:4kB unevictable:0kB writepending:8kB present:3129332kB managed:2578196kB mlocked:0kB kernel_stack:22576kB pagetables:50772kB bounce:0kB free_pcp:624kB local_pcp:496kB free_cma:0kB [ 3286.368068][ T3838] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3286.432979][ T3780] lowmem_reserve[]: 0 0 0 0 0 [ 3286.454350][ T3780] Node 0 Normal free:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:786432kB managed:0kB mlocked:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 3286.492657][ T3780] lowmem_reserve[]: 0 0 0 0 0 [ 3286.498952][ T3780] Node 1 Normal free:2466736kB min:53972kB low:67464kB high:80956kB reserved_highatomic:0KB active_anon:283692kB inactive_anon:24652kB active_file:19124kB inactive_file:106052kB unevictable:0kB writepending:304kB present:3932160kB managed:3870200kB mlocked:0kB kernel_stack:58268kB pagetables:187036kB bounce:0kB free_pcp:1676kB local_pcp:756kB free_cma:0kB [ 3286.626650][ T3842] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3286.644617][ T3780] lowmem_reserve[]: 0 0 0 0 0 [ 3286.657049][ T3780] Node 0 DMA: 17*4kB (UME) 4*8kB (UM) 17*16kB (UME) 9*32kB (U) 6*64kB (UE) 1*128kB (U) 1*256kB (E) 1*512kB (E) 2*1024kB (ME) 3*2048kB (UME) 0*4096kB = 10132kB [ 3286.707332][ T3780] Node 0 DMA32: 1779*4kB (MH) 1152*8kB (MH) 447*16kB (MH) 80*32kB (MH) 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 26044kB [ 3286.780951][ T3780] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 3286.794251][ T3780] Node 1 Normal: 766*4kB (UME) 163*8kB (UME) 48*16kB (UME) 43*32kB (UME) 27*64kB (UME) 17*128kB (UME) 11*256kB (UM) 6*512kB (UM) 3*1024kB (M) 3*2048kB (UE) 596*4096kB (UM) = 2466736kB [ 3286.816882][ T3780] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3286.827341][ T3780] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3286.837496][ T3780] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 3286.847130][ T3780] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 3286.856515][ T3780] 23070 total pagecache pages [ 3286.861190][ T3780] 0 pages in swap cache [ 3286.865447][ T3780] Swap cache stats: add 0, delete 0, find 0/0 [ 3286.871598][ T3780] Free swap = 0kB [ 3286.875437][ T3780] Total swap = 0kB [ 3286.879168][ T3780] 1965979 pages RAM [ 3286.882965][ T3780] 0 pages HighMem/MovableOnly [ 3286.887736][ T3780] 349903 pages reserved [ 3286.891883][ T3780] 0 pages cma reserved 22:01:40 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:40 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000ffffffb6000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:40 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:40 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) 22:01:40 executing program 1: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000740)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000009000000030000005002000000000000e0000000e0000000e0000000e0000000b8010000b8010000b8010000b8010000b801000003000000000000000000000000000000e35e28ec241cc82d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000009800e00000000000000000000000000000000000000000002800727066696c746572000000000000ffff000000000000000000000000000007ff00000000000048004354000000000000000000000000000000000000000000000000000000000100000000000000000000006e657462696f732d6e73000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000680000007000d80000000000000000000000000000000000000000006800435400000000000000008000000000000000000000000000000000000002010000000000000000000000736e6d7000000000000000000000000073797a3000000000000000000000000000000000f7ff001e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) syz_emit_ethernet(0x2a, &(0x7f0000000080)={@multicast, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) 22:01:40 executing program 0: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe6, 0xe6, 0x4, [@union={0x0, 0x8, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func, @datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], '\x00'}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x104}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3288.546379][ T3871] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3288.548339][ T3872] x_tables: duplicate underflow at hook 3 22:01:41 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3288.589425][ T3875] XFS (loop5): realtime geometry sanity check failed [ 3288.603131][ T3875] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3288.621932][ T3875] XFS (loop5): Unmount and run xfs_repair [ 3288.629051][ T3894] x_tables: duplicate underflow at hook 3 [ 3288.642958][ T3875] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3288.650676][ T3875] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3288.666710][ T3875] 00000010: 00 00 00 00 ff ff ff b6 00 00 00 00 00 00 00 00 ................ [ 3288.682112][ T3875] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:01:41 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3288.701840][ T3875] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3288.722121][ T3875] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3288.731988][ T3875] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3288.741527][ T3875] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3288.750635][ T3875] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3288.759775][ T3875] XFS (loop5): SB validate failed with error -117. 22:01:41 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:41 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3288.834046][ T3890] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:41 executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000080)=ANY=[@ANYBLOB="070f29645e"]) 22:01:41 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) 22:01:41 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3289.084240][ T3875] XFS (loop5): realtime geometry sanity check failed [ 3289.098691][ T3875] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3289.195778][ T3875] XFS (loop5): Unmount and run xfs_repair [ 3289.201550][ T3875] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3289.235278][ T3875] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3289.244175][ T3875] 00000010: 00 00 00 00 ff ff ff b6 00 00 00 00 00 00 00 00 ................ [ 3289.274896][ T3875] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3289.283944][ T3875] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3289.320449][ T3875] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3289.348852][ T3875] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3289.359377][ T3875] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3289.373682][ T3875] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3289.383312][ T3875] XFS (loop5): SB validate failed with error -117. 22:01:42 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168b7000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:42 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:42 executing program 1: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000008000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:42 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) [ 3289.806972][ T9252] XFS (loop5): realtime geometry sanity check failed [ 3289.817970][ T9252] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3289.831505][ T9252] XFS (loop5): Unmount and run xfs_repair [ 3289.838090][ T9252] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3289.846378][ T9252] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3289.856079][ T9252] 00000010: 00 00 00 00 00 01 68 b7 00 00 00 00 00 00 00 00 ......h......... [ 3289.865913][ T9252] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3289.875576][ T9252] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3289.885789][ T9252] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3289.894753][ T9252] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3289.914051][ T9252] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3289.925534][ T9252] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3289.943908][ T3967] XFS (loop5): SB validate failed with error -117. [ 3290.219534][ T3967] XFS (loop5): realtime geometry sanity check failed [ 3290.226598][ T3967] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3290.240185][ T3967] XFS (loop5): Unmount and run xfs_repair [ 3290.246718][ T3967] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3290.254480][ T3967] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3290.264969][ T3967] 00000010: 00 00 00 00 00 01 68 b7 00 00 00 00 00 00 00 00 ......h......... [ 3290.274167][ T3967] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3290.284665][ T3967] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3290.294354][ T3967] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3290.305631][ T3967] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3290.314727][ T3967] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3290.325156][ T3967] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3290.334251][ T3967] XFS (loop5): SB validate failed with error -117. 22:01:43 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000640)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000080)={0x68, r3, 0x5, 0x0, 0x0, {{}, {0x0, 0x4107}, {0x4c, 0x18, {0x60, @media='udp\x00'}}}}, 0x68}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0x14, &(0x7f0000000180)={&(0x7f0000000080)={0x68, r3, 0x5c053ef60c722d79, 0x71bd2d, 0x25dfdbfb, {{}, {}, {0x4c, 0x18, {0x8001, @link='syz0\x00'}}}, ["", "", "", "", "", "", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x20048845}, 0x4400009c) r4 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r4, 0x40140921, &(0x7f0000001200)={0x0, 0x8, 0x7, 0x0}) 22:01:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:43 executing program 1: r0 = openat$md(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/md0\x00', 0x4000, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x0, 0x8, 0x7, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$sock_SIOCSIFVLAN_DEL_VLAN_CMD(r1, 0x8983, &(0x7f0000000000)={0x1, 'veth0_to_team\x00', {}, 0x88c}) getsockopt$inet6_dccp_int(r3, 0x21, 0x5, &(0x7f0000000040), &(0x7f0000000080)=0x4) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x40, 0x0) connect$l2tp6(r4, &(0x7f0000000180)={0xa, 0x0, 0xb1fc, @local, 0x10000, 0x3}, 0x20) 22:01:43 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:01:43 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168b8000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3291.544658][ T3998] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3291.592001][ T4001] md: could not open device unknown-block(8,7). [ 3291.607741][ T4001] md: md_import_device returned -6 [ 3291.651111][ T4003] XFS (loop5): realtime geometry sanity check failed [ 3291.664032][ T4003] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3291.684977][ T4005] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3291.698077][ T4002] md: could not open device unknown-block(8,7). [ 3291.704361][ T4002] md: md_import_device returned -6 [ 3291.714430][ T4003] XFS (loop5): Unmount and run xfs_repair 22:01:44 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_GET_REGS(r2, 0x8090ae81, &(0x7f0000000040)) ioctl$BLKPG(r0, 0x40480923, 0x0) 22:01:44 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r1, 0x40480923, 0x0) [ 3291.767002][ T4003] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3291.790606][ T4003] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:01:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:44 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3291.815235][ T4003] 00000010: 00 00 00 00 00 01 68 b8 00 00 00 00 00 00 00 00 ......h......... [ 3291.863278][ T4003] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3291.893507][ T4003] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3291.934431][ T4003] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3291.946531][ T4027] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3291.962804][ T4003] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3291.980920][ T4003] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3291.993476][ T4003] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3292.013059][ T4003] XFS (loop5): SB validate failed with error -117. [ 3292.037782][ T4027] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 3292.051336][ T4027] device ip6gretap1 entered promiscuous mode [ 3292.331095][ T4028] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3292.383239][ T4003] XFS (loop5): realtime geometry sanity check failed [ 3292.394925][ T4003] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3292.455254][ T4003] XFS (loop5): Unmount and run xfs_repair [ 3292.486086][ T4003] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3292.505544][ T4003] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3292.545187][ T4003] 00000010: 00 00 00 00 00 01 68 b8 00 00 00 00 00 00 00 00 ......h......... [ 3292.558218][ T4028] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3292.574664][ T4003] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3292.585465][ T4003] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3292.595282][ T4003] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3292.606736][ T4003] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3292.625625][ T4003] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3292.655094][ T4003] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:01:45 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:45 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x0, 0x8, 0x7, 0x0}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000e40)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002f3753a9c3b630bf92dd696125265586f2043649b89eb3b91dc174d5701424fa24052b2fe97409000000058e4bf0391702519694cd73608fadb119a5ffc8f1460c55bcce412bc1cc14a1f64ad78f7efc6f2251217bae2233bacac999cbb0468424c2e8ab6cafc7bed22704254d5e3e970ab940986c4ef20a09f4a46c382c1e7016a71a704c7b3cddf5306b500fda7b4a72bcdb7c33a4c7e1f0c42819df5c26d28b450e2a9980b62fe2a57ac040892270e005a2e4ead36494a405cb04000000b544edf5491d98896b66851b823d3dc390934ea9062dd57a13ddb0ce78dbf6619bb0148e4dbb7ac738e4eb6e8061fa9d376fd0a4abf451611aa4aca0816a07a126f3a4453f7c12035ab1b2b55c098a78182c4651c0c3b019f94858fb0dc2ebd1ec689d889bf0839a7274a7886eeac67b9493f9c8c764310e79aa8bd1e9e2371ed3ab91e6a53d265a75ec4fcd4d8b2d06c73ca7efec28b59fbeccfa1dbcd25032f328223bc33acc2449b6e9da679198772e8e84f4cf1cc7f3886628dcc16c8ff17ff6ca528ef87741fc3e0f242a1037df395cbf0a99070700c17f704441360695072ca871e4c957552588ffe778b60794a8eccd0000887fad5755245963cd49619b6f87c86689c0e098ea15e8cc37f91c0d8fbe61e4ff8c85a2afba06844f5cad1ea6c07d5acd741b6442884dd99c95c41e180093a9f129db50c1e6ac5653fcf0b3c8fc57d51754bbeea6c676de473f5ed80b539dc9382faa75c7183de5de8b821433923feefe4457bfaad2e64a2cb3bd293dc991718b48e2502e8656a4f09cb67746496e4500000000000000000000000000b0990670db219d5b3ee8db3096ca6aee1264b6e004af0ebe6f39a2e080476c2e82f755eaf3f8f92f55b3cfcaf05893c6fb80e8ebaf01132fee3e6b55c2a5509243799f88c4b53d0e4e812b3e88ea5aee9e7c2e49cb7c55d211631130ff3c6fbc2bd09eb001cc6c81a3eb0bb48ba89bc03e91ffc567ed277001b9b59f977702f5ab58d88700"/852], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100)='ethtool\x00') r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r6, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='<\x00\x00\x00,\x00\'\r\x00'/20, @ANYRES32=r6, @ANYBLOB="0000ffff000000000e0000000c0001007463696e646578000c0002000600090000000000"], 0x3c}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_MPATH(r7, &(0x7f0000000540)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00012bbd7000fbdbdf25160000000a00060000000000000000000c0099006e0000000000000008000100ffffffff08000100000000000a0006001486b652a87a000008000300", @ANYRES32=0x0, @ANYBLOB="bc874b2a785323610485c2d4f562915efd13"], 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x408c0) socket(0x10, 0x803, 0x0) sendmsg$ETHTOOL_MSG_WOL_GET(r2, &(0x7f00000001c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="000828bd7000fcdbdf25090000002800018008000300010000001400020076657468305f746f5f6272696467650008000100", @ANYRES32=r6, @ANYBLOB="c16d7db3878912c21edc5cb9cbaf65dcd1e299b394e17eee6eed237b951a12a6ecf12fdd8e2b0cd716929eb158b67175fe82e43021a187b1f98d1a1a15cd91de1287de0045064467ff8c6b"], 0x3c}, 0x1, 0x0, 0x0, 0x4aae8dfda54f97f8}, 0x4) r8 = gettid() fcntl$setown(r1, 0x8, r8) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000040)={[], 0xff81, 0x0, 0x1, 0x100000000, 0xf7, r8}) 22:01:45 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:01:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000000ff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3292.681427][ T4003] XFS (loop5): SB validate failed with error -117. 22:01:45 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r1, 0x40480923, 0x0) [ 3292.759597][ T4062] md: could not open device unknown-block(8,7). [ 3292.784954][ T4062] md: md_import_device returned -6 [ 3292.830579][ T4067] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:45 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3292.930772][ T4062] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4062 comm=syz-executor.0 [ 3292.965339][ T4070] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:01:45 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168b9000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3292.986974][ T4070] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 3293.010700][ T4070] device ip6gretap1 entered promiscuous mode [ 3293.209819][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3293.225404][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3293.279270][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3293.306674][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3293.314102][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3293.355304][ T2112] 00000010: 00 00 00 00 00 01 68 b9 00 00 00 00 00 00 00 00 ......h......... [ 3293.364199][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3293.385354][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3293.394248][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3293.410944][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3293.421349][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3293.436523][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3293.449474][ T4090] XFS (loop5): SB validate failed with error -117. [ 3293.576991][ T4068] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. 22:01:46 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x0, 0x5, 0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f0000000080)={&(0x7f0000000040)=[0x400], 0x1, 0x6, 0x0, 0x7fffffff, 0x7, 0x9, 0x7, {0x80000000, 0x9, 0x4, 0x1, 0x4, 0x7fff, 0x9, 0xff01, 0x80, 0x6, 0xbd1d, 0x7f, 0x6, 0x3, "e5c68f59d6a72e6ce61e315d08d0b0ce54222cb1e62cebe4319e1c017f5ed17a"}}) 22:01:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000000ff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3293.628913][ T4067] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:46 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3293.749283][ T4111] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3293.799352][ T9252] XFS (loop5): realtime geometry sanity check failed [ 3293.818412][ T9252] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3293.890517][ T9252] XFS (loop5): Unmount and run xfs_repair [ 3293.915159][ T9252] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3293.922605][ T9252] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3293.960512][ T9252] 00000010: 00 00 00 00 00 01 68 b9 00 00 00 00 00 00 00 00 ......h......... [ 3293.969716][ T4119] md: could not open device unknown-block(5,0). [ 3293.980737][ T4119] md: md_import_device returned -6 22:01:46 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r1, 0x40480923, 0x0) [ 3294.008232][ T9252] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:01:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000007f", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3294.075381][ T9252] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3294.084288][ T9252] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3294.134117][ T9252] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3294.160478][ T9252] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3294.181377][ T9252] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3294.203614][ T4090] XFS (loop5): SB validate failed with error -117. [ 3294.342455][ T4140] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 3294.360930][ T4140] device ip6gretap1 entered promiscuous mode 22:01:48 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) 22:01:48 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:48 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40480923, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000040)) 22:01:48 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168ba000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:48 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000000ff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:48 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) [ 3295.939020][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3295.963846][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3295.966469][ T4168] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue 22:01:48 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x3, &(0x7f0000000040)=""/246, 0xf6) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x0, 0x8, 0x7, 0x0}) [ 3295.979182][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3295.991313][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3295.997064][ T4168] device ip6gretap1 entered promiscuous mode [ 3296.012593][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:01:48 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3296.072879][ T2112] 00000010: 00 00 00 00 00 01 68 ba 00 00 00 00 00 00 00 00 ......h......... [ 3296.115088][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3296.163303][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3296.176107][ T4193] md: could not open device unknown-block(8,7). [ 3296.182393][ T4193] md: md_import_device returned -6 [ 3296.206272][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:01:48 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000000040)={0x1100, 0x9, 0x0, 0x0}) [ 3296.256678][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3296.297726][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3296.320576][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3296.333030][ T4169] XFS (loop5): SB validate failed with error -117. 22:01:48 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x90000915, 0x0) [ 3296.361524][ T4200] md: md0 has zero or unknown size, marking faulty! [ 3296.368739][ T4200] md: md_import_device returned -22 22:01:48 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x90000915, 0x0) [ 3296.574997][ T4164] __nla_validate_parse: 5 callbacks suppressed [ 3296.575009][ T4164] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000004088ff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:49 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x90000915, 0x0) [ 3296.799769][ T4217] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3296.935756][ T4218] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:51 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:51 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:01:51 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168bb000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:51 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) 22:01:51 executing program 0: ioctl$BLKPG(0xffffffffffffffff, 0x90000915, 0x0) 22:01:51 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f0ffffff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3298.942394][ T4242] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:01:51 executing program 0: ioctl$BLKPG(0xffffffffffffffff, 0x90000915, 0x0) [ 3299.006970][ T4243] XFS (loop5): realtime geometry sanity check failed [ 3299.007072][ T4242] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 3299.021817][ T4243] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3299.046882][ T4243] XFS (loop5): Unmount and run xfs_repair 22:01:51 executing program 0: ioctl$BLKPG(0xffffffffffffffff, 0x90000915, 0x0) [ 3299.052867][ T4243] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3299.070415][ T4242] device ip6gretap1 entered promiscuous mode [ 3299.080420][ T4243] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:01:51 executing program 0: r0 = openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKPG(r0, 0x90000915, 0x0) [ 3299.119171][ T4243] 00000010: 00 00 00 00 00 01 68 bb 00 00 00 00 00 00 00 00 ......h......... [ 3299.159529][ T4243] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3299.187872][ T4243] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:01:51 executing program 0: r0 = openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKPG(r0, 0x90000915, 0x0) [ 3299.218389][ T4243] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3299.244093][ T4243] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3299.269420][ T4243] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3299.293362][ T4243] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:01:51 executing program 0: r0 = openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKPG(r0, 0x90000915, 0x0) [ 3299.317312][ T4243] XFS (loop5): SB validate failed with error -117. 22:01:51 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x90000915, 0x0) [ 3299.570188][ T4246] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3299.676981][ T4246] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3299.688135][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3299.705177][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3299.737376][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3299.768688][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3299.814952][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3299.823849][ T2112] 00000010: 00 00 00 00 00 01 68 bb 00 00 00 00 00 00 00 00 ......h......... [ 3299.874911][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3299.883794][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3299.929164][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3299.946677][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3299.956674][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3299.966569][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3299.976642][ T4243] XFS (loop5): SB validate failed with error -117. 22:01:54 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) 22:01:54 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:01:54 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168bc000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000f0ffffffff", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:54 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x90000915, 0x0) [ 3302.020714][ T4302] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:01:54 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x90000915, 0x0) [ 3302.062438][ T4302] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 3302.073345][ T4302] device ip6gretap1 entered promiscuous mode [ 3302.098641][ T4301] XFS (loop5): realtime geometry sanity check failed 22:01:54 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x0, 0x8, 0x45, 0x0}) [ 3302.123542][ T4301] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3302.180271][ T4301] XFS (loop5): Unmount and run xfs_repair [ 3302.202292][ T4301] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3302.219411][ T4301] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3302.239646][ T4301] 00000010: 00 00 00 00 00 01 68 bc 00 00 00 00 00 00 00 00 ......h......... [ 3302.249958][ T4301] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3302.260124][ T4301] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3302.270589][ T4301] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3302.281048][ T4301] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3302.291431][ T4301] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3302.301562][ T4325] md: could not open device unknown-block(8,69). [ 3302.309065][ T4301] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3302.320082][ T4325] md: md_import_device returned -6 [ 3302.326445][ T4301] XFS (loop5): SB validate failed with error -117. 22:01:54 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x0, 0x45, 0x7, 0x0}) 22:01:54 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0xfffff000, 0x8, 0x7, 0x0}) [ 3302.477815][ T4331] md: could not open device unknown-block(69,7). [ 3302.498162][ T4331] md: md_import_device returned -6 [ 3302.595430][ T4307] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3302.611083][ T4337] md: could not open device unknown-block(8,7). [ 3302.618362][ T4337] md: md_import_device returned -6 22:01:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x6000000, 0x8, 0x7, 0x0}) [ 3302.738755][ T4320] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3302.774379][ T4352] md: could not open device unknown-block(8,7). [ 3302.795003][ T4352] md: md_import_device returned -6 22:01:55 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000002000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:55 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r0, &(0x7f0000000140), 0x10) io_submit(r1, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r1, 0x2000000000000072, &(0x7f0000000080)) [ 3303.016467][ T4356] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3303.112211][ T4359] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:57 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:01:57 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x6800, 0x8, 0x7, 0x0}) 22:01:57 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168bd000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:01:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:01:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000003000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:57 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r0, &(0x7f0000000140), 0x10) io_submit(r1, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r1, 0x2000000000000072, &(0x7f0000000080)) [ 3305.125795][ T4378] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3305.138378][ T4377] md: could not open device unknown-block(8,7). [ 3305.159690][ T4377] md: md_import_device returned -6 22:01:57 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r4, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r6, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r7 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r7) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r9, 0xee00) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000140)={0x6b57, 0x9, {r7}, {r9}, 0x9, 0x9}) splice(r1, 0x0, r5, 0x0, 0x10005, 0x0) [ 3305.195176][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3305.211586][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3305.228023][ T4383] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3305.255451][ T4383] ip6gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 3305.263703][ T4383] device ip6gretap1 entered promiscuous mode [ 3305.288335][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3305.309902][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3305.331413][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3305.370018][ T2112] 00000010: 00 00 00 00 00 01 68 bd 00 00 00 00 00 00 00 00 ......h......... [ 3305.392353][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3305.420282][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3305.448162][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3305.463859][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3305.482722][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3305.493633][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3305.511636][ T4379] XFS (loop5): SB validate failed with error -117. [ 3305.542844][ T4390] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000004000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:01:58 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r0, &(0x7f0000000140), 0x10) io_submit(r1, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r1, 0x2000000000000072, &(0x7f0000000080)) 22:01:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:01:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3305.753757][ T4418] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:01:58 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3305.995463][ T4420] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:00 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:00 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) 22:02:00 executing program 1: r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:00 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168be000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:00 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r4, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r6, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r7 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r7) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r9, 0xee00) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000140)={0x6b57, 0x9, {r7}, {r9}, 0x9, 0x9}) splice(r1, 0x0, r5, 0x0, 0x10005, 0x0) 22:02:00 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000005000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3308.199045][ T4458] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:00 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3308.320494][ T4463] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3308.332226][ T4465] XFS (loop5): realtime geometry sanity check failed [ 3308.340942][ T4465] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3308.354328][ T4465] XFS (loop5): Unmount and run xfs_repair [ 3308.362169][ T4465] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3308.371128][ T4465] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3308.387034][ T4465] 00000010: 00 00 00 00 00 01 68 be 00 00 00 00 00 00 00 00 ......h......... [ 3308.399320][ T4465] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:02:00 executing program 1: r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3308.416258][ T4465] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3308.435509][ T4465] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3308.448352][ T4465] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3308.459662][ T4465] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:02:00 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000006000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3308.469858][ T4465] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3308.481212][ T4465] XFS (loop5): SB validate failed with error -117. [ 3308.523373][ T4483] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:01 executing program 2: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3308.615535][ T4488] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000007000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:01 executing program 1: r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3308.753829][ T4495] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3308.834188][ T4465] XFS (loop5): realtime geometry sanity check failed [ 3308.870703][ T4465] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3308.912719][ T4495] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3308.924492][ T4465] XFS (loop5): Unmount and run xfs_repair [ 3308.934163][ T4465] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3308.952640][ T4465] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3308.974938][ T4465] 00000010: 00 00 00 00 00 01 68 be 00 00 00 00 00 00 00 00 ......h......... [ 3309.027744][ T4465] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3309.069948][ T4465] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3309.111772][ T4465] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3309.141115][ T4465] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3309.160413][ T4465] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3309.175650][ T4465] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3309.184719][ T4465] XFS (loop5): SB validate failed with error -117. 22:02:03 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:03 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:03 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000008000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:03 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r4, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) r6 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r6, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r7 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r7) r8 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r9, 0xee00) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000140)={0x6b57, 0x9, {r7}, {r9}, 0x9, 0x9}) splice(r1, 0x0, r5, 0x0, 0x10005, 0x0) 22:02:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:03 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168bf000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3311.241318][ T4525] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3311.334334][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3311.359500][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:03 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3311.406909][ T4525] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3311.418893][ T3182] XFS (loop5): Unmount and run xfs_repair 22:02:03 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3311.453629][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3311.492052][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:02:03 executing program 1: sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3311.538917][ T3182] 00000010: 00 00 00 00 00 01 68 bf 00 00 00 00 00 00 00 00 ......h......... [ 3311.566642][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:02:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000009000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3311.588626][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3311.610093][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3311.624442][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3311.635632][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3311.647210][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3311.659365][ T4526] XFS (loop5): SB validate failed with error -117. [ 3311.678882][ T4561] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:04 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000a000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3311.856954][ T4561] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:04 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:04 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r8, 0xee00) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000140)={0x6b57, 0x9, {r6}, {r8}, 0x9, 0x9}) [ 3312.055779][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3312.062716][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3312.140690][ T2112] XFS (loop5): Unmount and run xfs_repair 22:02:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3312.199176][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3312.238024][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3312.277582][ T2112] 00000010: 00 00 00 00 00 01 68 bf 00 00 00 00 00 00 00 00 ......h......... [ 3312.318122][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3312.354201][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3312.400732][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3312.424933][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3312.433823][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3312.464346][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3312.494485][ T4526] XFS (loop5): SB validate failed with error -117. 22:02:05 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c0000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3312.929925][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3312.939151][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3312.953295][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3312.959933][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3312.968126][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3312.977926][ T2112] 00000010: 00 00 00 00 00 01 68 c0 00 00 00 00 00 00 00 00 ......h......... [ 3312.987803][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3312.997591][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3313.007436][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3313.017225][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3313.027178][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3313.037215][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3313.047947][ T4615] XFS (loop5): SB validate failed with error -117. [ 3313.347082][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3313.360109][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3313.405013][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3313.410781][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3313.428914][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3313.439099][ T2595] 00000010: 00 00 00 00 00 01 68 c0 00 00 00 00 00 00 00 00 ......h......... [ 3313.449017][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3313.459188][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3313.485045][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3313.493929][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3313.515004][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3313.523978][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3313.535196][ T4615] XFS (loop5): SB validate failed with error -117. 22:02:06 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x29}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:06 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000c000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:06 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r8, 0xee00) 22:02:06 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c1000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3314.619594][ T4652] __nla_validate_parse: 2 callbacks suppressed [ 3314.619606][ T4652] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3314.654478][ T4644] XFS (loop5): realtime geometry sanity check failed [ 3314.671171][ T4644] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3314.683918][ T4644] XFS (loop5): Unmount and run xfs_repair [ 3314.690171][ T4644] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3314.697907][ T4644] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3314.707422][ T4644] 00000010: 00 00 00 00 00 01 68 c1 00 00 00 00 00 00 00 00 ......h......... [ 3314.716722][ T4644] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3314.726295][ T4644] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3314.735507][ T4644] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3314.744638][ T4644] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3314.753953][ T4644] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:02:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3314.763210][ T4644] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3314.772560][ T4644] XFS (loop5): SB validate failed with error -117. 22:02:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000e000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3314.914581][ T4652] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:07 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:07 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3315.055687][ T4679] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3315.119531][ T4644] XFS (loop5): realtime geometry sanity check failed [ 3315.126673][ T4644] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3315.139080][ T4644] XFS (loop5): Unmount and run xfs_repair [ 3315.145056][ T4644] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3315.152658][ T4644] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3315.161955][ T4644] 00000010: 00 00 00 00 00 01 68 c1 00 00 00 00 00 00 00 00 ......h......... [ 3315.178850][ T4644] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3315.189561][ T4644] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3315.198914][ T4644] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3315.208133][ T4644] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3315.217320][ T4644] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3315.226548][ T4644] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3315.236061][ T4644] XFS (loop5): SB validate failed with error -117. [ 3315.333064][ T4683] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3315.365678][ T4683] device ip6gretap1 entered promiscuous mode [ 3315.792251][ T4679] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:10 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x29}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:10 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) 22:02:10 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) r7 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb), &(0x7f0000cab000)=0xc) 22:02:10 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c2000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:10 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000f000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:10 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3317.717952][ T4718] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3317.775301][ T4718] device ip6gretap1 entered promiscuous mode [ 3317.810845][ T4721] XFS (loop5): realtime geometry sanity check failed [ 3317.820422][ T4721] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3317.848456][ T4721] XFS (loop5): Unmount and run xfs_repair [ 3317.863040][ T4721] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3317.880671][ T4721] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3317.916615][ T4721] 00000010: 00 00 00 00 00 01 68 c2 00 00 00 00 00 00 00 00 ......h......... [ 3317.971086][ T4721] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3317.996181][ T4721] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3318.046054][ T4721] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3318.095094][ T4721] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3318.103993][ T4721] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3318.184890][ T4721] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3318.193847][ T4721] XFS (loop5): SB validate failed with error -117. [ 3318.394261][ T4719] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:10 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) socket$inet_udplite(0x2, 0x2, 0x88) [ 3318.604172][T26299] XFS (loop5): realtime geometry sanity check failed [ 3318.634989][T26299] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3318.741250][ T4736] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3318.744912][T26299] XFS (loop5): Unmount and run xfs_repair 22:02:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000010000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3318.814903][T26299] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3318.822351][T26299] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:02:11 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3318.901992][T26299] 00000010: 00 00 00 00 00 01 68 c2 00 00 00 00 00 00 00 00 ......h......... [ 3318.945938][T26299] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3318.957389][ T4758] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3318.994910][T26299] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3319.003908][T26299] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:02:11 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3319.075417][T26299] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3319.084309][T26299] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:02:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3319.174954][T26299] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3319.184138][ T4721] XFS (loop5): SB validate failed with error -117. [ 3319.195984][ T4761] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000002a000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3319.341151][ T4769] device ip6gretap1 entered promiscuous mode 22:02:13 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x29}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:13 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:13 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) r6 = gettid() fcntl$setown(0xffffffffffffffff, 0x8, r6) 22:02:13 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c3000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000003c000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3320.713654][ T4795] __nla_validate_parse: 2 callbacks suppressed [ 3320.713666][ T4795] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3320.786701][T26299] XFS (loop5): realtime geometry sanity check failed [ 3320.797424][T26299] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3320.822730][T26299] XFS (loop5): Unmount and run xfs_repair [ 3320.837624][T26299] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3320.857867][ T4792] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3320.857961][T26299] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3320.878620][T26299] 00000010: 00 00 00 00 00 01 68 c3 00 00 00 00 00 00 00 00 ......h......... [ 3320.889172][T26299] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3320.899443][T26299] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3320.910378][T26299] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3320.922399][T26299] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3320.933408][T26299] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3320.944054][T26299] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3320.955334][ T4793] XFS (loop5): SB validate failed with error -117. [ 3320.964719][ T4792] device ip6gretap1 entered promiscuous mode [ 3321.191120][ T4795] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3321.313639][T31280] XFS (loop5): realtime geometry sanity check failed [ 3321.336592][T31280] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:13 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3321.367597][T31280] XFS (loop5): Unmount and run xfs_repair 22:02:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000048000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3321.397665][T31280] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3321.418005][T31280] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:02:13 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3321.487709][T31280] 00000010: 00 00 00 00 00 01 68 c3 00 00 00 00 00 00 00 00 ......h......... [ 3321.508307][T31280] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3321.524237][T31280] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:02:13 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) gettid() [ 3321.547377][ T4838] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3321.564149][T31280] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3321.594775][T31280] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3321.621362][ T4838] device ip6gretap1 entered promiscuous mode [ 3321.628138][T31280] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3321.647322][T31280] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3321.658274][ T4793] XFS (loop5): SB validate failed with error -117. 22:02:14 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000c4000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3321.953150][ T4842] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3322.066891][ T4846] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3322.224195][T25648] XFS (loop5): realtime geometry sanity check failed [ 3322.238690][T25648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3322.256066][ T4864] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3322.300516][ T4864] device ip6gretap1 entered promiscuous mode [ 3322.321663][T25648] XFS (loop5): Unmount and run xfs_repair [ 3322.345281][T25648] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3322.352680][T25648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3322.393506][T25648] 00000010: 00 00 00 00 00 00 00 c4 00 00 00 00 00 00 00 00 ................ [ 3322.410401][T25648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3322.421839][T25648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3322.438639][T25648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3322.449925][T25648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3322.463046][T25648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3322.475080][T25648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3322.484086][ T4859] XFS (loop5): SB validate failed with error -117. [ 3322.841446][ T4859] XFS (loop5): realtime geometry sanity check failed [ 3322.848869][ T4859] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3322.861485][ T4859] XFS (loop5): Unmount and run xfs_repair [ 3322.867740][ T4859] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3322.876034][ T4859] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3322.885329][ T4859] 00000010: 00 00 00 00 00 00 00 c4 00 00 00 00 00 00 00 00 ................ [ 3322.894231][ T4859] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3322.903527][ T4859] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3322.912791][ T4859] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3322.922056][ T4859] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3322.931599][ T4859] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3322.940941][ T4859] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3322.950249][ T4859] XFS (loop5): SB validate failed with error -117. 22:02:16 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:16 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000004c000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:16 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r3, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r5, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) 22:02:16 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143f"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:16 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c4000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3323.823478][ T4902] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3323.865499][ T4901] XFS (loop5): realtime geometry sanity check failed [ 3323.876678][ T4901] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3323.880433][ T4902] device ip6gretap1 entered promiscuous mode 22:02:16 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x0, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3323.926298][ T4901] XFS (loop5): Unmount and run xfs_repair [ 3323.950759][ T4901] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3323.985532][ T4901] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3324.022226][ T4901] 00000010: 00 00 00 00 00 01 68 c4 00 00 00 00 00 00 00 00 ......h......... [ 3324.055034][ T4901] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3324.086421][ T4901] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3324.117898][ T4901] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3324.137244][ T4901] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3324.158692][ T4901] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3324.171651][ T4901] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3324.181047][ T4901] XFS (loop5): SB validate failed with error -117. [ 3324.196009][ T4908] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:16 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000060000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:16 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x0, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:16 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x0, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3324.384670][ T4937] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3324.581484][T31280] XFS (loop5): realtime geometry sanity check failed [ 3324.593862][T31280] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:17 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r4, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 3324.690522][T31280] XFS (loop5): Unmount and run xfs_repair [ 3324.730218][T31280] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3324.766329][T31280] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:02:17 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143f"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3324.820107][T31280] 00000010: 00 00 00 00 00 01 68 c4 00 00 00 00 00 00 00 00 ......h......... [ 3324.864189][T31280] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3324.903651][T31280] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3324.914309][T31280] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3324.925106][T31280] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3324.947114][T31280] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3324.959488][T31280] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3324.963534][ T4966] device ip6gretap1 entered promiscuous mode [ 3324.975197][ T4901] XFS (loop5): SB validate failed with error -117. 22:02:19 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:19 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000068000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:19 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, 0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) 22:02:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) 22:02:19 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143f"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:19 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c5000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3326.930697][ T4981] __nla_validate_parse: 2 callbacks suppressed [ 3326.930721][ T4981] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) socket$inet6(0xa, 0x2, 0x0) [ 3327.005976][ T4985] XFS (loop5): realtime geometry sanity check failed [ 3327.020891][ T4985] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3327.068145][ T4982] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3327.080673][ T4985] XFS (loop5): Unmount and run xfs_repair [ 3327.104323][ T4985] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:02:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) r3 = socket$inet_udp(0x2, 0x2, 0x0) close(r3) [ 3327.112497][ T4985] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3327.122853][ T4985] 00000010: 00 00 00 00 00 01 68 c5 00 00 00 00 00 00 00 00 ......h......... [ 3327.133882][ T4985] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3327.144132][ T4985] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3327.154219][ T4985] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3327.164258][ T4985] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3327.166834][ T4982] device ip6gretap1 entered promiscuous mode [ 3327.174516][ T4985] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3327.199381][ T4985] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3327.211740][ T4985] XFS (loop5): SB validate failed with error -117. 22:02:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) socket$inet_udp(0x2, 0x2, 0x0) 22:02:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, r2, 0x100, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x85d4}]}, @TIPC_NLA_SOCK={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4000091) 22:02:19 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3327.583832][ T4985] XFS (loop5): realtime geometry sanity check failed [ 3327.591574][ T4985] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3327.597090][ T4981] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3327.613028][ T4985] XFS (loop5): Unmount and run xfs_repair [ 3327.622840][ T4985] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:02:20 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, 0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) [ 3327.631488][ T4985] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3327.641835][ T4985] 00000010: 00 00 00 00 00 01 68 c5 00 00 00 00 00 00 00 00 ......h......... [ 3327.652573][ T4985] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3327.662828][ T4985] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3327.673041][ T4985] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3327.733111][ T4985] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3327.789981][ T4985] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3327.846176][ T4985] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3327.874551][ T4985] XFS (loop5): SB validate failed with error -117. 22:02:22 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:22 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000006c000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:22 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, 0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) 22:02:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) 22:02:22 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b03000800"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:22 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c6000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3330.005087][ T5039] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:02:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3330.061201][ T5039] device ip6gretap1 entered promiscuous mode [ 3330.085789][ T5038] XFS (loop5): realtime geometry sanity check failed [ 3330.092995][ T5038] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3330.114100][ T5038] XFS (loop5): Unmount and run xfs_repair [ 3330.126946][ T5038] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3330.153384][ T5038] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:02:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3330.189249][ T5038] 00000010: 00 00 00 00 00 01 68 c6 00 00 00 00 00 00 00 00 ......h......... [ 3330.218080][ T5038] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3330.238528][ T5038] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3330.252098][ T5038] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3330.264275][ T5038] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3330.276649][ T5038] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:02:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3330.295223][ T5038] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3330.324677][ T5038] XFS (loop5): SB validate failed with error -117. 22:02:22 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3330.504335][ T5042] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:23 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) pipe(&(0x7f00000002c0)) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) 22:02:23 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3330.770455][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3330.787043][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3330.839635][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3330.847650][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3330.857373][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3330.870223][ T4206] 00000010: 00 00 00 00 00 01 68 c6 00 00 00 00 00 00 00 00 ......h......... [ 3330.881449][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3330.892140][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3330.905041][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3330.916454][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3330.927752][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3330.938936][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3330.951961][ T5038] XFS (loop5): SB validate failed with error -117. 22:02:25 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:25 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000074000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:25 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) 22:02:25 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b03000800"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:25 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:25 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c7000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3333.076461][ T5093] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3333.123079][ T5093] device ip6gretap1 entered promiscuous mode [ 3333.177202][ T5098] XFS (loop5): realtime geometry sanity check failed [ 3333.185481][ T5098] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3333.215034][ T5098] XFS (loop5): Unmount and run xfs_repair 22:02:25 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3333.269883][ T5098] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3333.303990][ T5098] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3333.350357][ T5098] 00000010: 00 00 00 00 00 01 68 c7 00 00 00 00 00 00 00 00 ......h......... [ 3333.381646][ T5098] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3333.399347][ T5098] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3333.409029][ T5097] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3333.445160][ T5098] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3333.454053][ T5098] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3333.483982][ T5098] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3333.524635][ T5098] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:02:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3333.566197][ T5098] XFS (loop5): SB validate failed with error -117. [ 3333.602087][ T5097] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:26 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000007a000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:26 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(0xffffffffffffffff, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3333.792474][ T5133] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3333.896368][ T5133] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:28 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:28 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b03000800"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) 22:02:28 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f0000000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:28 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000168c8000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:28 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, 0x0, 0x0) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3336.207090][ T5158] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:02:28 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3336.286486][ T5159] XFS (loop5): realtime geometry sanity check failed [ 3336.290713][ T5158] device ip6gretap1 entered promiscuous mode [ 3336.300681][ T5159] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3336.330859][ T5159] XFS (loop5): Unmount and run xfs_repair [ 3336.337377][ T5159] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3336.346406][ T5159] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3336.355758][ T5159] 00000010: 00 00 00 00 00 01 68 c8 00 00 00 00 00 00 00 00 ......h......... [ 3336.364783][ T5159] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3336.373998][ T5159] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3336.383137][ T5159] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3336.393257][ T5159] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3336.402420][ T5159] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3336.411556][ T5159] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3336.420735][ T5159] XFS (loop5): SB validate failed with error -117. 22:02:28 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) 22:02:29 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3336.742420][ T5162] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3336.779107][ T5159] XFS (loop5): realtime geometry sanity check failed 22:02:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, 0x0, 0x0) [ 3336.793929][ T5159] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3336.861591][ T5159] XFS (loop5): Unmount and run xfs_repair 22:02:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, 0x0, 0x0) [ 3336.905033][ T5159] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:02:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, 0x0, 0x0) [ 3336.947684][ T5159] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3337.008061][ T5159] 00000010: 00 00 00 00 00 01 68 c8 00 00 00 00 00 00 00 00 ......h......... [ 3337.023660][ T5159] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3337.034651][ T5159] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3337.046398][ T5159] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3337.064866][ T5159] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3337.096148][ T5159] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3337.106039][ T5205] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3337.135325][ T5159] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3337.144278][ T5159] XFS (loop5): SB validate failed with error -117. 22:02:31 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) 22:02:31 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, 0x0, 0x0) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:31 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000005e020000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:31 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c3"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:31 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000002d2000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3339.302566][ T5224] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:02:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) [ 3339.373086][ T5224] device ip6gretap1 entered promiscuous mode [ 3339.391645][ T5228] XFS (loop5): realtime geometry sanity check failed [ 3339.399026][ T5228] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3339.412910][ T5228] XFS (loop5): Unmount and run xfs_repair [ 3339.421496][ T5228] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3339.430075][ T5228] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3339.440533][ T5228] 00000010: 00 00 00 00 00 00 02 d2 00 00 00 00 00 00 00 00 ................ [ 3339.450566][ T5228] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3339.460638][ T5228] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3339.470783][ T5228] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3339.480926][ T5228] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3339.492660][ T5228] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3339.503040][ T5228] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:02:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) [ 3339.521028][ T5228] XFS (loop5): SB validate failed with error -117. 22:02:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0}}, 0x0) 22:02:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0}}, 0x0) [ 3339.886930][ T5228] XFS (loop5): realtime geometry sanity check failed [ 3339.896571][ T5228] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0}}, 0x0) [ 3339.953098][ T5225] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3340.023141][ T5228] XFS (loop5): Unmount and run xfs_repair [ 3340.078568][ T5228] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3340.120284][ T5228] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3340.158710][ T5228] 00000010: 00 00 00 00 00 00 02 d2 00 00 00 00 00 00 00 00 ................ [ 3340.228081][ T5228] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3340.251117][ T5228] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3340.264684][ T5228] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3340.284662][ T5228] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3340.302208][ T5228] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3340.311299][ T5228] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3340.320950][ T5228] XFS (loop5): SB validate failed with error -117. 22:02:34 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:34 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000030000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:34 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) 22:02:34 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, 0x0, 0x0) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:34 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c3"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:34 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000d4000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3342.373456][ T5284] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3342.398540][ T5284] device ip6gretap1 entered promiscuous mode 22:02:34 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, 0x0, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3342.555122][T25648] XFS (loop5): realtime geometry sanity check failed [ 3342.566434][T25648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3342.581052][T25648] XFS (loop5): Unmount and run xfs_repair [ 3342.588753][T25648] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3342.598242][T25648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3342.609085][T25648] 00000010: 00 00 00 00 00 00 00 d4 00 00 00 00 00 00 00 00 ................ [ 3342.619918][T25648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3342.630812][T25648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3342.641804][T25648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:02:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3342.652712][T25648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3342.669474][T25648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:02:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3342.702137][T25648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3342.730570][ T5294] XFS (loop5): SB validate failed with error -117. 22:02:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3342.914852][ T5295] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:35 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000078030000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r1, 0x1}, 0x14}}, 0x0) [ 3343.080812][ T5329] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3343.156351][ T5333] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:37 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:37 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c3"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:37 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:37 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000ac030000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:37 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000002d6000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r1, 0x1}, 0x14}}, 0x0) [ 3345.542363][ T5351] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3345.573382][ T5351] device ip6gretap1 entered promiscuous mode 22:02:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x14, r1, 0x1}, 0x14}}, 0x0) [ 3345.646890][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3345.655344][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3345.668519][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3345.674755][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3345.682838][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3345.692954][ T2595] 00000010: 00 00 00 00 00 00 02 d6 00 00 00 00 00 00 00 00 ................ [ 3345.703835][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3345.718352][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3345.729607][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3345.740188][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3345.759996][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:02:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x44, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}]}]}, 0x44}}, 0x0) [ 3345.791403][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3345.828192][ T5359] XFS (loop5): SB validate failed with error -117. 22:02:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x44, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}]}]}, 0x44}}, 0x0) [ 3346.030254][ T5358] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x44, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}]}]}, 0x44}}, 0x0) [ 3346.202732][ T5359] XFS (loop5): realtime geometry sanity check failed [ 3346.223631][ T5359] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3346.250563][ T5367] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:38 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}}, 0x0) [ 3346.332528][ T5359] XFS (loop5): Unmount and run xfs_repair [ 3346.384867][ T5359] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3346.442303][ T5359] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3346.517022][ T5359] 00000010: 00 00 00 00 00 00 02 d6 00 00 00 00 00 00 00 00 ................ [ 3346.539885][ T5403] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3346.570305][ T5359] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3346.584847][ T5403] device ip6gretap1 entered promiscuous mode [ 3346.596660][ T5359] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3346.607477][ T5359] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3346.618360][ T5359] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3346.628356][ T5359] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3346.638613][ T5359] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3346.649383][ T5359] XFS (loop5): SB validate failed with error -117. 22:02:40 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:40 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}}, 0x0) 22:02:40 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f6030000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:40 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:40 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000ffffffe4000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3348.638176][ T5423] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x2c}}, 0x0) 22:02:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) [ 3348.700600][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3348.719947][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) [ 3348.772994][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3348.796248][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3348.810512][ T5426] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3348.846568][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3348.869695][ T5426] device ip6gretap1 entered promiscuous mode [ 3348.888320][ T2595] 00000010: 00 00 00 00 ff ff ff e4 00 00 00 00 00 00 00 00 ................ [ 3348.910531][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3348.923808][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:02:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) [ 3348.961183][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3348.971105][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3348.987799][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3349.001061][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:02:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3349.023729][ T5424] XFS (loop5): SB validate failed with error -117. 22:02:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) [ 3349.326986][ T5423] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3349.436028][ T5424] XFS (loop5): realtime geometry sanity check failed [ 3349.454813][ T5424] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3349.512777][ T5424] XFS (loop5): Unmount and run xfs_repair [ 3349.520149][ T5424] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3349.534115][ T5424] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3349.550773][ T5424] 00000010: 00 00 00 00 ff ff ff e4 00 00 00 00 00 00 00 00 ................ [ 3349.563028][ T5424] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3349.572741][ T5424] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3349.582221][ T5424] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3349.591681][ T5424] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3349.603457][ T5424] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3349.618600][ T5424] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3349.631510][ T5424] XFS (loop5): SB validate failed with error -117. 22:02:44 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x58, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x44, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x58}}, 0x0) 22:02:44 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000050000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:44 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(0x0, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:44 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:44 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000e8000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3351.738811][ T5489] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3351.778824][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3351.782797][ T5489] device ip6gretap1 entered promiscuous mode [ 3351.792302][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3351.813709][ T3182] XFS (loop5): Unmount and run xfs_repair 22:02:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) 22:02:44 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x0, 0x0) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3351.822690][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3351.833586][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:02:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) [ 3351.894496][ T3182] 00000010: 00 00 00 00 00 00 00 e8 00 00 00 00 00 00 00 00 ................ 22:02:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) 22:02:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) [ 3351.943184][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3351.996399][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:02:44 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x34, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x48}}, 0x0) [ 3352.043629][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3352.073235][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3352.110617][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3352.143721][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3352.166811][ T5485] XFS (loop5): SB validate failed with error -117. [ 3352.317800][ T5492] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3352.404814][ T5492] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3352.468265][ T5485] XFS (loop5): realtime geometry sanity check failed [ 3352.486507][ T5485] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3352.552544][ T5485] XFS (loop5): Unmount and run xfs_repair [ 3352.572997][ T5485] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3352.594646][ T5485] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3352.619654][ T5485] 00000010: 00 00 00 00 00 00 00 e8 00 00 00 00 00 00 00 00 ................ [ 3352.634806][ T5485] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3352.652343][ T5485] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3352.662418][ T5485] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3352.680659][ T5485] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3352.692209][ T5485] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3352.710248][ T5485] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3352.721842][ T5485] XFS (loop5): SB validate failed with error -117. 22:02:47 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x34, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x48}}, 0x0) 22:02:47 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x0, 0x0) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:47 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000060000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:47 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:47 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000f4000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x34, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x48}}, 0x0) [ 3354.822088][ T5553] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3354.883212][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3354.894595][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:47 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x0, 0x0) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3354.964183][ T5552] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3354.987727][ T2595] XFS (loop5): Unmount and run xfs_repair 22:02:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x34, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x48}}, 0x0) [ 3355.025219][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3355.041407][ T5552] device ip6gretap1 entered promiscuous mode [ 3355.053122][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3355.074503][ T2595] 00000010: 00 00 00 00 00 00 00 f4 00 00 00 00 00 00 00 00 ................ [ 3355.094551][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3355.113105][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:02:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x40, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x2c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x40}}, 0x0) [ 3355.138118][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3355.174272][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3355.184469][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3355.201253][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3355.212406][ T5550] XFS (loop5): SB validate failed with error -117. 22:02:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x40, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x2c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x40}}, 0x0) 22:02:47 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x40, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x2c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x40}}, 0x0) [ 3355.596965][ T5553] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:50 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3d, 0x3d, 0x5, [@datasec={0x0, 0x3, 0x0, 0xf, 0x1, [{}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x5d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:50 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x40, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x2c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x40}}, 0x0) 22:02:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000070000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:50 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:50 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x0, &(0x7f0000000080)) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:50 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000fffffff5000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:50 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x38, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x38}}, 0x0) [ 3357.883762][ T5610] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3357.921867][ T5610] device ip6gretap1 entered promiscuous mode 22:02:50 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x38, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x38}}, 0x0) [ 3357.984245][T25648] XFS (loop5): realtime geometry sanity check failed [ 3358.010993][T25648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:50 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x38, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x38}}, 0x0) 22:02:50 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000180)={0x50, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf3}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x50}}, 0x0) [ 3358.076478][T25648] XFS (loop5): Unmount and run xfs_repair [ 3358.105966][T25648] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:02:50 executing program 0: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3358.154332][T25648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3358.190999][T25648] 00000010: 00 00 00 00 ff ff ff f5 00 00 00 00 00 00 00 00 ................ [ 3358.212519][T25648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3358.240742][T25648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3358.263238][T25648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3358.287226][T25648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3358.308971][T25648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3358.331839][T25648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3358.350907][ T5616] XFS (loop5): SB validate failed with error -117. [ 3358.401609][ T5615] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3358.494142][ T5643] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.0'. [ 3358.531531][ T5643] device ip6gretap1 entered promiscuous mode [ 3358.773651][ T5616] XFS (loop5): realtime geometry sanity check failed [ 3358.783182][ T5616] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3358.799735][ T5616] XFS (loop5): Unmount and run xfs_repair [ 3358.811716][ T5616] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3358.822790][ T5616] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3358.835636][ T5616] 00000010: 00 00 00 00 ff ff ff f5 00 00 00 00 00 00 00 00 ................ [ 3358.848111][ T5616] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3358.860560][ T5616] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3358.872986][ T5616] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3358.885485][ T5616] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3358.895191][ T5616] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3358.904776][ T5616] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3358.914570][ T5616] XFS (loop5): SB validate failed with error -117. [ 3358.955111][ T5625] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:51 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3359.113500][ T5669] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3359.139158][ T5669] device ip6gretap1 entered promiscuous mode 22:02:53 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:53 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000090000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:53 executing program 0: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:53 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x0, &(0x7f0000000080)) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:53 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000fffffff6000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:53 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:53 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3360.961076][ T5684] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3360.984628][ T5685] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3361.043474][ T5692] syz-executor.3 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 3361.071403][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3361.085790][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3361.109655][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3361.120490][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3361.132945][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3361.143863][ T2595] 00000010: 00 00 00 00 ff ff ff f6 00 00 00 00 00 00 00 00 ................ [ 3361.147552][ T5688] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.0'. [ 3361.154057][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3361.172428][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3361.182648][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3361.192687][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3361.202674][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3361.213537][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3361.223962][ T5686] XFS (loop5): SB validate failed with error -117. [ 3361.240916][ T5688] device ip6gretap1 entered promiscuous mode [ 3361.464438][ T5701] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3361.486311][ T5685] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:02:53 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:54 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x0, &(0x7f0000000080)) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3361.592773][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3361.621922][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:02:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000a0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3361.699793][ T2595] XFS (loop5): Unmount and run xfs_repair 22:02:54 executing program 0: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) [ 3361.756470][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:02:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3361.824322][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3361.887895][ T2595] 00000010: 00 00 00 00 ff ff ff f6 00 00 00 00 00 00 00 00 ................ [ 3361.912391][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3361.976295][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3362.023481][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3362.039983][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3362.051071][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3362.060567][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3362.070180][ T5686] XFS (loop5): SB validate failed with error -117. 22:02:56 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:56 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000c0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:56 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[0x0]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:56 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:02:56 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000fffffdf9000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3364.062910][ T5751] __nla_validate_parse: 4 callbacks suppressed [ 3364.062921][ T5751] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3364.074642][ T5756] md: md0 stopped. 22:02:56 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:02:56 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[0x0]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3364.161415][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3364.177741][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3364.202522][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3364.218925][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3364.248622][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3364.251397][ T5771] md: md0 stopped. 22:02:56 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3364.273364][ T5755] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3364.308293][ T2112] 00000010: 00 00 00 00 ff ff fd f9 00 00 00 00 00 00 00 00 ................ 22:02:56 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3364.319884][ T5760] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3364.348034][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3364.385998][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3364.423291][ T5780] md: md0 stopped. [ 3364.427867][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3364.468363][ T5781] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3364.470861][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:02:56 executing program 0: ioctl$BLKPG(0xffffffffffffffff, 0x932, 0x0) 22:02:56 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000e0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3364.510816][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3364.522322][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3364.534510][ T5753] XFS (loop5): SB validate failed with error -117. [ 3364.634647][ T5789] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3364.873073][ T5753] XFS (loop5): realtime geometry sanity check failed [ 3364.890240][ T5753] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3364.935945][ T5753] XFS (loop5): Unmount and run xfs_repair [ 3364.942063][ T5753] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3364.954241][ T5753] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3364.964918][ T5753] 00000010: 00 00 00 00 ff ff fd f9 00 00 00 00 00 00 00 00 ................ [ 3364.975611][ T5753] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3364.984827][ T5753] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3364.997064][ T5753] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3365.007198][ T5753] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3365.017553][ T5753] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3365.028047][ T5753] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3365.039178][ T5753] XFS (loop5): SB validate failed with error -117. 22:02:59 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:02:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e00010069703667726574617000000020000280", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:02:59 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[0x0]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:02:59 executing program 0: ioctl$BLKPG(0xffffffffffffffff, 0x932, 0x0) 22:02:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000000f0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:02:59 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000000000ff000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:02:59 executing program 0: ioctl$BLKPG(0xffffffffffffffff, 0x932, 0x0) [ 3367.117248][ T5815] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3367.153920][ T5815] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3367.195496][ T5819] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3367.228910][ T5818] XFS (loop5): realtime geometry sanity check failed 22:02:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e00010069703667726574617000000020000280", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3367.237165][ T5818] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3367.250639][ T5818] XFS (loop5): Unmount and run xfs_repair [ 3367.268400][ T5818] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3367.288870][ T5818] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3367.301050][ T5818] 00000010: 00 00 00 00 00 00 00 ff 00 00 00 00 00 00 00 00 ................ [ 3367.311709][ T5818] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3367.321992][ T5818] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3367.332596][ T5818] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... 22:02:59 executing program 0: r0 = openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3367.343063][ T5818] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3367.353433][ T5818] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3367.363697][ T5818] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3367.374304][ T5818] XFS (loop5): SB validate failed with error -117. 22:02:59 executing program 0: r0 = openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:02:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000200000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3367.436916][ T5845] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3367.457776][ T5845] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.1'. 22:02:59 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e00010069703667726574617000000020000280", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3367.733321][ T5818] XFS (loop5): realtime geometry sanity check failed [ 3367.745199][ T5818] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3367.767035][ T5818] XFS (loop5): Unmount and run xfs_repair [ 3367.772793][ T5818] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3367.781251][ T5818] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3367.790494][ T5818] 00000010: 00 00 00 00 00 00 00 ff 00 00 00 00 00 00 00 00 ................ [ 3367.799733][ T5818] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3367.808741][ T5818] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3367.818049][ T5818] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3367.845157][ T5818] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3367.854049][ T5818] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3367.863242][ T5818] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3367.872729][ T5818] XFS (loop5): SB validate failed with error -117. 22:03:02 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:02 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:02 executing program 0: r0 = openat$md(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:03:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe8800"/48, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:02 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000002a0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:02 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000000000000000fff000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:02 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x932, 0x0) [ 3370.229634][ T5885] __nla_validate_parse: 4 callbacks suppressed [ 3370.229644][ T5885] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3370.326291][ T5886] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3370.336206][ T5886] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3370.361579][ T5886] device ip6gretap1 entered promiscuous mode [ 3370.370810][ T5887] XFS (loop5): realtime geometry sanity check failed [ 3370.374929][ T5885] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3370.394348][ T5887] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3370.408541][ T5887] XFS (loop5): Unmount and run xfs_repair [ 3370.416291][ T5887] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:03:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe8800"/48, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:02 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000003c0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3370.425372][ T5887] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3370.438179][ T5887] 00000010: 00 00 00 00 00 00 0f ff 00 00 00 00 00 00 00 00 ................ 22:03:02 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x932, 0x0) [ 3370.471189][ T5887] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3370.481725][ T5887] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3370.504877][ T5887] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3370.531229][ T5887] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3370.570373][ T5887] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:03:03 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(0xffffffffffffffff, 0x932, 0x0) [ 3370.587234][ T5912] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3370.599205][ T5887] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3370.618408][ T5887] XFS (loop5): SB validate failed with error -117. 22:03:03 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, &(0x7f0000001200)={0x6, 0x8, 0x7, 0x0}) [ 3370.766742][ T5913] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3370.777198][ T5913] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3370.794882][ T5912] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3370.800529][ T5923] md: could not open device unknown-block(8,7). [ 3370.811658][ T5923] md: md_import_device returned -6 [ 3371.017015][ T5887] XFS (loop5): realtime geometry sanity check failed [ 3371.029023][ T5887] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3371.075194][ T5887] XFS (loop5): Unmount and run xfs_repair [ 3371.081059][ T5887] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3371.119033][ T5887] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3371.134614][ T5887] 00000010: 00 00 00 00 00 00 0f ff 00 00 00 00 00 00 00 00 ................ [ 3371.145676][ T5887] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3371.156735][ T5887] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3371.167336][ T5887] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3371.177781][ T5887] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3371.187578][ T5887] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3371.197296][ T5887] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3371.207138][ T5887] XFS (loop5): SB validate failed with error -117. 22:03:05 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:05 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x928, 0x0) 22:03:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe8800"/48, @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000003f0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:05 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:05 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000fffffdff000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3373.268385][ T5944] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:05 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x922, 0x0) [ 3373.346268][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3373.359440][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:05 executing program 0 (fault-call:1 fault-nth:0): r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3373.417320][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3373.424529][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3373.447218][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:03:05 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe88000000000000000000000000000106000200", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3373.470302][ T5947] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3373.508377][ T2112] 00000010: 00 00 00 00 ff ff fd ff 00 00 00 00 00 00 00 00 ................ [ 3373.558470][ T5974] FAULT_INJECTION: forcing a failure. [ 3373.558470][ T5974] name failslab, interval 1, probability 0, space 0, times 0 [ 3373.582840][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3373.597787][ T5974] CPU: 1 PID: 5974 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0 [ 3373.606400][ T5974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3373.609084][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3373.616451][ T5974] Call Trace: [ 3373.616481][ T5974] dump_stack+0x18f/0x20d [ 3373.616508][ T5974] should_fail.cold+0x5/0x14 [ 3373.616535][ T5974] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3373.616554][ T5974] should_failslab+0x5/0xf [ 3373.616572][ T5974] __kmalloc+0x27d/0x340 [ 3373.616594][ T5974] ? rcu_read_lock_sched_held+0x3a/0xb0 22:03:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000400000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3373.616621][ T5974] tomoyo_realpath_from_path+0xc3/0x620 [ 3373.616642][ T5974] ? tomoyo_profile+0x42/0x50 [ 3373.616665][ T5974] tomoyo_path_number_perm+0x1cb/0x4d0 [ 3373.616689][ T5974] ? tomoyo_path_number_perm+0x183/0x4d0 [ 3373.644043][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3373.647803][ T5974] ? tomoyo_execute_permission+0x470/0x470 [ 3373.647840][ T5974] ? lock_is_held_type+0xb0/0xe0 [ 3373.647874][ T5974] ? selinux_inode_getsecctx+0x90/0x90 [ 3373.647892][ T5974] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3373.647907][ T5974] ? lock_is_held_type+0xb0/0xe0 [ 3373.647931][ T5974] ? __fget_files+0x294/0x400 [ 3373.647956][ T5974] security_file_ioctl+0x50/0xb0 [ 3373.647975][ T5974] ksys_ioctl+0x50/0x180 [ 3373.666049][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3373.667933][ T5974] __x64_sys_ioctl+0x6f/0xb0 [ 3373.667953][ T5974] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3373.667970][ T5974] do_syscall_64+0x60/0xe0 [ 3373.667987][ T5974] entry_SYSCALL_64_after_hwframe+0x44/0xa9 22:03:06 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe88000000000000000000000000000106000200", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3373.668004][ T5974] RIP: 0033:0x45cba9 [ 3373.674406][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3373.679053][ T5974] Code: Bad RIP value. [ 3373.679062][ T5974] RSP: 002b:00007f3a97ec9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3373.679077][ T5974] RAX: ffffffffffffffda RBX: 00000000004e2800 RCX: 000000000045cba9 [ 3373.679087][ T5974] RDX: 0000000000000000 RSI: 0000000000000932 RDI: 0000000000000003 [ 3373.679096][ T5974] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3373.679104][ T5974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 3373.679113][ T5974] R13: 000000000000022c R14: 00000000004c48c6 R15: 00007f3a97eca6d4 [ 3373.835066][ T5974] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3373.842271][ T5974] md: md0 stopped. 22:03:06 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3373.918226][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3373.932617][ T5946] XFS (loop5): SB validate failed with error -117. 22:03:08 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000088400000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:08 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:08 executing program 0 (fault-call:1 fault-nth:1): r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:03:08 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000000007fffffff000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:08 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:08 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe88000000000000000000000000000106000200", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3376.353443][ T6003] __nla_validate_parse: 5 callbacks suppressed [ 3376.353454][ T6003] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3376.394955][ T6006] FAULT_INJECTION: forcing a failure. [ 3376.394955][ T6006] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3376.408190][ T6006] CPU: 1 PID: 6006 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0 [ 3376.416774][ T6006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3376.426851][ T6006] Call Trace: [ 3376.430158][ T6006] dump_stack+0x18f/0x20d [ 3376.434523][ T6006] should_fail.cold+0x5/0x14 [ 3376.439140][ T6006] __alloc_pages_nodemask+0x1a3/0x930 [ 3376.444526][ T6006] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3376.451310][ T6006] ? lock_downgrade+0x820/0x820 [ 3376.456182][ T6006] cache_grow_begin+0x8c/0xb20 [ 3376.460995][ T6006] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 3376.466466][ T6006] cache_alloc_refill+0x27b/0x340 [ 3376.471521][ T6006] ? lockdep_hardirqs_off+0x66/0xa0 [ 3376.476734][ T6006] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3376.482460][ T6006] __kmalloc+0x319/0x340 [ 3376.486730][ T6006] tomoyo_realpath_from_path+0xc3/0x620 [ 3376.492291][ T6006] ? tomoyo_profile+0x42/0x50 [ 3376.496990][ T6006] tomoyo_path_number_perm+0x1cb/0x4d0 [ 3376.501158][ T6004] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3376.502455][ T6006] ? tomoyo_path_number_perm+0x183/0x4d0 [ 3376.502480][ T6006] ? tomoyo_execute_permission+0x470/0x470 [ 3376.502516][ T6006] ? lock_is_held_type+0xb0/0xe0 [ 3376.502564][ T6006] ? selinux_inode_getsecctx+0x90/0x90 [ 3376.533619][ T6006] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3376.539169][ T6006] ? lock_is_held_type+0xb0/0xe0 [ 3376.544125][ T6006] ? __fget_files+0x294/0x400 [ 3376.548820][ T6006] security_file_ioctl+0x50/0xb0 [ 3376.553765][ T6006] ksys_ioctl+0x50/0x180 [ 3376.558015][ T6006] __x64_sys_ioctl+0x6f/0xb0 [ 3376.562610][ T6006] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3376.567726][ T6006] do_syscall_64+0x60/0xe0 [ 3376.572151][ T6006] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3376.578049][ T6006] RIP: 0033:0x45cba9 [ 3376.581942][ T6006] Code: Bad RIP value. [ 3376.586008][ T6006] RSP: 002b:00007f3a97ec9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 22:03:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe8800000000000000000000000000010600020002000000", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3376.594424][ T6006] RAX: ffffffffffffffda RBX: 00000000004e2800 RCX: 000000000045cba9 [ 3376.602399][ T6006] RDX: 0000000000000000 RSI: 0000000000000932 RDI: 0000000000000003 [ 3376.610398][ T6006] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3376.618376][ T6006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 3376.626362][ T6006] R13: 000000000000022c R14: 00000000004c48c6 R15: 00007f3a97eca6d4 22:03:09 executing program 0 (fault-call:1 fault-nth:2): r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3376.642611][ T6006] md: md0 stopped. [ 3376.660103][ T6003] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3376.689860][ T6024] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3376.708082][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3376.726718][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3376.729438][ T6028] FAULT_INJECTION: forcing a failure. [ 3376.729438][ T6028] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3376.751754][ T6028] CPU: 1 PID: 6028 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0 [ 3376.760338][ T6028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3376.770398][ T6028] Call Trace: [ 3376.773727][ T6028] dump_stack+0x18f/0x20d [ 3376.778071][ T6028] should_fail.cold+0x5/0x14 [ 3376.782679][ T6028] __alloc_pages_nodemask+0x1a3/0x930 22:03:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000480000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3376.788059][ T6028] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3376.794874][ T6028] ? find_held_lock+0x2d/0x110 [ 3376.799263][ T6024] device ip6gretap2 entered promiscuous mode [ 3376.799646][ T6028] ? lock_downgrade+0x820/0x820 [ 3376.806531][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3376.810455][ T6028] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3376.810474][ T6028] cache_grow_begin+0x8c/0xb20 [ 3376.810504][ T6028] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3376.832380][ T6028] ____cache_alloc_node+0x171/0x1d0 [ 3376.837610][ T6028] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3376.843332][ T6028] __kmalloc+0x22b/0x340 [ 3376.847583][ T6028] tomoyo_realpath_from_path+0xc3/0x620 [ 3376.852979][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3376.853135][ T6028] ? tomoyo_profile+0x42/0x50 [ 3376.865214][ T6028] tomoyo_path_number_perm+0x1cb/0x4d0 [ 3376.870683][ T6028] ? tomoyo_path_number_perm+0x183/0x4d0 [ 3376.876322][ T6028] ? tomoyo_execute_permission+0x470/0x470 [ 3376.880200][ T6032] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3376.882171][ T6028] ? lock_is_held_type+0xb0/0xe0 [ 3376.882210][ T6028] ? selinux_inode_getsecctx+0x90/0x90 [ 3376.882232][ T6028] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3376.893252][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3376.896428][ T6028] ? lock_is_held_type+0xb0/0xe0 [ 3376.896456][ T6028] ? __fget_files+0x294/0x400 [ 3376.896481][ T6028] security_file_ioctl+0x50/0xb0 [ 3376.896501][ T6028] ksys_ioctl+0x50/0x180 [ 3376.896519][ T6028] __x64_sys_ioctl+0x6f/0xb0 [ 3376.896535][ T6028] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3376.896550][ T6028] do_syscall_64+0x60/0xe0 [ 3376.896567][ T6028] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3376.896580][ T6028] RIP: 0033:0x45cba9 [ 3376.896593][ T6028] Code: Bad RIP value. [ 3376.924443][ T2595] 00000010: 00 00 00 00 7f ff ff ff 00 00 00 00 00 00 00 00 ................ [ 3376.926022][ T6028] RSP: 002b:00007f3a97ec9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3376.926040][ T6028] RAX: ffffffffffffffda RBX: 00000000004e2800 RCX: 000000000045cba9 22:03:09 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe8800000000000000000000000000010600020002000000", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3376.926049][ T6028] RDX: 0000000000000000 RSI: 0000000000000932 RDI: 0000000000000003 [ 3376.926057][ T6028] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3376.926065][ T6028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 3376.926073][ T6028] R13: 000000000000022c R14: 00000000004c48c6 R15: 00007f3a97eca6d4 22:03:09 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3377.058053][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3377.068868][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3377.078690][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3377.089046][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3377.098793][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3377.108784][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3377.120946][ T6035] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3377.131675][ T6008] XFS (loop5): SB validate failed with error -117. [ 3377.219956][ T6028] md: md0 stopped. [ 3377.262403][ T6044] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 22:03:09 executing program 0 (fault-call:1 fault-nth:3): r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:03:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000004c0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3377.469510][ T6055] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3377.487613][ T6056] FAULT_INJECTION: forcing a failure. [ 3377.487613][ T6056] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3377.532494][ T6056] CPU: 0 PID: 6056 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0 [ 3377.541110][ T6056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3377.551160][ T6056] Call Trace: [ 3377.554489][ T6056] dump_stack+0x18f/0x20d [ 3377.558824][ T6056] should_fail.cold+0x5/0x14 [ 3377.563418][ T6056] __alloc_pages_nodemask+0x1a3/0x930 [ 3377.568794][ T6056] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 3377.574339][ T6056] ? __alloc_pages_nodemask+0x6b1/0x930 [ 3377.579906][ T6056] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3377.586677][ T6056] ? cache_grow_begin+0x3cb/0xb20 [ 3377.591811][ T6056] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3377.597812][ T6056] cache_grow_begin+0x8c/0xb20 [ 3377.602586][ T6056] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3377.608302][ T6056] ? cache_grow_begin+0x8c/0xb20 [ 3377.613244][ T6056] fallback_alloc+0x205/0x2d0 [ 3377.617932][ T6056] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3377.623653][ T6056] __kmalloc+0x22b/0x340 [ 3377.627901][ T6056] tomoyo_realpath_from_path+0xc3/0x620 [ 3377.633541][ T6056] ? tomoyo_profile+0x42/0x50 [ 3377.638243][ T6056] tomoyo_path_number_perm+0x1cb/0x4d0 [ 3377.643701][ T6056] ? tomoyo_path_number_perm+0x183/0x4d0 [ 3377.649343][ T6056] ? tomoyo_execute_permission+0x470/0x470 [ 3377.655166][ T6056] ? lock_is_held_type+0xb0/0xe0 [ 3377.660124][ T6056] ? selinux_inode_getsecctx+0x90/0x90 [ 3377.665584][ T6056] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3377.671125][ T6056] ? lock_is_held_type+0xb0/0xe0 [ 3377.676069][ T6056] ? __fget_files+0x294/0x400 [ 3377.680752][ T6056] security_file_ioctl+0x50/0xb0 [ 3377.685690][ T6056] ksys_ioctl+0x50/0x180 [ 3377.689946][ T6056] __x64_sys_ioctl+0x6f/0xb0 [ 3377.694532][ T6056] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3377.699641][ T6056] do_syscall_64+0x60/0xe0 [ 3377.704056][ T6056] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3377.709953][ T6056] RIP: 0033:0x45cba9 [ 3377.713835][ T6056] Code: Bad RIP value. [ 3377.717890][ T6056] RSP: 002b:00007f3a97ec9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3377.726303][ T6056] RAX: ffffffffffffffda RBX: 00000000004e2800 RCX: 000000000045cba9 [ 3377.734267][ T6056] RDX: 0000000000000000 RSI: 0000000000000932 RDI: 0000000000000003 [ 3377.742231][ T6056] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3377.750205][ T6056] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 3377.758177][ T6056] R13: 000000000000022c R14: 00000000004c48c6 R15: 00007f3a97eca6d4 [ 3377.812182][ T6056] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3377.819584][ T6056] md: md0 stopped. [ 3377.934607][ T6057] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:11 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe8800000000000000000000000000010600020002000000", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:11 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:11 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000000000ffffffff000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:11 executing program 0 (fault-call:1 fault-nth:4): r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:03:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000065580000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3379.520346][ T6072] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 22:03:11 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe88000000000000000000000000000106000200020000000800", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3379.588019][ T6077] FAULT_INJECTION: forcing a failure. [ 3379.588019][ T6077] name failslab, interval 1, probability 0, space 0, times 0 [ 3379.642822][T25648] XFS (loop5): realtime geometry sanity check failed [ 3379.651109][ T6077] CPU: 0 PID: 6077 Comm: syz-executor.0 Not tainted 5.8.0-rc4-syzkaller #0 [ 3379.659736][ T6077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3379.664272][T25648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3379.669797][ T6077] Call Trace: [ 3379.669822][ T6077] dump_stack+0x18f/0x20d [ 3379.669845][ T6077] should_fail.cold+0x5/0x14 [ 3379.669869][ T6077] ? tomoyo_encode2.part.0+0xe9/0x3a0 [ 3379.669887][ T6077] should_failslab+0x5/0xf [ 3379.669905][ T6077] __kmalloc+0x27d/0x340 [ 3379.669924][ T6077] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3379.669946][ T6077] tomoyo_encode2.part.0+0xe9/0x3a0 [ 3379.669971][ T6077] ? tomoyo_realpath_from_path+0xc3/0x620 [ 3379.669993][ T6077] tomoyo_encode+0x28/0x50 [ 3379.709644][T25648] XFS (loop5): Unmount and run xfs_repair [ 3379.713673][ T6077] tomoyo_realpath_from_path+0x186/0x620 22:03:12 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3379.713703][ T6077] tomoyo_path_number_perm+0x1cb/0x4d0 [ 3379.713718][ T6077] ? tomoyo_path_number_perm+0x183/0x4d0 [ 3379.713738][ T6077] ? tomoyo_execute_permission+0x470/0x470 [ 3379.729935][T25648] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3379.734755][ T6077] ? lock_is_held_type+0xb0/0xe0 [ 3379.734800][ T6077] ? selinux_inode_getsecctx+0x90/0x90 [ 3379.744900][T25648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3379.745862][ T6077] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3379.745878][ T6077] ? lock_is_held_type+0xb0/0xe0 [ 3379.745902][ T6077] ? __fget_files+0x294/0x400 [ 3379.745928][ T6077] security_file_ioctl+0x50/0xb0 [ 3379.745948][ T6077] ksys_ioctl+0x50/0x180 [ 3379.745973][ T6077] __x64_sys_ioctl+0x6f/0xb0 [ 3379.745990][ T6077] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3379.746006][ T6077] do_syscall_64+0x60/0xe0 [ 3379.746021][ T6077] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3379.746036][ T6077] RIP: 0033:0x45cba9 [ 3379.746042][ T6077] Code: Bad RIP value. [ 3379.746050][ T6077] RSP: 002b:00007f3a97ec9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3379.746072][ T6077] RAX: ffffffffffffffda RBX: 00000000004e2800 RCX: 000000000045cba9 [ 3379.766922][T25648] 00000010: 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 ................ [ 3379.769755][ T6077] RDX: 0000000000000000 RSI: 0000000000000932 RDI: 0000000000000003 [ 3379.769765][ T6077] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3379.769774][ T6077] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 3379.769784][ T6077] R13: 000000000000022c R14: 00000000004c48c6 R15: 00007f3a97eca6d4 [ 3379.900673][ T6077] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3379.907841][ T6077] md: md0 stopped. [ 3379.911775][T25648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3379.936426][T25648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:03:12 executing program 0 (fault-call:1 fault-nth:5): r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3379.949959][T25648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3379.963568][T25648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3379.976887][T25648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3379.987109][T25648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:03:12 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe88000000000000000000000000000106000200020000000800", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:12 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000025e0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3380.014457][ T6074] XFS (loop5): SB validate failed with error -117. [ 3380.067301][ T6103] md: md0 stopped. 22:03:12 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3380.227786][ T6114] md: md0 stopped. [ 3380.397155][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3380.404091][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3380.419371][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3380.433523][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3380.458606][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3380.479260][ T2595] 00000010: 00 00 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 ................ [ 3380.499855][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3380.511321][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3380.521729][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3380.532256][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3380.542161][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3380.552152][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3380.562293][ T6074] XFS (loop5): SB validate failed with error -117. 22:03:14 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:14 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe88000000000000000000000000000106000200020000000800", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:14 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x2, 0x0) 22:03:14 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000600000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:14 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000004088ffffffff000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3382.630783][ T6140] __nla_validate_parse: 4 callbacks suppressed [ 3382.630794][ T6140] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:15 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x10, 0x0) [ 3382.672157][ T6138] XFS (loop5): realtime geometry sanity check failed [ 3382.688014][ T6138] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3382.708574][ T6138] XFS (loop5): Unmount and run xfs_repair [ 3382.714842][ T6138] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:03:15 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, 0x0}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3382.741978][ T6138] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:03:15 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x301, 0x0) [ 3382.786671][ T6138] 00000010: 00 00 40 88 ff ff ff ff 00 00 00 00 00 00 00 00 ..@............. [ 3382.812131][ T6138] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:03:15 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x90a, 0x0) 22:03:15 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3382.856497][ T6138] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:03:15 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x914, 0x0) [ 3382.928042][ T6138] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3382.967102][ T6138] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3382.983889][ T6138] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3383.002116][ T6138] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3383.021001][ T6172] md: Autodetecting RAID arrays. [ 3383.027236][ T6172] md: autorun ... [ 3383.031469][ T6172] md: ... autorun DONE. [ 3383.031961][ T6138] XFS (loop5): SB validate failed with error -117. [ 3383.067815][ T6173] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3383.400443][ T6138] XFS (loop5): realtime geometry sanity check failed [ 3383.422099][ T6138] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3383.470994][ T6138] XFS (loop5): Unmount and run xfs_repair [ 3383.483233][ T6138] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3383.495909][ T6138] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3383.504852][ T6138] 00000010: 00 00 40 88 ff ff ff ff 00 00 00 00 00 00 00 00 ..@............. [ 3383.518515][ T6138] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3383.528633][ T6138] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3383.541445][ T6138] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3383.551558][ T6138] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3383.564511][ T6138] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3383.574728][ T6138] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3383.587673][ T6138] XFS (loop5): SB validate failed with error -117. 22:03:18 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x4, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0]}}, 0x0, 0x68}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000058650000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:18 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x922, 0x0) 22:03:18 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:18 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:18 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000ffffffffffffffff000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:18 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x928, 0x0) [ 3385.718081][ T6197] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3385.747330][ T6199] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:18 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3385.796467][ T6200] XFS (loop5): realtime geometry sanity check failed [ 3385.819057][ T6200] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3385.836859][ T6200] XFS (loop5): Unmount and run xfs_repair [ 3385.843940][ T6200] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3385.854881][ T6200] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3385.866509][ T6200] 00000010: ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 ................ [ 3385.879404][ T6200] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3385.891171][ T6200] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3385.902960][ T6200] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3385.916778][ T6200] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:03:18 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x929, 0x0) [ 3385.950520][ T6200] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3385.953867][ T6222] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3385.969634][ T6200] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3385.986588][ T6200] XFS (loop5): SB validate failed with error -117. 22:03:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000680000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3386.003326][ T6211] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:18 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:18 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3386.091995][ T6231] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3386.231005][ T6234] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3386.243815][ T6233] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3386.332336][T31280] XFS (loop5): realtime geometry sanity check failed [ 3386.347837][T31280] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3386.382819][T31280] XFS (loop5): Unmount and run xfs_repair [ 3386.407908][T31280] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3386.451958][T31280] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3386.521652][T31280] 00000010: ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 ................ [ 3386.544801][T31280] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3386.565410][T31280] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3386.574341][T31280] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3386.587101][T31280] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3386.605510][T31280] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3386.614420][T31280] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3386.637505][ T6200] XFS (loop5): SB validate failed with error -117. 22:03:21 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x935, 0x0) 22:03:21 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000006c0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:21 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:21 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000002000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3388.815598][ T6270] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x125d, 0x0) [ 3388.873861][ T6268] XFS (loop5): realtime geometry sanity check failed [ 3388.893842][ T6268] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3388.942336][ T6268] XFS (loop5): Unmount and run xfs_repair [ 3388.948328][ T6274] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3388.969272][ T6268] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3388.983826][ T6270] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3388.997896][ T6268] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3389.008728][ T6268] 00000010: 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3389.019052][ T6268] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3389.029017][ T6268] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:03:21 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3389.038977][ T6268] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3389.049071][ T6268] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3389.069960][ T6268] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:03:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x125e, 0x0) 22:03:21 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f00", 0x1c}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000740000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3389.100978][ T6268] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3389.127133][ T6268] XFS (loop5): SB validate failed with error -117. [ 3389.170094][ T6299] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.1'. 22:03:21 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3389.230955][ T6306] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3389.379541][ T6306] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3389.509779][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3389.532957][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3389.565170][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3389.570929][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3389.583155][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3389.593019][ T2595] 00000010: 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3389.602807][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3389.613629][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3389.623626][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3389.633874][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3389.643937][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3389.653967][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3389.664008][ T6268] XFS (loop5): SB validate failed with error -117. 22:03:24 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:24 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x125f, 0x0) 22:03:24 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000003780000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:24 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f00", 0x1c}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:24 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000003000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:24 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:24 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1260, 0x0) [ 3391.945498][ T6342] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:24 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f00", 0x1c}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:24 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1261, 0x0) [ 3392.071221][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3392.082013][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:24 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1262, 0x0) [ 3392.154924][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3392.168611][ T6349] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:24 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3392.205769][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3392.213169][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3392.273309][ T3182] 00000010: 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3392.301225][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3392.353194][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3392.362478][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3392.376498][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3392.388485][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3392.399894][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3392.411741][ T6343] XFS (loop5): SB validate failed with error -117. [ 3392.677706][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3392.684553][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3392.745348][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3392.751130][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3392.778906][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3392.804266][ T3182] 00000010: 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3392.835336][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3392.844231][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3392.871013][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3392.884634][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3392.894471][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3392.904123][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3392.913767][ T6343] XFS (loop5): SB validate failed with error -117. 22:03:27 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000007a0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:27 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1263, 0x0) 22:03:27 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f42", 0x2a}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:27 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:27 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000004000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3395.010711][ T6394] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3395.063214][ T6395] XFS (loop5): realtime geometry sanity check failed [ 3395.071593][ T6395] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:27 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1264, 0x0) [ 3395.118274][ T6395] XFS (loop5): Unmount and run xfs_repair [ 3395.133759][ T6401] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:27 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3395.178914][ T6395] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3395.199542][ T6395] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3395.208769][ T6395] 00000010: 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3395.218186][ T6395] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:03:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000810000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3395.227852][ T6395] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3395.237016][ T6395] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3395.257379][ T6395] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3395.285130][ T6395] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3395.302763][ T6395] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3395.321771][ T6395] XFS (loop5): SB validate failed with error -117. 22:03:27 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f42", 0x2a}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3395.332312][ T6418] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:27 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff0000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:27 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1265, 0x0) [ 3395.450749][ T6420] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3395.516137][ T6428] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3395.674282][T25648] XFS (loop5): realtime geometry sanity check failed [ 3395.686884][T25648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3395.707713][T25648] XFS (loop5): Unmount and run xfs_repair [ 3395.717705][T25648] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3395.725802][T25648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3395.734759][T25648] 00000010: 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3395.744118][T25648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3395.754511][T25648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3395.763659][T25648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3395.772755][T25648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3395.781844][T25648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3395.791045][T25648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3395.800193][ T6395] XFS (loop5): SB validate failed with error -117. 22:03:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:30 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff0000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:30 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000003ac0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:30 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1267, 0x0) 22:03:30 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f42", 0x2a}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:30 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000005000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:30 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1268, 0x0) [ 3398.179520][ T6452] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. 22:03:30 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff0000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3398.238964][ T6455] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:30 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000", 0x31}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:30 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1269, 0x0) [ 3398.324964][ T6457] XFS (loop5): realtime geometry sanity check failed [ 3398.349551][ T6457] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3398.406908][ T6457] XFS (loop5): Unmount and run xfs_repair [ 3398.430400][ T6457] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3398.474287][ T6457] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3398.483535][ T6473] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3398.502241][ T6455] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:30 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff00000000040000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3398.531719][ T6457] 00000010: 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 22:03:30 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1274, 0x0) [ 3398.572958][ T6457] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3398.598230][ T6457] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3398.619282][ T6457] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3398.666132][ T6457] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3398.693228][ T6457] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3398.708406][ T6487] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3398.711884][ T6457] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3398.749987][ T6457] XFS (loop5): SB validate failed with error -117. [ 3399.046073][ T6457] XFS (loop5): realtime geometry sanity check failed [ 3399.053306][ T6457] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3399.067450][ T6457] XFS (loop5): Unmount and run xfs_repair [ 3399.073646][ T6457] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3399.083577][ T6457] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3399.094121][ T6457] 00000010: 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3399.104194][ T6457] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3399.114281][ T6457] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3399.126895][ T6457] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3399.137059][ T6457] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3399.147144][ T6457] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3399.157239][ T6457] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3399.167654][ T6457] XFS (loop5): SB validate failed with error -117. 22:03:33 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:33 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000f00000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:33 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000", 0x31}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:33 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1276, 0x0) 22:03:33 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff00000000040000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:33 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000006000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:33 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1277, 0x0) [ 3401.276226][ T6517] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3401.335585][ T6520] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3401.364394][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3401.378671][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:33 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1278, 0x0) 22:03:33 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff00000000040000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3401.406868][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3401.425462][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3401.439008][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3401.449043][ T2595] 00000010: 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3401.459265][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3401.468827][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3401.478254][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3401.487810][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3401.497406][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3401.506851][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3401.517039][ T6515] XFS (loop5): SB validate failed with error -117. 22:03:34 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x1279, 0x0) 22:03:34 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff00000000040000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3401.602439][ T6538] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3401.625922][ T6520] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:34 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000", 0x31}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3401.760965][ T6548] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3401.822765][ T6515] XFS (loop5): realtime geometry sanity check failed [ 3401.830353][ T6515] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3401.843055][ T6515] XFS (loop5): Unmount and run xfs_repair [ 3401.848983][ T6515] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3401.856737][ T6515] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3401.865761][ T6515] 00000010: 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3401.874811][ T6515] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3401.888214][ T6515] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3401.938270][ T6515] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3401.975283][ T6515] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3401.984183][ T6515] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3402.022015][ T6515] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3402.038436][ T6515] XFS (loop5): SB validate failed with error -117. 22:03:36 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:36 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x127a, 0x0) 22:03:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000fff00000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:36 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff00000000040000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:36 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff", 0x35}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:36 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000007000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3404.373347][ T6571] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:36 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x127b, 0x0) [ 3404.482122][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3404.493431][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:37 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff00000000040000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3404.529845][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3404.539563][ T6575] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3404.548143][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3404.554637][ T6579] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:37 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x127c, 0x0) [ 3404.599878][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3404.619063][ T2112] 00000010: 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3404.631429][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:03:37 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff", 0x35}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3404.649666][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:03:37 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000003f60000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3404.704584][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3404.735207][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3404.736940][ T6605] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. 22:03:37 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x127d, 0x0) [ 3404.744113][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3404.744125][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3404.744816][ T6573] XFS (loop5): SB validate failed with error -117. [ 3404.827898][ T6608] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3405.191172][ T6573] XFS (loop5): realtime geometry sanity check failed [ 3405.200563][ T6573] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3405.220667][ T6573] XFS (loop5): Unmount and run xfs_repair [ 3405.228932][ T6573] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3405.242181][ T6573] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3405.262814][ T6573] 00000010: 00 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3405.272095][ T6573] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3405.281268][ T6573] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3405.290943][ T6573] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3405.300047][ T6573] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3405.309258][ T6573] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3405.318790][ T6573] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3405.328363][ T6573] XFS (loop5): SB validate failed with error -117. 22:03:39 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:39 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff0000000004000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:39 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x127e, 0x0) 22:03:39 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f0ff0000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:39 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff", 0x35}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:39 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000008000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3407.409583][ T6643] __nla_validate_parse: 1 callbacks suppressed [ 3407.409595][ T6643] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. 22:03:39 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x127f, 0x0) [ 3407.455917][ T6645] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3407.474591][ T6644] XFS (loop5): realtime geometry sanity check failed [ 3407.497533][ T6644] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3407.519990][ T6644] XFS (loop5): Unmount and run xfs_repair [ 3407.529820][ T6644] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:03:39 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff0000000004000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3407.543547][ T6644] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3407.568008][ T6644] 00000010: 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3407.586480][ T6644] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3407.603269][ T6644] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:03:40 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x4b47, 0x0) [ 3407.614890][ T6644] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3407.633572][ T6644] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3407.680633][ T6644] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3407.693479][ T6666] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3407.705182][ T6658] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3407.720361][ T6644] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:03:40 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff0000000004000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:40 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff0000", 0x37}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:40 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x4b49, 0x0) [ 3407.768450][ T6644] XFS (loop5): SB validate failed with error -117. [ 3407.871088][ T6679] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3408.141911][ T6644] XFS (loop5): realtime geometry sanity check failed [ 3408.149113][ T6644] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3408.184218][ T6644] XFS (loop5): Unmount and run xfs_repair [ 3408.193193][ T6644] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3408.202654][ T6644] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3408.212941][ T6644] 00000010: 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3408.223193][ T6644] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3408.233208][ T6644] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3408.243231][ T6644] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3408.253165][ T6644] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3408.263237][ T6644] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3408.273429][ T6644] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3408.284098][ T6644] XFS (loop5): SB validate failed with error -117. 22:03:42 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x4c00, 0x0) 22:03:42 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000400300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:42 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:42 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x0, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:42 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000009000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:42 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff0000", 0x37}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3410.491225][ T6707] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:42 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x0, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:42 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x4c01, 0x0) [ 3410.618774][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3410.636448][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3410.659221][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3410.671717][ T6707] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3410.686110][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3410.693831][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3410.704805][ T3182] 00000010: 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3410.715403][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3410.724535][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3410.736843][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3410.747158][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3410.757445][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:03:43 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x0, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3410.767734][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3410.788390][ T6710] XFS (loop5): SB validate failed with error -117. 22:03:43 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x541b, 0x0) 22:03:43 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5421, 0x0) 22:03:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000d7a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:43 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:43 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff0000", 0x37}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3411.024682][ T6763] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3411.207802][T31280] XFS (loop5): realtime geometry sanity check failed [ 3411.225388][T31280] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3411.246006][T31280] XFS (loop5): Unmount and run xfs_repair [ 3411.252099][T31280] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3411.262069][T31280] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3411.273965][T31280] 00000010: 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3411.283997][T31280] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3411.294129][T31280] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3411.313604][ T6765] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3411.354292][T31280] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3411.420474][T31280] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3411.456278][T31280] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3411.472520][T31280] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3411.484086][ T6710] XFS (loop5): SB validate failed with error -117. 22:03:45 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:45 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5423, 0x0) 22:03:45 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000d8a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:45 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(0x0) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:45 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000a000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:46 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3413.581404][ T6803] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:46 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5450, 0x0) 22:03:46 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) socket(0x10, 0x8000000000000003, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3413.652591][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3413.677230][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:46 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5451, 0x0) [ 3413.745524][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3413.782305][ T6827] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:46 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) socket(0x10, 0x8000000000000003, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3413.813477][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3413.853303][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:03:46 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(0x0) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3413.893534][ T3182] 00000010: 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3413.924351][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3413.943408][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3413.962576][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3413.986467][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3414.008238][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3414.018931][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3414.034699][ T6813] XFS (loop5): SB validate failed with error -117. [ 3414.383092][ T6813] XFS (loop5): realtime geometry sanity check failed [ 3414.392955][ T6813] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3414.442336][ T6813] XFS (loop5): Unmount and run xfs_repair [ 3414.482301][ T6813] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3414.490929][ T6813] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3414.509507][ T6813] 00000010: 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3414.520582][ T6813] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3414.532149][ T6813] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3414.545209][ T6813] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3414.562502][ T6813] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3414.574306][ T6813] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3414.584732][ T6813] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3414.595383][ T6813] XFS (loop5): SB validate failed with error -117. 22:03:49 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:49 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) socket(0x10, 0x8000000000000003, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:49 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5452, 0x0) 22:03:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000d9a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:49 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(0x0) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:03:49 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000b000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:49 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5460, 0x0) 22:03:49 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, 0x0, 0x0, 0x8) [ 3416.709249][ T6882] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:49 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5501, 0x0) 22:03:49 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, 0x0, 0x0, 0x8) [ 3416.770120][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3416.795375][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:49 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x5509, 0x0) 22:03:49 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, 0x0, 0x0, 0x8) [ 3416.849760][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3416.880986][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3416.934946][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3416.977564][ T2112] 00000010: 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3417.000032][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3417.012290][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3417.029931][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3417.053417][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3417.073947][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3417.101940][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3417.112580][ T6880] XFS (loop5): SB validate failed with error -117. [ 3417.415805][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3417.427883][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3417.475316][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3417.482357][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3417.491712][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3417.501894][ T4206] 00000010: 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3417.511701][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3417.521641][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3417.532699][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3417.542848][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3417.552913][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3417.562702][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3417.573276][ T6880] XFS (loop5): SB validate failed with error -117. 22:03:52 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:52 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000daa00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:52 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x6364, 0x0) 22:03:52 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) 22:03:52 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 22:03:52 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000c000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3419.712850][ T6932] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3419.741078][ T6933] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:52 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 22:03:52 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x6612, 0x0) [ 3419.846154][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3419.858848][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:03:52 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x8912, 0x0) [ 3419.894084][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3419.908329][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3419.936611][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3419.956373][ T3182] 00000010: 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3419.969233][ T6956] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3419.983802][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:03:52 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 22:03:52 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x891b, 0x0) [ 3419.999458][ T6944] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3420.003734][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:03:52 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000dba00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3420.075205][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3420.103116][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3420.130936][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3420.152035][ T6968] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3420.165662][ T6970] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3420.170412][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3420.239593][ T6937] XFS (loop5): SB validate failed with error -117. [ 3420.303508][ T6970] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3420.526339][ T6937] XFS (loop5): realtime geometry sanity check failed [ 3420.533198][ T6937] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3420.546740][ T6937] XFS (loop5): Unmount and run xfs_repair [ 3420.552580][ T6937] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3420.561570][ T6937] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3420.571615][ T6937] 00000010: 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3420.581562][ T6937] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3420.591973][ T6937] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3420.601814][ T6937] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3420.613273][ T6937] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3420.624418][ T6937] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3420.635639][ T6937] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3420.644637][ T6937] XFS (loop5): SB validate failed with error -117. 22:03:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x8933, 0x0) 22:03:55 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:55 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) 22:03:55 executing program 1 (fault-call:2 fault-nth:0): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:55 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000dca00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:55 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000d000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3422.820059][ T6996] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3422.820313][ T6997] FAULT_INJECTION: forcing a failure. [ 3422.820313][ T6997] name failslab, interval 1, probability 0, space 0, times 0 [ 3422.856102][ T6997] CPU: 0 PID: 6997 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3422.864773][ T6997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3422.874847][ T6997] Call Trace: [ 3422.878151][ T6997] dump_stack+0x18f/0x20d [ 3422.882511][ T6997] should_fail.cold+0x5/0x14 [ 3422.887132][ T6997] should_failslab+0x5/0xf [ 3422.891564][ T6997] kmem_cache_alloc_node+0x257/0x3c0 [ 3422.896973][ T6997] __alloc_skb+0x71/0x550 [ 3422.901361][ T6997] netlink_sendmsg+0x94f/0xd90 [ 3422.906166][ T6997] ? netlink_unicast+0x7d0/0x7d0 [ 3422.911123][ T6997] ? netlink_unicast+0x7d0/0x7d0 [ 3422.916073][ T6997] sock_sendmsg+0xcf/0x120 [ 3422.920511][ T6997] ____sys_sendmsg+0x331/0x810 [ 3422.925304][ T6997] ? kernel_sendmsg+0x50/0x50 [ 3422.929991][ T6997] ? do_recvmmsg+0x6d0/0x6d0 [ 3422.934597][ T6997] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 3422.940596][ T6997] ? __lockdep_free_key_range+0x110/0x110 [ 3422.946334][ T6997] ___sys_sendmsg+0xf3/0x170 [ 3422.951037][ T6997] ? sendmsg_copy_msghdr+0x160/0x160 [ 3422.956336][ T6997] ? __fget_files+0x272/0x400 [ 3422.961029][ T6997] ? lock_downgrade+0x820/0x820 [ 3422.965914][ T6997] ? __fget_files+0x294/0x400 [ 3422.970607][ T6997] ? __fget_light+0xea/0x280 [ 3422.975213][ T6997] __sys_sendmmsg+0x195/0x480 [ 3422.979906][ T6997] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3422.984942][ T6997] ? lock_downgrade+0x820/0x820 [ 3422.989834][ T6997] ? vfs_write+0x397/0x6b0 [ 3422.994283][ T6997] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3422.999840][ T6997] ? lock_is_held_type+0xb0/0xe0 [ 3423.004794][ T6997] ? wait_for_completion+0x260/0x260 [ 3423.008481][ T7017] md0: error: bitmap file is already in use [ 3423.012290][ T6997] ? vfs_write+0x1b0/0x6b0 [ 3423.012310][ T6997] ? fput_many+0x2f/0x1a0 [ 3423.012325][ T6997] ? ksys_write+0x1a5/0x250 [ 3423.012345][ T6997] ? lock_is_held_type+0xb0/0xe0 [ 3423.012366][ T6997] __x64_sys_sendmmsg+0x99/0x100 [ 3423.012383][ T6997] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3423.012405][ T6997] do_syscall_64+0x60/0xe0 [ 3423.050937][ T6997] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3423.057028][ T6997] RIP: 0033:0x45cba9 [ 3423.060926][ T6997] Code: Bad RIP value. 22:03:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x4004092b, 0x0) 22:03:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40044620, 0x0) [ 3423.064997][ T6997] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3423.073457][ T6997] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3423.081452][ T6997] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3423.089439][ T6997] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3423.097426][ T6997] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3423.105419][ T6997] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 22:03:55 executing program 1 (fault-call:2 fault-nth:1): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3423.174841][ T6999] XFS (loop5): realtime geometry sanity check failed [ 3423.184333][ T6999] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3423.200213][ T6999] XFS (loop5): Unmount and run xfs_repair [ 3423.206614][ T6999] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3423.214253][ T6999] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ 22:03:55 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000dda00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3423.236706][ T7027] FAULT_INJECTION: forcing a failure. [ 3423.236706][ T7027] name failslab, interval 1, probability 0, space 0, times 0 [ 3423.268515][ T6999] 00000010: 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3423.279345][ T7027] CPU: 0 PID: 7027 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3423.287959][ T7027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3423.298025][ T7027] Call Trace: [ 3423.301349][ T7027] dump_stack+0x18f/0x20d [ 3423.305886][ T7027] should_fail.cold+0x5/0x14 [ 3423.310494][ T7027] should_failslab+0x5/0xf [ 3423.314924][ T7027] kmem_cache_alloc_node_trace+0x27d/0x400 [ 3423.320748][ T7027] __kmalloc_node_track_caller+0x38/0x60 [ 3423.325560][ T6999] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3423.326415][ T7027] __alloc_skb+0xae/0x550 [ 3423.326443][ T7027] netlink_sendmsg+0x94f/0xd90 [ 3423.345127][ T7027] ? netlink_unicast+0x7d0/0x7d0 [ 3423.350086][ T7027] ? netlink_unicast+0x7d0/0x7d0 [ 3423.355040][ T7027] sock_sendmsg+0xcf/0x120 [ 3423.359469][ T7027] ____sys_sendmsg+0x331/0x810 [ 3423.364245][ T7027] ? kernel_sendmsg+0x50/0x50 [ 3423.368933][ T7027] ? do_recvmmsg+0x6d0/0x6d0 [ 3423.371994][ T7033] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3423.373536][ T7027] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 3423.373558][ T7027] ? __lockdep_free_key_range+0x110/0x110 [ 3423.373577][ T7027] ___sys_sendmsg+0xf3/0x170 [ 3423.373593][ T7027] ? sendmsg_copy_msghdr+0x160/0x160 [ 3423.373615][ T7027] ? __fget_files+0x272/0x400 [ 3423.386639][ T6999] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3423.388904][ T7027] ? lock_downgrade+0x820/0x820 [ 3423.388935][ T7027] ? __fget_files+0x294/0x400 [ 3423.388957][ T7027] ? __fget_light+0xea/0x280 [ 3423.388979][ T7027] __sys_sendmmsg+0x195/0x480 [ 3423.412491][ T6999] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3423.418063][ T7027] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3423.418084][ T7027] ? lock_downgrade+0x820/0x820 [ 3423.418099][ T7027] ? vfs_write+0x397/0x6b0 [ 3423.418129][ T7027] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3423.418145][ T7027] ? lock_is_held_type+0xb0/0xe0 [ 3423.418163][ T7027] ? wait_for_completion+0x260/0x260 [ 3423.418179][ T7027] ? vfs_write+0x1b0/0x6b0 [ 3423.418199][ T7027] ? fput_many+0x2f/0x1a0 22:03:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x400454ca, 0x0) 22:03:55 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x2000000000000072, &(0x7f0000000080)) [ 3423.451013][ T6999] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3423.455737][ T7027] ? ksys_write+0x1a5/0x250 [ 3423.455760][ T7027] ? lock_is_held_type+0xb0/0xe0 [ 3423.455781][ T7027] __x64_sys_sendmmsg+0x99/0x100 [ 3423.455799][ T7027] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3423.455813][ T7027] do_syscall_64+0x60/0xe0 [ 3423.455829][ T7027] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3423.455841][ T7027] RIP: 0033:0x45cba9 [ 3423.455846][ T7027] Code: Bad RIP value. [ 3423.455854][ T7027] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3423.455875][ T7027] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3423.485203][ T6999] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3423.493614][ T7027] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3423.493624][ T7027] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3423.493632][ T7027] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 22:03:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40045506, 0x0) [ 3423.493642][ T7027] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3423.592930][ T6999] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3423.604230][ T6999] XFS (loop5): SB validate failed with error -117. [ 3423.775275][ T7033] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:58 executing program 1 (fault-call:2 fault-nth:2): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:58 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x4004550a, 0x0) 22:03:58 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:03:58 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x0, 0x0) 22:03:58 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000000e000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000dea00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3425.907144][ T7062] FAULT_INJECTION: forcing a failure. [ 3425.907144][ T7062] name failslab, interval 1, probability 0, space 0, times 0 [ 3425.926699][ T7061] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3425.937965][ T7062] CPU: 0 PID: 7062 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3425.946659][ T7062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3425.956926][ T7062] Call Trace: [ 3425.960236][ T7062] dump_stack+0x18f/0x20d [ 3425.964591][ T7062] should_fail.cold+0x5/0x14 [ 3425.969233][ T7062] should_failslab+0x5/0xf [ 3425.973667][ T7062] kmem_cache_alloc+0x40/0x3b0 [ 3425.978452][ T7062] skb_clone+0x14f/0x3c0 [ 3425.982723][ T7062] netlink_deliver_tap+0x990/0xb70 [ 3425.987853][ T7062] netlink_unicast+0x5e5/0x7d0 [ 3425.992645][ T7062] ? netlink_attachskb+0x810/0x810 [ 3425.997778][ T7062] ? _copy_from_iter_full+0x247/0x890 [ 3426.003173][ T7062] netlink_sendmsg+0x856/0xd90 [ 3426.007964][ T7062] ? netlink_unicast+0x7d0/0x7d0 [ 3426.012938][ T7062] ? netlink_unicast+0x7d0/0x7d0 [ 3426.017892][ T7062] sock_sendmsg+0xcf/0x120 [ 3426.022355][ T7062] ____sys_sendmsg+0x331/0x810 [ 3426.027151][ T7062] ? kernel_sendmsg+0x50/0x50 [ 3426.031857][ T7062] ? do_recvmmsg+0x6d0/0x6d0 [ 3426.036475][ T7062] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 3426.042471][ T7062] ? __lockdep_free_key_range+0x110/0x110 [ 3426.048226][ T7062] ___sys_sendmsg+0xf3/0x170 [ 3426.052829][ T7062] ? sendmsg_copy_msghdr+0x160/0x160 [ 3426.058127][ T7062] ? __fget_files+0x272/0x400 [ 3426.062816][ T7062] ? lock_downgrade+0x820/0x820 [ 3426.067693][ T7062] ? __fget_files+0x294/0x400 [ 3426.072387][ T7062] ? __fget_light+0xea/0x280 [ 3426.077004][ T7062] __sys_sendmmsg+0x195/0x480 [ 3426.081727][ T7062] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3426.086767][ T7062] ? lock_downgrade+0x820/0x820 [ 3426.091652][ T7062] ? vfs_write+0x397/0x6b0 [ 3426.096114][ T7062] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3426.101668][ T7062] ? lock_is_held_type+0xb0/0xe0 [ 3426.106616][ T7062] ? wait_for_completion+0x260/0x260 [ 3426.111919][ T7062] ? vfs_write+0x1b0/0x6b0 [ 3426.116346][ T7062] ? fput_many+0x2f/0x1a0 [ 3426.120707][ T7062] ? ksys_write+0x1a5/0x250 [ 3426.125241][ T7062] ? lock_is_held_type+0xb0/0xe0 [ 3426.130288][ T7062] __x64_sys_sendmmsg+0x99/0x100 [ 3426.135258][ T7062] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3426.140389][ T7062] do_syscall_64+0x60/0xe0 [ 3426.144820][ T7062] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3426.156142][ T7062] RIP: 0033:0x45cba9 [ 3426.160036][ T7062] Code: Bad RIP value. [ 3426.164104][ T7062] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3426.172542][ T7062] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3426.180519][ T7062] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3426.188498][ T7062] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3426.196480][ T7062] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 22:03:58 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40045568, 0x0) [ 3426.204459][ T7062] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 22:03:58 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3426.240109][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3426.248409][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3426.268064][ T7061] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000dfa00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:03:58 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40049409, 0x0) [ 3426.317239][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3426.372251][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3426.381144][ T7098] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3426.412991][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3426.451746][ T3182] 00000010: 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 22:03:58 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x0, 0x0) [ 3426.459165][ T7098] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3426.491667][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:03:59 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40081271, 0x0) [ 3426.553102][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3426.559453][ T7062] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:03:59 executing program 1 (fault-call:2 fault-nth:3): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:03:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e0a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3426.614929][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3426.646591][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3426.666523][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3426.692371][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:03:59 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x0, 0x0) [ 3426.733390][ T7121] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3426.748076][ T7060] XFS (loop5): SB validate failed with error -117. 22:03:59 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40085503, 0x0) [ 3426.816028][ T7124] FAULT_INJECTION: forcing a failure. [ 3426.816028][ T7124] name failslab, interval 1, probability 0, space 0, times 0 [ 3426.883846][ T7124] CPU: 1 PID: 7124 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3426.892495][ T7124] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3426.902555][ T7124] Call Trace: [ 3426.905863][ T7124] dump_stack+0x18f/0x20d [ 3426.910214][ T7124] should_fail.cold+0x5/0x14 [ 3426.914830][ T7124] should_failslab+0x5/0xf [ 3426.919268][ T7124] kmem_cache_alloc_node+0x257/0x3c0 [ 3426.924573][ T7124] __alloc_skb+0x71/0x550 [ 3426.928919][ T7124] netlink_sendmsg+0x94f/0xd90 [ 3426.933726][ T7124] ? netlink_unicast+0x7d0/0x7d0 [ 3426.938686][ T7124] ? netlink_unicast+0x7d0/0x7d0 [ 3426.943641][ T7124] sock_sendmsg+0xcf/0x120 [ 3426.948078][ T7124] ____sys_sendmsg+0x331/0x810 [ 3426.952861][ T7124] ? kernel_sendmsg+0x50/0x50 [ 3426.957551][ T7124] ? do_recvmmsg+0x6d0/0x6d0 [ 3426.962158][ T7124] ? __lock_acquire+0x16e3/0x56e0 [ 3426.967200][ T7124] ___sys_sendmsg+0xf3/0x170 [ 3426.970019][ T7122] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3426.971802][ T7124] ? sendmsg_copy_msghdr+0x160/0x160 [ 3426.971828][ T7124] ? __lockdep_free_key_range+0x110/0x110 [ 3426.971851][ T7124] ? lock_acquire+0x1f1/0xad0 [ 3426.996959][ T7124] ? __might_fault+0xef/0x1d0 [ 3427.001647][ T7124] ? find_held_lock+0x2d/0x110 [ 3427.006448][ T7124] ? __might_fault+0x11f/0x1d0 [ 3427.011225][ T7124] ? lock_downgrade+0x820/0x820 [ 3427.016090][ T7124] ? lock_is_held_type+0xb0/0xe0 [ 3427.021064][ T7124] __sys_sendmmsg+0x195/0x480 [ 3427.025748][ T7124] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3427.030781][ T7124] ? lock_downgrade+0x820/0x820 [ 3427.035658][ T7124] ? vfs_write+0x397/0x6b0 [ 3427.040113][ T7124] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3427.045666][ T7124] ? lock_is_held_type+0xb0/0xe0 [ 3427.050636][ T7124] ? wait_for_completion+0x260/0x260 [ 3427.055931][ T7124] ? vfs_write+0x1b0/0x6b0 [ 3427.060357][ T7124] ? fput_many+0x2f/0x1a0 [ 3427.064724][ T7124] ? ksys_write+0x1a5/0x250 [ 3427.069293][ T7124] ? lock_is_held_type+0xb0/0xe0 [ 3427.074242][ T7124] __x64_sys_sendmmsg+0x99/0x100 [ 3427.079192][ T7124] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3427.084350][ T7124] do_syscall_64+0x60/0xe0 [ 3427.088784][ T7124] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3427.094677][ T7124] RIP: 0033:0x45cba9 [ 3427.098565][ T7124] Code: Bad RIP value. [ 3427.102630][ T7124] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3427.111051][ T7124] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3427.119061][ T7124] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3427.127053][ T7124] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 22:03:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e1a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3427.135048][ T7124] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3427.143059][ T7124] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3427.289528][ T7140] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:03:59 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000010000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:03:59 executing program 1 (fault-call:2 fault-nth:4): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3427.362862][ T7140] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3427.449834][ T7151] FAULT_INJECTION: forcing a failure. [ 3427.449834][ T7151] name failslab, interval 1, probability 0, space 0, times 0 [ 3427.462714][ T7151] CPU: 0 PID: 7151 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3427.471311][ T7151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3427.481374][ T7151] Call Trace: [ 3427.484685][ T7151] dump_stack+0x18f/0x20d [ 3427.489034][ T7151] should_fail.cold+0x5/0x14 [ 3427.490191][ T7153] XFS (loop5): realtime geometry sanity check failed [ 3427.493651][ T7151] should_failslab+0x5/0xf [ 3427.493673][ T7151] kmem_cache_alloc_node_trace+0x27d/0x400 [ 3427.493699][ T7151] __kmalloc_node_track_caller+0x38/0x60 [ 3427.493723][ T7151] __alloc_skb+0xae/0x550 [ 3427.503566][ T7153] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3427.504810][ T7151] netlink_sendmsg+0x94f/0xd90 [ 3427.504833][ T7151] ? netlink_unicast+0x7d0/0x7d0 [ 3427.504858][ T7151] ? netlink_unicast+0x7d0/0x7d0 [ 3427.504881][ T7151] sock_sendmsg+0xcf/0x120 [ 3427.528532][ T7153] XFS (loop5): Unmount and run xfs_repair [ 3427.532386][ T7151] ____sys_sendmsg+0x331/0x810 [ 3427.532410][ T7151] ? kernel_sendmsg+0x50/0x50 [ 3427.532423][ T7151] ? do_recvmmsg+0x6d0/0x6d0 [ 3427.532444][ T7151] ? __lock_acquire+0x16e3/0x56e0 [ 3427.532465][ T7151] ___sys_sendmsg+0xf3/0x170 [ 3427.548941][ T7153] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3427.551474][ T7151] ? sendmsg_copy_msghdr+0x160/0x160 [ 3427.551498][ T7151] ? __lockdep_free_key_range+0x110/0x110 [ 3427.551518][ T7151] ? lock_acquire+0x1f1/0xad0 [ 3427.551536][ T7151] ? __might_fault+0xef/0x1d0 [ 3427.564790][ T7153] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3427.566644][ T7151] ? find_held_lock+0x2d/0x110 [ 3427.566662][ T7151] ? __might_fault+0x11f/0x1d0 [ 3427.566681][ T7151] ? lock_downgrade+0x820/0x820 [ 3427.566707][ T7151] ? lock_is_held_type+0xb0/0xe0 [ 3427.566733][ T7151] __sys_sendmmsg+0x195/0x480 [ 3427.566752][ T7151] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3427.566768][ T7151] ? lock_downgrade+0x820/0x820 [ 3427.566783][ T7151] ? vfs_write+0x397/0x6b0 [ 3427.566811][ T7151] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3427.566826][ T7151] ? lock_is_held_type+0xb0/0xe0 [ 3427.566845][ T7151] ? wait_for_completion+0x260/0x260 [ 3427.582182][ T7153] 00000010: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3427.588368][ T7151] ? vfs_write+0x1b0/0x6b0 [ 3427.588386][ T7151] ? fput_many+0x2f/0x1a0 [ 3427.588401][ T7151] ? ksys_write+0x1a5/0x250 [ 3427.588422][ T7151] ? lock_is_held_type+0xb0/0xe0 [ 3427.588444][ T7151] __x64_sys_sendmmsg+0x99/0x100 [ 3427.588460][ T7151] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3427.588474][ T7151] do_syscall_64+0x60/0xe0 [ 3427.588490][ T7151] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3427.588502][ T7151] RIP: 0033:0x45cba9 [ 3427.588508][ T7151] Code: Bad RIP value. [ 3427.588516][ T7151] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3427.588530][ T7151] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3427.588546][ T7151] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3427.607493][ T7153] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3427.608837][ T7151] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3427.608847][ T7151] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3427.608856][ T7151] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3427.784717][ T7153] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3427.796398][ T7153] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3427.812868][ T7153] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3427.823534][ T7153] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3427.833038][ T7153] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3427.842658][ T7153] XFS (loop5): SB validate failed with error -117. [ 3428.164024][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3428.182017][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3428.215258][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3428.221021][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3428.230217][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3428.239690][ T4206] 00000010: 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3428.248925][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3428.264017][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3428.297061][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3428.316565][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3428.345186][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3428.354058][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3428.390587][ T7153] XFS (loop5): SB validate failed with error -117. 22:04:01 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:01 executing program 2 (fault-call:9 fault-nth:0): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:01 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40086602, 0x0) 22:04:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e2a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:01 executing program 1 (fault-call:2 fault-nth:5): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:01 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000023000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:01 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40087602, 0x0) [ 3429.378660][ T7187] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3429.427173][ T7190] FAULT_INJECTION: forcing a failure. [ 3429.427173][ T7190] name failslab, interval 1, probability 0, space 0, times 0 [ 3429.470621][ T7188] XFS (loop5): realtime geometry sanity check failed [ 3429.475141][ T7190] CPU: 0 PID: 7190 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3429.482275][ T7188] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3429.485930][ T7190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3429.485938][ T7190] Call Trace: [ 3429.485963][ T7190] dump_stack+0x18f/0x20d [ 3429.485996][ T7190] should_fail.cold+0x5/0x14 [ 3429.486020][ T7190] should_failslab+0x5/0xf [ 3429.486038][ T7190] kmem_cache_alloc+0x40/0x3b0 [ 3429.486061][ T7190] skb_clone+0x14f/0x3c0 [ 3429.486082][ T7190] netlink_deliver_tap+0x990/0xb70 [ 3429.486108][ T7190] netlink_unicast+0x5e5/0x7d0 [ 3429.486132][ T7190] ? netlink_attachskb+0x810/0x810 [ 3429.486148][ T7190] ? _copy_from_iter_full+0x247/0x890 [ 3429.486181][ T7190] netlink_sendmsg+0x856/0xd90 [ 3429.486205][ T7190] ? netlink_unicast+0x7d0/0x7d0 [ 3429.486233][ T7190] ? netlink_unicast+0x7d0/0x7d0 [ 3429.486262][ T7190] sock_sendmsg+0xcf/0x120 [ 3429.534047][ T7188] XFS (loop5): Unmount and run xfs_repair [ 3429.538731][ T7190] ____sys_sendmsg+0x331/0x810 [ 3429.538754][ T7190] ? kernel_sendmsg+0x50/0x50 [ 3429.538765][ T7190] ? do_recvmmsg+0x6d0/0x6d0 [ 3429.538786][ T7190] ? __lock_acquire+0x16e3/0x56e0 [ 3429.538809][ T7190] ___sys_sendmsg+0xf3/0x170 [ 3429.538826][ T7190] ? sendmsg_copy_msghdr+0x160/0x160 [ 3429.538844][ T7190] ? __lockdep_free_key_range+0x110/0x110 [ 3429.538863][ T7190] ? lock_acquire+0x1f1/0xad0 22:04:02 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40095505, 0x0) [ 3429.538878][ T7190] ? __might_fault+0xef/0x1d0 [ 3429.538897][ T7190] ? find_held_lock+0x2d/0x110 [ 3429.557490][ T7188] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3429.558905][ T7190] ? __might_fault+0x11f/0x1d0 [ 3429.558930][ T7190] ? lock_downgrade+0x820/0x820 [ 3429.558955][ T7190] ? lock_is_held_type+0xb0/0xe0 [ 3429.558989][ T7190] __sys_sendmmsg+0x195/0x480 [ 3429.568545][ T7188] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3429.569887][ T7190] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3429.569907][ T7190] ? lock_downgrade+0x820/0x820 [ 3429.569922][ T7190] ? vfs_write+0x397/0x6b0 [ 3429.569953][ T7190] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3429.579371][ T7188] 00000010: 00 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .#.............. [ 3429.580059][ T7190] ? lock_is_held_type+0xb0/0xe0 [ 3429.606498][ T7188] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3429.608914][ T7190] ? wait_for_completion+0x260/0x260 [ 3429.608935][ T7190] ? vfs_write+0x1b0/0x6b0 [ 3429.608958][ T7190] ? fput_many+0x2f/0x1a0 [ 3429.617978][ T7188] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3429.619330][ T7190] ? ksys_write+0x1a5/0x250 [ 3429.619352][ T7190] ? lock_is_held_type+0xb0/0xe0 [ 3429.619374][ T7190] __x64_sys_sendmmsg+0x99/0x100 [ 3429.619394][ T7190] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3429.624855][ T7188] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3429.628819][ T7190] do_syscall_64+0x60/0xe0 [ 3429.628837][ T7190] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3429.628849][ T7190] RIP: 0033:0x45cba9 [ 3429.628855][ T7190] Code: Bad RIP value. [ 3429.628863][ T7190] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3429.628878][ T7190] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3429.628888][ T7190] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3429.628897][ T7190] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3429.628906][ T7190] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3429.628914][ T7190] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3429.660728][ T7192] FAULT_INJECTION: forcing a failure. [ 3429.660728][ T7192] name failslab, interval 1, probability 0, space 0, times 0 [ 3429.698931][ T7188] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3429.766425][ T7192] CPU: 0 PID: 7192 Comm: syz-executor.2 Not tainted 5.8.0-rc4-syzkaller #0 [ 3429.828248][ T7188] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... 22:04:02 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x400c0930, 0x0) [ 3429.838153][ T7192] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3429.838161][ T7192] Call Trace: [ 3429.838187][ T7192] dump_stack+0x18f/0x20d [ 3429.838207][ T7192] should_fail.cold+0x5/0x14 [ 3429.838232][ T7192] should_failslab+0x5/0xf [ 3429.838248][ T7192] kmem_cache_alloc+0x2a9/0x3b0 [ 3429.838331][ T7192] io_submit_one+0x100/0x1ff0 [ 3429.838357][ T7192] ? lock_acquire+0x1f1/0xad0 [ 3429.854425][ T7188] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3429.855773][ T7192] ? __might_fault+0xef/0x1d0 [ 3429.855790][ T7192] ? find_held_lock+0x2d/0x110 [ 3429.855808][ T7192] ? ioctx_alloc+0x1d70/0x1d70 [ 3429.855827][ T7192] ? lock_downgrade+0x820/0x820 [ 3429.855840][ T7192] ? lock_downgrade+0x820/0x820 [ 3429.855870][ T7192] __x64_sys_io_submit+0x19a/0x4f0 [ 3429.855889][ T7192] ? __ia32_sys_io_destroy+0x3c0/0x3c0 [ 3429.855903][ T7192] ? fput_many+0x2f/0x1a0 [ 3429.855927][ T7192] ? lock_is_held_type+0xb0/0xe0 [ 3429.871772][ T7188] XFS (loop5): SB validate failed with error -117. [ 3429.874818][ T7192] ? do_syscall_64+0x1c/0xe0 22:04:02 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40101283, 0x0) [ 3429.874837][ T7192] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3429.874857][ T7192] do_syscall_64+0x60/0xe0 [ 3429.979457][ T7192] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3429.985358][ T7192] RIP: 0033:0x45cba9 [ 3429.989241][ T7192] Code: Bad RIP value. [ 3429.993302][ T7192] RSP: 002b:00007f0127aabc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 3430.001715][ T7192] RAX: ffffffffffffffda RBX: 00000000004e1ec0 RCX: 000000000045cba9 [ 3430.009692][ T7192] RDX: 0000000020000080 RSI: 2000000000000072 RDI: 00007f0127a6a000 22:04:02 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e3a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:02 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40101286, 0x0) [ 3430.017685][ T7192] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3430.025682][ T7192] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 3430.033742][ T7192] R13: 0000000000000207 R14: 00000000004c46af R15: 00007f0127aac6d4 22:04:04 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:04 executing program 1 (fault-call:2 fault-nth:6): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:04 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40101288, 0x0) 22:04:04 executing program 2 (fault-call:9 fault-nth:1): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e4a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:04 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000027000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:04 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x401070c9, 0x0) [ 3432.459494][ T7239] __nla_validate_parse: 4 callbacks suppressed [ 3432.459505][ T7239] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3432.491380][ T7242] FAULT_INJECTION: forcing a failure. [ 3432.491380][ T7242] name failslab, interval 1, probability 0, space 0, times 0 [ 3432.510744][ T7242] CPU: 0 PID: 7242 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3432.519371][ T7242] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3432.529437][ T7242] Call Trace: [ 3432.532739][ T7242] dump_stack+0x18f/0x20d [ 3432.537089][ T7242] should_fail.cold+0x5/0x14 [ 3432.541694][ T7242] should_failslab+0x5/0xf [ 3432.546121][ T7242] kmem_cache_alloc_node_trace+0x27d/0x400 [ 3432.551971][ T7242] __kmalloc_node_track_caller+0x38/0x60 [ 3432.557645][ T7242] __alloc_skb+0xae/0x550 [ 3432.562004][ T7242] netlink_sendmsg+0x94f/0xd90 [ 3432.566780][ T7242] ? netlink_unicast+0x7d0/0x7d0 [ 3432.571729][ T7242] ? netlink_unicast+0x7d0/0x7d0 [ 3432.576673][ T7242] sock_sendmsg+0xcf/0x120 [ 3432.581132][ T7242] ____sys_sendmsg+0x331/0x810 [ 3432.585912][ T7242] ? kernel_sendmsg+0x50/0x50 [ 3432.590600][ T7242] ? do_recvmmsg+0x6d0/0x6d0 [ 3432.595213][ T7242] ? __lock_acquire+0x16e3/0x56e0 [ 3432.600263][ T7242] ___sys_sendmsg+0xf3/0x170 [ 3432.604879][ T7242] ? sendmsg_copy_msghdr+0x160/0x160 [ 3432.610180][ T7242] ? __lockdep_free_key_range+0x110/0x110 [ 3432.615930][ T7242] ? lock_acquire+0x1f1/0xad0 [ 3432.620621][ T7242] ? __might_fault+0xef/0x1d0 [ 3432.625308][ T7242] ? find_held_lock+0x2d/0x110 [ 3432.630086][ T7242] ? __might_fault+0x11f/0x1d0 [ 3432.634872][ T7242] ? lock_downgrade+0x820/0x820 [ 3432.639735][ T7242] ? lock_is_held_type+0xb0/0xe0 [ 3432.644693][ T7242] __sys_sendmmsg+0x195/0x480 [ 3432.649376][ T7242] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3432.654414][ T7242] ? lock_downgrade+0x820/0x820 [ 3432.659271][ T7242] ? vfs_write+0x397/0x6b0 [ 3432.662077][ T7244] FAULT_INJECTION: forcing a failure. [ 3432.662077][ T7244] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3432.663699][ T7242] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3432.682431][ T7242] ? lock_is_held_type+0xb0/0xe0 [ 3432.687374][ T7242] ? wait_for_completion+0x260/0x260 [ 3432.692659][ T7242] ? vfs_write+0x1b0/0x6b0 [ 3432.697082][ T7242] ? fput_many+0x2f/0x1a0 [ 3432.701408][ T7242] ? ksys_write+0x1a5/0x250 [ 3432.705914][ T7242] ? lock_is_held_type+0xb0/0xe0 [ 3432.710872][ T7242] __x64_sys_sendmmsg+0x99/0x100 [ 3432.715820][ T7242] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3432.720961][ T7242] do_syscall_64+0x60/0xe0 [ 3432.725382][ T7242] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3432.731274][ T7242] RIP: 0033:0x45cba9 [ 3432.735157][ T7242] Code: Bad RIP value. [ 3432.739214][ T7242] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3432.747633][ T7242] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 22:04:05 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x401070ca, 0x0) [ 3432.755611][ T7242] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3432.763582][ T7242] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3432.771562][ T7242] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3432.779561][ T7242] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3432.787607][ T7244] CPU: 1 PID: 7244 Comm: syz-executor.2 Not tainted 5.8.0-rc4-syzkaller #0 [ 3432.796222][ T7244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3432.806344][ T7244] Call Trace: [ 3432.809654][ T7244] dump_stack+0x18f/0x20d [ 3432.814029][ T7244] should_fail.cold+0x5/0x14 [ 3432.818653][ T7244] __alloc_pages_nodemask+0x1a3/0x930 [ 3432.824094][ T7244] ? perf_trace_lock+0xeb/0x4a0 [ 3432.828972][ T7244] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3432.835746][ T7244] ? __lockdep_free_key_range+0x110/0x110 [ 3432.841486][ T7244] ? lock_acquire+0x1f1/0xad0 [ 3432.846170][ T7244] ? fs_reclaim_acquire+0xf/0x40 [ 3432.851129][ T7244] ? find_held_lock+0x2d/0x110 [ 3432.855925][ T7244] cache_grow_begin+0x8c/0xb20 22:04:05 executing program 1 (fault-call:2 fault-nth:7): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3432.860714][ T7244] ? cache_alloc_pfmemalloc+0x1e/0x140 [ 3432.866185][ T7244] cache_alloc_refill+0x27b/0x340 [ 3432.871232][ T7244] ? lockdep_hardirqs_off+0x66/0xa0 [ 3432.876445][ T7244] kmem_cache_alloc+0x38e/0x3b0 [ 3432.881312][ T7244] io_submit_one+0x100/0x1ff0 [ 3432.886009][ T7244] ? lock_acquire+0x1f1/0xad0 [ 3432.890693][ T7244] ? __might_fault+0xef/0x1d0 [ 3432.895381][ T7244] ? find_held_lock+0x2d/0x110 [ 3432.900155][ T7244] ? ioctx_alloc+0x1d70/0x1d70 [ 3432.904932][ T7244] ? lock_downgrade+0x820/0x820 [ 3432.909786][ T7244] ? lock_downgrade+0x820/0x820 [ 3432.914668][ T7244] __x64_sys_io_submit+0x19a/0x4f0 [ 3432.919795][ T7244] ? __ia32_sys_io_destroy+0x3c0/0x3c0 [ 3432.925265][ T7244] ? fput_many+0x2f/0x1a0 [ 3432.929618][ T7244] ? lock_is_held_type+0xb0/0xe0 [ 3432.934566][ T7244] ? do_syscall_64+0x1c/0xe0 [ 3432.939169][ T7244] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3432.943952][ T7260] FAULT_INJECTION: forcing a failure. [ 3432.943952][ T7260] name failslab, interval 1, probability 0, space 0, times 0 [ 3432.945192][ T7244] do_syscall_64+0x60/0xe0 [ 3432.945211][ T7244] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3432.945225][ T7244] RIP: 0033:0x45cba9 [ 3432.945230][ T7244] Code: Bad RIP value. [ 3432.945238][ T7244] RSP: 002b:00007f0127aabc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 3432.945252][ T7244] RAX: ffffffffffffffda RBX: 00000000004e1ec0 RCX: 000000000045cba9 [ 3432.945261][ T7244] RDX: 0000000020000080 RSI: 2000000000000072 RDI: 00007f0127a8b000 [ 3432.945269][ T7244] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 22:04:05 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 3432.945276][ T7244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 3432.945285][ T7244] R13: 0000000000000207 R14: 00000000004c46af R15: 00007f0127aac6d4 22:04:05 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e5a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3433.078155][ T7260] CPU: 0 PID: 7260 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3433.086867][ T7260] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3433.096954][ T7260] Call Trace: [ 3433.100271][ T7260] dump_stack+0x18f/0x20d [ 3433.104624][ T7260] should_fail.cold+0x5/0x14 [ 3433.105737][T31280] XFS (loop5): realtime geometry sanity check failed [ 3433.109234][ T7260] should_failslab+0x5/0xf [ 3433.109257][ T7260] kmem_cache_alloc_node_trace+0x27d/0x400 [ 3433.109284][ T7260] __kmalloc_node_track_caller+0x38/0x60 [ 3433.109305][ T7260] __alloc_skb+0xae/0x550 [ 3433.109326][ T7260] netlink_sendmsg+0x94f/0xd90 [ 3433.109351][ T7260] ? netlink_unicast+0x7d0/0x7d0 [ 3433.145053][T31280] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3433.146019][ T7260] ? netlink_unicast+0x7d0/0x7d0 [ 3433.146038][ T7260] sock_sendmsg+0xcf/0x120 [ 3433.146055][ T7260] ____sys_sendmsg+0x331/0x810 [ 3433.146075][ T7260] ? kernel_sendmsg+0x50/0x50 [ 3433.146088][ T7260] ? do_recvmmsg+0x6d0/0x6d0 [ 3433.146109][ T7260] ? __lock_acquire+0x16e3/0x56e0 [ 3433.146133][ T7260] ___sys_sendmsg+0xf3/0x170 [ 3433.146153][ T7260] ? sendmsg_copy_msghdr+0x160/0x160 [ 3433.166964][T31280] XFS (loop5): Unmount and run xfs_repair [ 3433.167291][ T7260] ? __lockdep_free_key_range+0x110/0x110 [ 3433.167314][ T7260] ? lock_acquire+0x1f1/0xad0 [ 3433.167329][ T7260] ? __might_fault+0xef/0x1d0 [ 3433.167343][ T7260] ? find_held_lock+0x2d/0x110 [ 3433.167361][ T7260] ? __might_fault+0x11f/0x1d0 [ 3433.173698][T31280] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3433.176781][ T7260] ? lock_downgrade+0x820/0x820 [ 3433.176810][ T7260] ? lock_is_held_type+0xb0/0xe0 [ 3433.176835][ T7260] __sys_sendmmsg+0x195/0x480 [ 3433.176855][ T7260] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3433.176870][ T7260] ? lock_downgrade+0x820/0x820 [ 3433.176884][ T7260] ? vfs_write+0x397/0x6b0 [ 3433.176911][ T7260] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3433.176932][ T7260] ? lock_is_held_type+0xb0/0xe0 [ 3433.182866][T31280] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3433.186542][ T7260] ? wait_for_completion+0x260/0x260 [ 3433.186562][ T7260] ? vfs_write+0x1b0/0x6b0 [ 3433.186581][ T7260] ? fput_many+0x2f/0x1a0 [ 3433.186596][ T7260] ? ksys_write+0x1a5/0x250 [ 3433.186614][ T7260] ? lock_is_held_type+0xb0/0xe0 [ 3433.186634][ T7260] __x64_sys_sendmmsg+0x99/0x100 [ 3433.186650][ T7260] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3433.186664][ T7260] do_syscall_64+0x60/0xe0 [ 3433.186688][ T7260] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3433.192789][T31280] 00000010: 00 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .'.............. [ 3433.196546][ T7260] RIP: 0033:0x45cba9 [ 3433.196553][ T7260] Code: Bad RIP value. [ 3433.196561][ T7260] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3433.196576][ T7260] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3433.196585][ T7260] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3433.196594][ T7260] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 22:04:05 executing program 2 (fault-call:9 fault-nth:2): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3433.196603][ T7260] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3433.196612][ T7260] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3433.313790][ T7272] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:05 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x401070cd, 0x0) [ 3433.575779][ T7277] FAULT_INJECTION: forcing a failure. [ 3433.575779][ T7277] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3433.589025][ T7277] CPU: 0 PID: 7277 Comm: syz-executor.2 Not tainted 5.8.0-rc4-syzkaller #0 [ 3433.597611][ T7277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3433.607673][ T7277] Call Trace: [ 3433.610988][ T7277] dump_stack+0x18f/0x20d [ 3433.615341][ T7277] should_fail.cold+0x5/0x14 [ 3433.620045][ T7277] __alloc_pages_nodemask+0x1a3/0x930 [ 3433.625443][ T7277] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3433.632222][ T7277] ? find_held_lock+0x2d/0x110 [ 3433.637016][ T7277] ? lock_downgrade+0x820/0x820 [ 3433.641888][ T7277] cache_grow_begin+0x8c/0xb20 [ 3433.646677][ T7277] ____cache_alloc_node+0x171/0x1d0 [ 3433.651894][ T7277] kmem_cache_alloc+0x1f2/0x3b0 [ 3433.656761][ T7277] io_submit_one+0x100/0x1ff0 [ 3433.661464][ T7277] ? lock_acquire+0x1f1/0xad0 [ 3433.666159][ T7277] ? __might_fault+0xef/0x1d0 [ 3433.670846][ T7277] ? find_held_lock+0x2d/0x110 [ 3433.675331][T31280] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3433.675647][ T7277] ? ioctx_alloc+0x1d70/0x1d70 [ 3433.689235][ T7277] ? lock_downgrade+0x820/0x820 [ 3433.694097][ T7277] ? lock_downgrade+0x820/0x820 [ 3433.699000][ T7277] __x64_sys_io_submit+0x19a/0x4f0 [ 3433.704145][ T7277] ? __ia32_sys_io_destroy+0x3c0/0x3c0 [ 3433.709616][ T7277] ? fput_many+0x2f/0x1a0 [ 3433.713021][T31280] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3433.713957][ T7277] ? lock_is_held_type+0xb0/0xe0 [ 3433.727725][ T7277] ? do_syscall_64+0x1c/0xe0 [ 3433.727794][T31280] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3433.732320][ T7277] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3433.732342][ T7277] do_syscall_64+0x60/0xe0 [ 3433.732362][ T7277] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3433.745491][T31280] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3433.747169][ T7277] RIP: 0033:0x45cba9 [ 3433.747177][ T7277] Code: Bad RIP value. 22:04:06 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40140921, 0x0) 22:04:06 executing program 1 (fault-call:2 fault-nth:8): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3433.747185][ T7277] RSP: 002b:00007f0127aabc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 3433.752122][T31280] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3433.757472][ T7277] RAX: ffffffffffffffda RBX: 00000000004e1ec0 RCX: 000000000045cba9 [ 3433.757482][ T7277] RDX: 0000000020000080 RSI: 2000000000000072 RDI: 00007f0127a6a000 [ 3433.757490][ T7277] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3433.757498][ T7277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 3433.757506][ T7277] R13: 0000000000000207 R14: 00000000004c46af R15: 00007f0127aac6d4 22:04:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e6a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:06 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40186366, 0x0) [ 3433.890267][T31280] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3433.909989][ T7241] XFS (loop5): SB validate failed with error -117. [ 3433.939667][ T7297] FAULT_INJECTION: forcing a failure. [ 3433.939667][ T7297] name failslab, interval 1, probability 0, space 0, times 0 [ 3433.977898][ T7297] CPU: 1 PID: 7297 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3433.986521][ T7297] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3433.996588][ T7297] Call Trace: [ 3433.999904][ T7297] dump_stack+0x18f/0x20d [ 3434.004263][ T7297] should_fail.cold+0x5/0x14 [ 3434.008880][ T7297] should_failslab+0x5/0xf [ 3434.013330][ T7297] kmem_cache_alloc+0x40/0x3b0 [ 3434.018111][ T7297] skb_clone+0x14f/0x3c0 [ 3434.022366][ T7297] netlink_deliver_tap+0x990/0xb70 [ 3434.027497][ T7297] netlink_unicast+0x5e5/0x7d0 [ 3434.032279][ T7297] ? netlink_attachskb+0x810/0x810 [ 3434.037404][ T7297] ? _copy_from_iter_full+0x247/0x890 [ 3434.042807][ T7297] netlink_sendmsg+0x856/0xd90 [ 3434.047593][ T7297] ? netlink_unicast+0x7d0/0x7d0 [ 3434.052251][ T7303] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3434.052567][ T7297] ? netlink_unicast+0x7d0/0x7d0 [ 3434.066784][ T7297] sock_sendmsg+0xcf/0x120 [ 3434.071210][ T7297] ____sys_sendmsg+0x331/0x810 [ 3434.075982][ T7297] ? kernel_sendmsg+0x50/0x50 [ 3434.080658][ T7297] ? do_recvmmsg+0x6d0/0x6d0 [ 3434.085267][ T7297] ? __lock_acquire+0x16e3/0x56e0 [ 3434.090337][ T7297] ___sys_sendmsg+0xf3/0x170 [ 3434.094934][ T7297] ? sendmsg_copy_msghdr+0x160/0x160 [ 3434.100337][ T7297] ? __lockdep_free_key_range+0x110/0x110 [ 3434.106070][ T7297] ? lock_acquire+0x1f1/0xad0 [ 3434.110749][ T7297] ? __might_fault+0xef/0x1d0 [ 3434.115457][ T7297] ? find_held_lock+0x2d/0x110 [ 3434.120222][ T7297] ? __might_fault+0x11f/0x1d0 [ 3434.125082][ T7297] ? lock_downgrade+0x820/0x820 [ 3434.129948][ T7297] ? lock_is_held_type+0xb0/0xe0 [ 3434.134901][ T7297] __sys_sendmmsg+0x195/0x480 [ 3434.138898][ T7306] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3434.139586][ T7297] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3434.139605][ T7297] ? lock_downgrade+0x820/0x820 [ 3434.139621][ T7297] ? vfs_write+0x397/0x6b0 [ 3434.139657][ T7297] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3434.168723][ T7297] ? lock_is_held_type+0xb0/0xe0 [ 3434.173674][ T7297] ? wait_for_completion+0x260/0x260 [ 3434.178972][ T7297] ? vfs_write+0x1b0/0x6b0 [ 3434.183401][ T7297] ? fput_many+0x2f/0x1a0 [ 3434.187747][ T7297] ? ksys_write+0x1a5/0x250 [ 3434.192265][ T7297] ? lock_is_held_type+0xb0/0xe0 [ 3434.197224][ T7297] __x64_sys_sendmmsg+0x99/0x100 [ 3434.202182][ T7297] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3434.207299][ T7297] do_syscall_64+0x60/0xe0 [ 3434.211718][ T7297] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3434.217633][ T7297] RIP: 0033:0x45cba9 [ 3434.221523][ T7297] Code: Bad RIP value. [ 3434.225588][ T7297] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3434.233992][ T7297] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3434.241948][ T7297] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3434.249904][ T7297] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3434.257879][ T7297] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3434.265868][ T7297] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3434.284358][ T7297] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:04:06 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000036000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:06 executing program 2 (fault-call:9 fault-nth:3): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:06 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x401870c8, 0x0) 22:04:06 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e7a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3434.650795][ T7317] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3434.664442][ T7318] FAULT_INJECTION: forcing a failure. [ 3434.664442][ T7318] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 3434.708135][ T7318] CPU: 1 PID: 7318 Comm: syz-executor.2 Not tainted 5.8.0-rc4-syzkaller #0 [ 3434.716769][ T7318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3434.726839][ T7318] Call Trace: [ 3434.730148][ T7318] dump_stack+0x18f/0x20d [ 3434.734492][ T7318] should_fail.cold+0x5/0x14 [ 3434.739109][ T7318] __alloc_pages_nodemask+0x1a3/0x930 [ 3434.744507][ T7318] ? rcu_read_lock_sched_held+0x3a/0xb0 [ 3434.750071][ T7318] ? __alloc_pages_nodemask+0x6b1/0x930 [ 3434.755655][ T7318] ? __alloc_pages_slowpath.constprop.0+0x2780/0x2780 [ 3434.762443][ T7318] ? cache_grow_begin+0x3cb/0xb20 [ 3434.767495][ T7318] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3434.773505][ T7318] cache_grow_begin+0x8c/0xb20 [ 3434.778295][ T7318] ? cache_grow_begin+0x8c/0xb20 [ 3434.783258][ T7318] fallback_alloc+0x205/0x2d0 [ 3434.787971][ T7318] kmem_cache_alloc+0x1f2/0x3b0 [ 3434.792865][ T7318] io_submit_one+0x100/0x1ff0 [ 3434.797561][ T7318] ? lock_acquire+0x1f1/0xad0 [ 3434.802254][ T7318] ? __might_fault+0xef/0x1d0 [ 3434.806953][ T7318] ? find_held_lock+0x2d/0x110 [ 3434.811747][ T7318] ? ioctx_alloc+0x1d70/0x1d70 [ 3434.816539][ T7318] ? lock_downgrade+0x820/0x820 [ 3434.821409][ T7318] ? lock_downgrade+0x820/0x820 [ 3434.826343][ T7318] __x64_sys_io_submit+0x19a/0x4f0 [ 3434.831493][ T7318] ? __ia32_sys_io_destroy+0x3c0/0x3c0 [ 3434.836978][ T7318] ? fput_many+0x2f/0x1a0 [ 3434.841369][ T7318] ? lock_is_held_type+0xb0/0xe0 [ 3434.846328][ T7318] ? do_syscall_64+0x1c/0xe0 [ 3434.850930][ T7318] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3434.856922][ T7318] do_syscall_64+0x60/0xe0 [ 3434.861346][ T7318] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3434.867263][ T7318] RIP: 0033:0x45cba9 [ 3434.871171][ T7318] Code: Bad RIP value. [ 3434.875244][ T7318] RSP: 002b:00007f0127aabc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 3434.883694][ T7318] RAX: ffffffffffffffda RBX: 00000000004e1ec0 RCX: 000000000045cba9 [ 3434.891708][ T7318] RDX: 0000000020000080 RSI: 2000000000000072 RDI: 00007f0127a8b000 [ 3434.899699][ T7318] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3434.907833][ T7318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 3434.915830][ T7318] R13: 0000000000000207 R14: 00000000004c46af R15: 00007f0127aac6d4 [ 3434.991185][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3434.999809][ T7320] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3435.009632][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3435.024942][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3435.032194][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3435.040453][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3435.050231][ T4206] 00000010: 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .6.............. [ 3435.059995][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3435.078767][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3435.115211][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3435.124193][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3435.144482][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3435.154386][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3435.164295][ T7321] XFS (loop5): SB validate failed with error -117. [ 3435.433905][ T7321] XFS (loop5): realtime geometry sanity check failed [ 3435.440954][ T7321] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3435.455080][ T7321] XFS (loop5): Unmount and run xfs_repair [ 3435.462265][ T7321] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3435.470915][ T7321] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3435.481515][ T7321] 00000010: 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .6.............. [ 3435.492104][ T7321] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3435.510058][ T7321] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3435.522040][ T7321] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3435.532430][ T7321] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3435.549186][ T7321] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3435.560956][ T7321] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3435.572047][ T7321] XFS (loop5): SB validate failed with error -117. 22:04:08 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:08 executing program 1 (fault-call:2 fault-nth:9): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:08 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x401870cb, 0x0) 22:04:08 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e8a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:08 executing program 2 (fault-call:9 fault-nth:4): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:08 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000048000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3436.268349][ T7360] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3436.283223][ T7363] FAULT_INJECTION: forcing a failure. [ 3436.283223][ T7363] name failslab, interval 1, probability 0, space 0, times 0 [ 3436.311286][ T7363] CPU: 1 PID: 7363 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3436.319927][ T7363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3436.330019][ T7363] Call Trace: [ 3436.333328][ T7363] dump_stack+0x18f/0x20d [ 3436.337684][ T7363] should_fail.cold+0x5/0x14 [ 3436.342292][ T7363] should_failslab+0x5/0xf [ 3436.346724][ T7363] kmem_cache_alloc_node+0x257/0x3c0 [ 3436.352049][ T7363] __alloc_skb+0x71/0x550 [ 3436.356405][ T7363] netlink_sendmsg+0x94f/0xd90 [ 3436.361198][ T7363] ? netlink_unicast+0x7d0/0x7d0 [ 3436.366197][ T7363] ? netlink_unicast+0x7d0/0x7d0 [ 3436.371160][ T7363] sock_sendmsg+0xcf/0x120 [ 3436.375607][ T7363] ____sys_sendmsg+0x331/0x810 [ 3436.380391][ T7363] ? kernel_sendmsg+0x50/0x50 [ 3436.385081][ T7363] ? do_recvmmsg+0x6d0/0x6d0 [ 3436.389691][ T7363] ? __lock_acquire+0x16e3/0x56e0 [ 3436.394735][ T7363] ___sys_sendmsg+0xf3/0x170 [ 3436.399336][ T7363] ? sendmsg_copy_msghdr+0x160/0x160 [ 3436.404657][ T7363] ? lock_acquire+0x1f1/0xad0 [ 3436.409352][ T7363] ? __might_fault+0xef/0x1d0 [ 3436.414040][ T7363] ? find_held_lock+0x2d/0x110 22:04:08 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x401870cc, 0x0) [ 3436.418814][ T7363] ? __might_fault+0x11f/0x1d0 [ 3436.423595][ T7363] ? lock_downgrade+0x820/0x820 [ 3436.428469][ T7363] ? lock_is_held_type+0xb0/0xe0 [ 3436.433442][ T7363] __sys_sendmmsg+0x195/0x480 [ 3436.438139][ T7363] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3436.443182][ T7363] ? lock_downgrade+0x820/0x820 [ 3436.448042][ T7363] ? vfs_write+0x397/0x6b0 [ 3436.452486][ T7363] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3436.458123][ T7363] ? lock_is_held_type+0xb0/0xe0 [ 3436.463068][ T7363] ? wait_for_completion+0x260/0x260 [ 3436.468366][ T7363] ? vfs_write+0x1b0/0x6b0 [ 3436.472790][ T7363] ? fput_many+0x2f/0x1a0 [ 3436.477133][ T7363] ? ksys_write+0x1a5/0x250 [ 3436.481656][ T7363] ? lock_is_held_type+0xb0/0xe0 [ 3436.486607][ T7363] __x64_sys_sendmmsg+0x99/0x100 [ 3436.491575][ T7363] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3436.496692][ T7363] do_syscall_64+0x60/0xe0 [ 3436.501118][ T7363] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3436.507021][ T7363] RIP: 0033:0x45cba9 [ 3436.510909][ T7363] Code: Bad RIP value. 22:04:08 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x4020940d, 0x0) [ 3436.514980][ T7363] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3436.523404][ T7363] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3436.531382][ T7363] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3436.539357][ T7363] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3436.547342][ T7363] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3436.555333][ T7363] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 22:04:09 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x40480923, 0x0) [ 3436.596641][ T7364] FAULT_INJECTION: forcing a failure. [ 3436.596641][ T7364] name failslab, interval 1, probability 0, space 0, times 0 [ 3436.613479][ T7360] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3436.630771][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3436.637429][ T7364] CPU: 0 PID: 7364 Comm: syz-executor.2 Not tainted 5.8.0-rc4-syzkaller #0 [ 3436.645163][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3436.646236][ T7364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3436.646244][ T7364] Call Trace: [ 3436.646267][ T7364] dump_stack+0x18f/0x20d [ 3436.646293][ T7364] should_fail.cold+0x5/0x14 [ 3436.646318][ T7364] should_failslab+0x5/0xf [ 3436.684723][ T7364] kmem_cache_alloc_node_trace+0x27d/0x400 [ 3436.690541][ T7364] __kmalloc_node_track_caller+0x38/0x60 [ 3436.694203][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3436.696188][ T7364] __alloc_skb+0xae/0x550 [ 3436.696274][ T7364] bcm_send_to_user+0xf6/0x480 [ 3436.696296][ T7364] ? mark_held_locks+0x9f/0xe0 [ 3436.709624][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3436.711076][ T7364] bcm_read_op+0x373/0x440 [ 3436.711102][ T7364] bcm_sendmsg+0xaad/0x4242 [ 3436.711125][ T7364] ? tomoyo_socket_sendmsg_permission+0x12a/0x389 [ 3436.711145][ T7364] ? bcm_notifier+0x670/0x670 [ 3436.728661][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3436.732153][ T7364] ? bcm_notifier+0x670/0x670 [ 3436.732175][ T7364] sock_sendmsg+0xcf/0x120 [ 3436.732201][ T7364] sock_write_iter+0x28c/0x3c0 [ 3436.758067][ T4206] 00000010: 00 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .H.............. [ 3436.761191][ T7364] ? sock_sendmsg+0x120/0x120 [ 3436.761233][ T7364] aio_write+0x32e/0x5c0 [ 3436.761253][ T7364] ? aio_setup_rw.isra.0+0x110/0x110 22:04:09 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x41015500, 0x0) [ 3436.778894][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3436.779626][ T7364] ? __might_fault+0x11f/0x1d0 [ 3436.779651][ T7364] ? lock_downgrade+0x820/0x820 [ 3436.779686][ T7364] io_submit_one+0xeb7/0x1ff0 [ 3436.784083][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3436.789216][ T7364] ? lock_acquire+0x1f1/0xad0 [ 3436.789232][ T7364] ? __might_fault+0xef/0x1d0 [ 3436.789246][ T7364] ? find_held_lock+0x2d/0x110 [ 3436.789272][ T7364] ? ioctx_alloc+0x1d70/0x1d70 [ 3436.789292][ T7364] ? lock_downgrade+0x820/0x820 [ 3436.789305][ T7364] ? lock_downgrade+0x820/0x820 [ 3436.789339][ T7364] __x64_sys_io_submit+0x19a/0x4f0 [ 3436.789358][ T7364] ? __ia32_sys_io_destroy+0x3c0/0x3c0 [ 3436.789379][ T7364] ? fput_many+0x2f/0x1a0 [ 3436.807618][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3436.807847][ T7364] ? lock_is_held_type+0xb0/0xe0 [ 3436.812741][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3436.821451][ T7364] ? do_syscall_64+0x1c/0xe0 22:04:09 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80041284, 0x0) [ 3436.821470][ T7364] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 3436.821491][ T7364] do_syscall_64+0x60/0xe0 [ 3436.821510][ T7364] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3436.821523][ T7364] RIP: 0033:0x45cba9 [ 3436.821528][ T7364] Code: Bad RIP value. [ 3436.821537][ T7364] RSP: 002b:00007f0127aabc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 3436.821551][ T7364] RAX: ffffffffffffffda RBX: 00000000004e1ec0 RCX: 000000000045cba9 [ 3436.821561][ T7364] RDX: 0000000020000080 RSI: 2000000000000072 RDI: 00007f0127a8b000 [ 3436.821568][ T7364] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3436.821576][ T7364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 3436.821585][ T7364] R13: 0000000000000207 R14: 00000000004c46af R15: 00007f0127aac6d4 22:04:09 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000e9a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3436.989934][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3437.002999][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3437.019843][ T7362] XFS (loop5): SB validate failed with error -117. [ 3437.132312][ T7393] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:11 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:11 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80041285, 0x0) 22:04:11 executing program 1 (fault-call:2 fault-nth:10): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:11 executing program 2 (fault-call:9 fault-nth:5): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:11 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000eaa00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:11 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000004c000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3439.305598][ T7417] __nla_validate_parse: 1 callbacks suppressed [ 3439.305962][ T7417] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3439.346370][ T7420] FAULT_INJECTION: forcing a failure. [ 3439.346370][ T7420] name failslab, interval 1, probability 0, space 0, times 0 22:04:11 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80081270, 0x0) [ 3439.420253][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3439.437640][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3439.461464][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3439.471052][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3439.471639][ T7429] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3439.480790][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3439.492523][ T7420] CPU: 1 PID: 7420 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3439.499693][ T2112] 00000010: 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .L.............. [ 3439.505554][ T7420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3439.505561][ T7420] Call Trace: [ 3439.505586][ T7420] dump_stack+0x18f/0x20d [ 3439.505607][ T7420] should_fail.cold+0x5/0x14 [ 3439.505628][ T7420] should_failslab+0x5/0xf [ 3439.505645][ T7420] kmem_cache_alloc_node+0x257/0x3c0 [ 3439.505668][ T7420] __alloc_skb+0x71/0x550 [ 3439.519589][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3439.524568][ T7420] netlink_sendmsg+0x94f/0xd90 [ 3439.529211][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3439.532151][ T7420] ? netlink_unicast+0x7d0/0x7d0 [ 3439.532175][ T7420] ? netlink_unicast+0x7d0/0x7d0 [ 3439.539758][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3439.541152][ T7420] sock_sendmsg+0xcf/0x120 [ 3439.541177][ T7420] ____sys_sendmsg+0x331/0x810 [ 3439.549006][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3439.550764][ T7420] ? kernel_sendmsg+0x50/0x50 [ 3439.550784][ T7420] ? do_recvmmsg+0x6d0/0x6d0 [ 3439.562269][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3439.564369][ T7420] ? __lock_acquire+0x16e3/0x56e0 [ 3439.564395][ T7420] ___sys_sendmsg+0xf3/0x170 [ 3439.576116][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3439.578147][ T7420] ? sendmsg_copy_msghdr+0x160/0x160 [ 3439.578172][ T7420] ? __lockdep_free_key_range+0x110/0x110 [ 3439.584216][ T7419] XFS (loop5): SB validate failed with error -117. [ 3439.591926][ T7420] ? lock_acquire+0x1f1/0xad0 [ 3439.591941][ T7420] ? __might_fault+0xef/0x1d0 [ 3439.591954][ T7420] ? find_held_lock+0x2d/0x110 [ 3439.591968][ T7420] ? __might_fault+0x11f/0x1d0 [ 3439.591986][ T7420] ? lock_downgrade+0x820/0x820 [ 3439.592027][ T7420] ? lock_is_held_type+0xb0/0xe0 [ 3439.592051][ T7420] __sys_sendmmsg+0x195/0x480 [ 3439.698035][ T7420] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3439.703068][ T7420] ? lock_downgrade+0x820/0x820 [ 3439.707925][ T7420] ? vfs_write+0x397/0x6b0 [ 3439.712361][ T7420] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3439.717911][ T7420] ? lock_is_held_type+0xb0/0xe0 [ 3439.722858][ T7420] ? wait_for_completion+0x260/0x260 [ 3439.728153][ T7420] ? vfs_write+0x1b0/0x6b0 [ 3439.732584][ T7420] ? fput_many+0x2f/0x1a0 [ 3439.736915][ T7420] ? ksys_write+0x1a5/0x250 [ 3439.741430][ T7420] ? lock_is_held_type+0xb0/0xe0 [ 3439.746395][ T7420] __x64_sys_sendmmsg+0x99/0x100 [ 3439.751336][ T7420] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3439.756451][ T7420] do_syscall_64+0x60/0xe0 [ 3439.760888][ T7420] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3439.766782][ T7420] RIP: 0033:0x45cba9 [ 3439.770674][ T7420] Code: Bad RIP value. [ 3439.774734][ T7420] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3439.783146][ T7420] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3439.791146][ T7420] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3439.799121][ T7420] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3439.807103][ T7420] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3439.815088][ T7420] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 22:04:12 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:12 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80081272, 0x0) 22:04:12 executing program 1 (fault-call:2 fault-nth:11): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:12 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80085502, 0x0) [ 3440.158546][ T7459] FAULT_INJECTION: forcing a failure. [ 3440.158546][ T7459] name failslab, interval 1, probability 0, space 0, times 0 [ 3440.174039][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3440.186723][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3440.214663][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3440.227838][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3440.258116][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3440.275177][ T2595] 00000010: 00 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .L.............. [ 3440.284072][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3440.287078][ T7459] CPU: 1 PID: 7459 Comm: syz-executor.1 Not tainted 5.8.0-rc4-syzkaller #0 [ 3440.301503][ T7459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3440.311556][ T7459] Call Trace: [ 3440.314856][ T7459] dump_stack+0x18f/0x20d [ 3440.315146][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3440.319196][ T7459] should_fail.cold+0x5/0x14 [ 3440.332632][ T7459] should_failslab+0x5/0xf [ 3440.337051][ T7459] kmem_cache_alloc_node_trace+0x27d/0x400 [ 3440.342877][ T7459] __kmalloc_node_track_caller+0x38/0x60 [ 3440.345145][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3440.348517][ T7459] __alloc_skb+0xae/0x550 [ 3440.361665][ T7459] netlink_sendmsg+0x94f/0xd90 [ 3440.366438][ T7459] ? netlink_unicast+0x7d0/0x7d0 [ 3440.371383][ T7459] ? netlink_unicast+0x7d0/0x7d0 [ 3440.375148][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3440.376323][ T7459] sock_sendmsg+0xcf/0x120 [ 3440.389567][ T7459] ____sys_sendmsg+0x331/0x810 [ 3440.394336][ T7459] ? kernel_sendmsg+0x50/0x50 [ 3440.399012][ T7459] ? do_recvmmsg+0x6d0/0x6d0 [ 3440.403606][ T7459] ? __lock_acquire+0x16e3/0x56e0 [ 3440.405145][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3440.408632][ T7459] ___sys_sendmsg+0xf3/0x170 [ 3440.420788][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3440.422032][ T7459] ? sendmsg_copy_msghdr+0x160/0x160 [ 3440.436136][ T7459] ? __lockdep_free_key_range+0x110/0x110 [ 3440.441869][ T7459] ? lock_acquire+0x1f1/0xad0 [ 3440.446544][ T7459] ? __might_fault+0xef/0x1d0 [ 3440.451223][ T7459] ? find_held_lock+0x2d/0x110 [ 3440.455994][ T7459] ? __might_fault+0x11f/0x1d0 [ 3440.460768][ T7459] ? lock_downgrade+0x820/0x820 [ 3440.465627][ T7459] ? lock_is_held_type+0xb0/0xe0 [ 3440.470572][ T7459] __sys_sendmmsg+0x195/0x480 [ 3440.475253][ T7459] ? __ia32_sys_sendmsg+0xb0/0xb0 [ 3440.480282][ T7459] ? lock_downgrade+0x820/0x820 [ 3440.485151][ T7459] ? vfs_write+0x397/0x6b0 [ 3440.489578][ T7459] ? __mutex_unlock_slowpath+0xe2/0x610 [ 3440.495121][ T7459] ? lock_is_held_type+0xb0/0xe0 [ 3440.500062][ T7459] ? wait_for_completion+0x260/0x260 [ 3440.505348][ T7459] ? vfs_write+0x1b0/0x6b0 [ 3440.509765][ T7459] ? fput_many+0x2f/0x1a0 [ 3440.514095][ T7459] ? ksys_write+0x1a5/0x250 [ 3440.518606][ T7459] ? lock_is_held_type+0xb0/0xe0 [ 3440.523554][ T7459] __x64_sys_sendmmsg+0x99/0x100 [ 3440.528500][ T7459] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3440.533646][ T7459] do_syscall_64+0x60/0xe0 [ 3440.538090][ T7459] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3440.544032][ T7459] RIP: 0033:0x45cba9 [ 3440.547929][ T7459] Code: Bad RIP value. [ 3440.551999][ T7459] RSP: 002b:00007f48031b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 3440.560428][ T7459] RAX: ffffffffffffffda RBX: 00000000004fe340 RCX: 000000000045cba9 [ 3440.568408][ T7459] RDX: 04000000000001f2 RSI: 0000000020000000 RDI: 0000000000000003 [ 3440.576408][ T7459] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3440.584381][ T7459] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000004 [ 3440.592361][ T7459] R13: 0000000000000919 R14: 00000000004cbed9 R15: 00007f48031b46d4 [ 3440.601712][ T7419] XFS (loop5): SB validate failed with error -117. 22:04:13 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000eba00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3440.797273][ T7468] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3440.942696][ T7468] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:14 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:14 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfffffffffffffffe) r2 = socket$can_bcm(0x1d, 0x2, 0x2) set_mempolicy(0x4000, &(0x7f0000000180)=0x2, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$bt_BT_RCVMTU(0xffffffffffffffff, 0x112, 0xd, &(0x7f0000000000)=0xff, &(0x7f0000000040)=0x2) io_setup(0x9, &(0x7f0000000240)=0x0) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x2000, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$can_bcm(r4, &(0x7f0000000140), 0x10) r5 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r5, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) ioctl$EXT4_IOC_SWAP_BOOT(r5, 0x6611) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) r7 = socket$unix(0x1, 0x5, 0x0) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) fcntl$setstatus(r6, 0x4, 0x6000) 22:04:14 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80086301, 0x0) 22:04:14 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000060000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:14 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:14 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000eca00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:14 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80086601, 0x0) [ 3442.393098][ T7491] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3442.424090][ T7490] XFS (loop5): realtime geometry sanity check failed [ 3442.435003][ T7490] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3442.457730][ T7490] XFS (loop5): Unmount and run xfs_repair [ 3442.473593][ T7490] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3442.485029][ T7490] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3442.502598][ T7490] 00000010: 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .`.............. [ 3442.512448][ T7490] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3442.532120][ T7490] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:04:14 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80087601, 0x0) [ 3442.552542][ T7490] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3442.573376][ T7490] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3442.598118][ T7490] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3442.613170][ T7490] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3442.623707][ T7490] XFS (loop5): SB validate failed with error -117. 22:04:15 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x800c0910, 0x0) [ 3442.644709][ T7501] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:04:15 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000002, 0x8) [ 3442.678429][ T7491] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000eda00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:15 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80140912, 0x0) [ 3442.846296][ T7526] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3442.973593][ T7533] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3443.029332][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3443.059803][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3443.124718][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3443.150727][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3443.172363][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3443.193008][ T2595] 00000010: 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .`.............. [ 3443.203636][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3443.214332][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3443.250958][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3443.261212][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3443.271207][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3443.282251][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3443.292729][ T7490] XFS (loop5): SB validate failed with error -117. 22:04:17 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:17 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000003, 0x8) 22:04:17 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x80480911, 0x0) 22:04:17 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x810405, &(0x7f0000000000)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:17 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000eea00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:17 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000064000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3445.519848][ T7560] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3445.568509][ T7557] XFS (loop5): realtime geometry sanity check failed [ 3445.577016][ T7557] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3445.605420][ T7557] XFS (loop5): Unmount and run xfs_repair 22:04:18 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000004, 0x8) 22:04:18 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x90000915, 0x0) [ 3445.620640][ T7557] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3445.636770][ T7557] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3445.657945][ T7557] 00000010: 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .d.............. [ 3445.673116][ T7557] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3445.684366][ T7557] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3445.694388][ T7557] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3445.704450][ T7557] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3445.714478][ T7557] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3445.724615][ T7557] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3445.739871][ T7575] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3445.747468][ T7557] XFS (loop5): SB validate failed with error -117. 22:04:18 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0xc0045878, 0x0) 22:04:18 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$VIDIOC_S_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000100)={0xa20000, 0x8, 0xa71c, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x980903, 0xfffffffe, [], @p_u16=&(0x7f0000000000)=0x28}}) getsockopt$inet6_opts(r3, 0x29, 0x36, &(0x7f0000000180)=""/1, &(0x7f00000001c0)=0x1) r4 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r5, &(0x7f0000000140), 0x10) io_submit(r6, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r6, 0x2000000000000072, &(0x7f0000000080)) [ 3445.776869][ T7585] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3445.801909][ T7586] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:04:18 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000005, 0x8) 22:04:18 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000efa00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3445.893008][ T7591] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3445.940624][ T7594] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3445.962919][ T7596] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3446.073422][ T7597] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3446.149552][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3446.172226][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3446.216345][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3446.222114][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3446.275405][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3446.284311][ T2595] 00000010: 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .d.............. [ 3446.307081][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3446.316881][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3446.326415][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3446.336126][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3446.345043][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3446.355284][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3446.364269][ T7557] XFS (loop5): SB validate failed with error -117. 22:04:20 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000006, 0x8) 22:04:20 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0xc0045878, 0x0) 22:04:20 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:20 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f0a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:20 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r1, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r2, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r3 = fcntl$dupfd(r2, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r4, &(0x7f0000000140), 0x10) ioctl$RTC_VL_READ(r3, 0x80047013, &(0x7f0000000000)) io_submit(r5, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r4, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) syz_genetlink_get_family_id$SEG6(&(0x7f0000000040)='SEG6\x00') io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) 22:04:20 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000068000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3448.573834][ T7624] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0xc0085504, 0x0) [ 3448.617055][ T7623] XFS (loop5): realtime geometry sanity check failed [ 3448.626328][ T7623] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3448.644844][ T7623] XFS (loop5): Unmount and run xfs_repair [ 3448.651921][ T7623] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3448.668494][ T7623] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3448.690946][ T7623] 00000010: 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .h.............. [ 3448.718075][ T7623] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3448.729813][ T7623] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:04:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0xc0101282, 0x0) 22:04:21 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000007, 0x8) [ 3448.759781][ T7623] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3448.765315][ T7627] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3448.798781][ T7623] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:04:21 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f1a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3448.839057][ T7623] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3448.857236][ T7623] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3448.877544][ T7623] XFS (loop5): SB validate failed with error -117. 22:04:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0xc0189436, 0x0) 22:04:21 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000008, 0x8) 22:04:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0xc020660b, 0x0) 22:04:21 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0xc0481273, 0x0) [ 3449.246580][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3449.257958][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3449.302775][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3449.317407][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3449.334290][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3449.371491][ T2595] 00000010: 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .h.............. [ 3449.422276][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3449.460892][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3449.481432][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3449.490673][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3449.504388][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3449.525348][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3449.535279][ T7623] XFS (loop5): SB validate failed with error -117. 22:04:23 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x3) 22:04:23 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) syz_open_dev$rtc(&(0x7f0000000040)='/dev/rtc#\x00', 0xb065, 0x24083) ioctl$BLKPG(r0, 0x932, 0x0) 22:04:23 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:23 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f2a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:23 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000006a000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:23 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r8 = dup(0xffffffffffffffff) r9 = openat$cgroup_ro(r1, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r9, 0xc0845657, &(0x7f0000000280)={0x0, @bt={0x9f74, 0x7, 0x1, 0x2, 0x8, 0x401, 0x2, 0x2, 0x7, 0xfffffffd, 0x2, 0x800, 0x3ef, 0xf39d, 0xd3064e3d4fbaf2d1, 0x29, {0x0, 0x1}, 0x7, 0x9b}}) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) ioctl$vim2m_VIDIOC_QBUF(r5, 0xc058560f, &(0x7f0000000180)={0x7, 0x2, 0x4, 0x20, 0xff, {r6, r7/1000+60000}, {0x2, 0xc, 0x3, 0x3f, 0x52, 0x0, "43566bf7"}, 0x401, 0x1, @userptr=0x5, 0xff, 0x0, r8}) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(0x0, 0x0, &(0x7f0000000080)) [ 3451.623548][ T7704] md: md0 stopped. [ 3451.628007][ T7705] __nla_validate_parse: 8 callbacks suppressed [ 3451.628018][ T7705] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3451.653430][ T7708] md: md0 stopped. 22:04:24 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x80, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x44) [ 3451.734215][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3451.744336][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3451.766923][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3451.775059][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3451.779744][ T7705] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3451.782668][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3451.800946][ T4206] 00000010: 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .j.............. [ 3451.810061][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3451.819445][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:04:24 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x5) [ 3451.828482][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3451.837719][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3451.850175][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3451.863942][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3451.874092][ T7709] XFS (loop5): SB validate failed with error -117. [ 3451.877495][ T7730] md: md0 stopped. 22:04:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f3a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3451.892124][ T7730] md: md0 stopped. 22:04:24 executing program 0: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x101400, 0x0) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r0, 0x3) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r1, 0x932, 0x0) [ 3451.968454][ T7736] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:24 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r0, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r1, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x8000, 0x0) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r2, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r3 = fcntl$dupfd(r2, 0x406, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r4, &(0x7f0000000140), 0x10) io_submit(r5, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r4, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) 22:04:24 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x6) [ 3452.124521][ T7745] md: md0 stopped. 22:04:24 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f4a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3452.159159][ T7736] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3452.183894][ T7752] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3452.241974][ T7756] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3452.271988][ T7709] XFS (loop5): realtime geometry sanity check failed 22:04:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r1, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) r6 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r6, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, &(0x7f00000000c0)={r7}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={r7, 0xffffffff, 0x5}, 0xc) ioctl$BLKPG(r2, 0x932, 0x0) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x288782, 0x0) ioctl$VIDIOC_S_EDID(r8, 0xc0285629, &(0x7f0000000180)={0x0, 0x2, 0xffff, [], &(0x7f0000000140)=0x7}) [ 3452.286282][ T7709] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3452.324586][ T7768] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3452.350664][ T7709] XFS (loop5): Unmount and run xfs_repair [ 3452.365287][ T7709] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3452.384063][ T7709] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3452.404529][ T7709] 00000010: 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .j.............. [ 3452.432085][ T7709] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3452.453427][ T7709] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3452.474182][ T7709] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3452.514132][ T7709] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3452.538053][ T7771] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3452.549199][ T7770] md: md0 stopped. [ 3452.561941][ T7709] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3452.582392][ T7709] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3452.598004][ T7709] XFS (loop5): SB validate failed with error -117. [ 3453.171336][ T7773] md: md0 stopped. 22:04:27 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:27 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x9) 22:04:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f5a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:27 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000006c000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:27 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r4, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x38, 0x0, 0x0, 0x0, r1}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:27 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKROGET(r0, 0x125e, &(0x7f0000000040)) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000080)={0x30, 0x5, 0x0, {0x0, 0x0, 0x8, 0xd1}}, 0x30) 22:04:27 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xa) [ 3454.732299][ T7797] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3454.740934][ T7804] md: md0 stopped. [ 3454.795825][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3454.825208][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3454.837648][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3454.843385][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3454.851514][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3454.870417][ T2112] 00000010: 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .l.............. [ 3454.879734][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3454.888995][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3454.899315][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3454.909914][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3454.919802][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3454.929668][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3454.939612][ T7800] XFS (loop5): SB validate failed with error -117. [ 3454.979181][ T7818] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3454.995464][ T7816] md: md0 stopped. 22:04:27 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0xb) 22:04:27 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=@newtfilter={0x14e0, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x14b0, 0x2, [@TCA_TCINDEX_ACT={0x14ac, 0x7, [@m_ctinfo={0x164, 0x1c, 0x0, 0x0, {{0xb, 0x1, 'ctinfo\x00'}, {0x6c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x4, 0x0, 0x20000000, 0x6202, 0xfcf}}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3ff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x5}, @TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x3}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x3f}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x6}, @TCA_CTINFO_ACT={0x18, 0x3, {0xa, 0x120000, 0x5, 0x400, 0x6}}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x72}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x47}]}, {0xd0, 0x6, "38b05b6079668e6a2dc2e279fdb59cfd208912df5423e84848e04905a9197c21d1c2a43071f75b46bb499386918bfd2e8bb1857fd899a31e0c626d8dcc097636960ab4c042cce960627dd5e3bae4e0c3c1b2197201019df10e38715f2a906216d0ff8ef05e4369ca7edd5dd7b4e3df0e7dd227c7fbd2f21d4982896d046800a8cabf6363473b96aa50b375690f70c0a1f22f8dfbf331b4bd09f4663977978fa38a952015dd73f6780c13ee7036da336275bced8baefe716ac21ce03b5c31395a683867d073ec7b3ba774ecac"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_tunnel_key={0x12c, 0x3, 0x0, 0x0, {{0xf, 0x1, 'tunnel_key\x00'}, {0x64, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x8, 0xffffffff, 0x7, 0x0, 0x81}, 0x2}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e21}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @remote}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @ipv4={[], [], @local}}]}, {0x9a, 0x6, "62d9557011246fc062bdcf5c92b6f9707443a73fb42c7f0524e386def9ae358d945479a52daddec4bc90b05a03bf2fd85d4ac11c88cc804ebf44b11afaf85c7742699a511e9b7b68eca9bc8394c15f333c5f7cfa8d0da22ee8315dbf89333508772afe4bf05ae684aaeb5bca5ea55582beacc1e7c8d899863e4d90df3f2d9168114e77c01cbbf93ac9c8920c8a33dae06a43b73e20cb"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_xt={0x115c, 0x1a, 0x0, 0x0, {{0x7, 0x1, 'xt\x00'}, {0x106c, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x400}, @TCA_IPT_TARG={0x102a, 0x6, {0x2, 'security\x00', 0x1f, 0xfffd, "91878ebc103391abda67fae834f210abaa06052c87bed3962fb089d8d6a2a6f8c19eb91124cc0717538b21255d60de596f710b1c58bc8b8789bad6998246b448832a202ce8da10c239b33e69c1ea1b62df8398c87b7c57238a16988ac4f6dabcceba3a2960a2cc182701566049b06a6f9d07c361d02d6db46bed373390ff015c4e7992797141a8dba9c80fc963b9692df125a12874dbf6447036dc0287e6175043a274ccffbb9e2b3586ca69fa6abac19a85260c94274caca45a42f8543fd7d1c75c309d176251134ee93d706f91f16ba3ae89c48216074fa0e783bba7c2b17037a9cbe2bf5174c5220cf6adf48b533c81f12d03782ed45a55c6e142b06e5f7d744421a0e4c3196e2c347ede6ff7fb913f3a017c3837484f8064d3ab12849968be54644d771fe112076e4a93e896d6137170b8e6f9754c38e53c3c186f48ca25bbbc828805529a21f51123cbed041de003bcf995888ab30fb325b7fcb6115d1bf704a63e90feb7afc347e66ff80c5c18fb79519c02b513dd3c96c2b91d190cfc25967737a4776d22e1ebf35b1616defb0a830726ceeae6d588888ccb5914146ced20feff7335f87f11f0849c46380112489f19b736990dbcc7b1efb612b6ee4f83f9b8626b1021dab947882b29b1ff6004fd64a8c715ae426e346ee85bca5c5011f930487143fed0283a6ec10937a1f09ec912dc30371290801b46bf758698dd6f5cd19747306cf425b78c7d8eec15a6d09e640ce5e4249376c170ad5a1ead1d6c054aaec26bf7f4750ad23af44b5372c0b4987b1ac8554162cd2d644ab7f6920bfe4bf8ed65eb8529754ef5e382b6e487ae7b33efd2002921280d3c38d7c6ae6892780ac819358e77ae0eebefc6bd0822fd312dfc6495e7604c20bd129e051db7b58a756909cd66695ebb1f19fb737c6e31b2d0f430fff6ddb78476a2cb5f61252bb0f001dead2089c7f24db57476f4ef86e8797bca598296a97a499221f4cfcd82c8795902b135be1d1138677d268b56465a8990d9c58dc8f07b192a2b0d4eda9776d5e970f0580a7dfdd1a2c4f74d76b221a52368886e07043cf5a82188e49212951198cf6247164a84412a30473262966965bf94dc114e68afe0bd65bedc02013b7c6f36f7727cb332df3f4c8a51cbf6c9cdc5c9ba97dcf8c679fca5bb8a1b8b9758cc8e8d774e587a21ef9df378833802c327c1bf414c0bb8ff6343ff2b29a94e5ff708412c5e9f067d34346806e86a0eb0411169b6f34a592170882e7b5c874ba84dde769c55abdf0953e8b2768e709c83ebb642b3a3a6762b68e3212e38f1b9b8228e52f5070082717abfac621d1fc0397ab5ed604541c4a85f13906ef896c47977327a1cca7c197355ef3af0481f1fca2f6ce0eecb81d62e52747a4b21ce7eff01fdfba678bb4c9130082618d1e1be44c0d04579e0964957e6b631e56e74b194da1ce7995f8ca1832ea934d083abc9ccaaa68c29f9060197f71880cb2c1bf9d476e16f9559d793d992bdc6c3da66a903911e7965a7ea9c8daa9b9c9b4afb3e3a10c39ae2d24bb9d0b19e955a532e68c790df1f0e939517f0a8877b62d454d04af394b6e5f8d88946ec78e9d0c98eb533431c9cb7eece4c619ce151d50c3318d01c3905dec1c5854d6cc3faee30f5026570a320d869820f2ac0497bbd75d96889e8d73c6b29f19b59ad1ec8a8dcb325a98a23b8731e153cbb48406d14f496298853b044650f542cb46e1c1bb26c29c4c1de0d1adb69eb392b125a0cf1a6d29489d4fdd34a4c87a1ef2ac5f0e87cd49f723001f3d95efc31ee5d8f6a4c4382d2c0236df0ce41d3e4ffcb5daa206b57ed2d5f349e7e43dad533a4237801534c2523ce5cdb4b470a3e68151ea4d61287a489ae3c6e3786d4f0bd059f0ba05a513c9273827683e3a4bc3f52a1e9124e6ba062a29831a1e70e4162f13982286de93f0097f327365917d64221efbadef93eba90ded0a6054ea8b946acaa55ecd1050a246a3b8e186a21ae8bae26321cccd500dd9ad7d1e2d7883f81f3284e167ac74ecff4fe1a6e31e4a4fec7b4c1fef6779c904aa8188876e1f0fe9dad4af1512b131cb2cb501712249371efb147567e03476b99bc6637af68759d3c9d987739b7d211a055a96f8649f58c14c4d09a614256804017b076f0c3b309d34bf429d9368cc10182f7fbd9e16dabae09f2876c03bc4c7511ce360f057b44125bcca3b630d1655fda5169fa5c4d2a22de13c1207317548faf4aa6cc1d3991dd8f69c5a49187a687aae3e7f2d26621c62bb8dd821896fd62b8fc571a2cfca2f583875786ff007b7e8a31912d88916f0b250906d436b6e9a6231d203c5aafcd5aa1bbe7f9f21231714d66ffdce1814b04736d2f537a089b43e3a0350307ae58264bc27c180a1011a135baa32d9158f0208982a244e38fdeae140dad0348d54c8643169653c6c19024018e10600028dc76867d137f075f56384e823fe55f862f524186538a97d363a59f9b28fd34b6e161368cc96d3b1d42b4c02d13f19573b5d68f824673cacb3f577c83da688b1d61279bf4d1dcfee016e5baf51511169cb5ec1b1de61d968c10fdb976de8a3cb9ea612d0e38cd7bf1af727ab5bb5434875f852fd0b994b5fdec5263f9972e6d0d6457cd77e69a4304b7a77b8341e324c1c3b03077fb6054d8b96b53873d2aff2bc800a0a4f2af742d60b01d08746b03bc369284275d53fa5a8546826e642b7bc3c4ebfe78cd6e9e7bc16de085ecd4cd9f86eb0f13c8808f0d7b1eb96784dac04601fa0f5d10e8b96cb3aad2d7a1b26ef34a29a2b1ef8c83e326d2d54a66c5d98bf73c41220fd40d56a061ca06dcb91a46d587cc734f19892bc991c766ec6093eb3456845d52298b746e3a768273b03cb6a909af4d0791bc0a1241cf2f5ff895943b6a978e78bd105a16e76f05fabb598aba0f718c45fcef1b92e236d1083aa5878c6733729ce9640125cd63f12646ffdaf688faa547f09f8c91041ce93b044ac09b2456c931fbeb353d0302d9ea5be276e0af4bf6511d270506399e775c2250cf6fcca2b8e3ff1ca14ecb3a899743a6433d24cc445b2280d98c3a028603d1b82edf15a64648d06a4ee93491293a81650ca05355c41d5ef545026b51c778bf3aef66b2a3ec96e0178d70341a1181b0d7623c848167e410e935eb3edc64052a44deff7033a98626426d8a4aeff686c175a7e599f7281c02e73fc8edc7cae3be3a654b48f5fbc6c921256fad32fd6af40feb11801801765d399c15a3f51ab005092cd6328c5291ea209ab9264e7d33a8cee11b7e812ee13f7fa17e17768066fae43501418c850b4d5c4654e06475b767c0d4d9cded87fd33bdc8a6c5698cee5bfde13b2d14c313830de241523230dad17800972ba69c3cfbc72a8dba86dd417578439e7ba41dd350fe3eebc02fb48872bf06bc8aea89d67a8b2d9e08411813d4fd91a46b320411d6142f4c06efbddb375818b30ee560dafdce57a04c2e2857a88ec9646ecb3c5f6162aced7dee93ab9c80fe9f962a9f4debb9d0f8c3bb573c80dc9f63dc297316593d49e5084751cf08e77b71839791fd8080c7b30cb8532202853993e411c597bb7da8ada973b49eb15dc1515a5cbd7c56d79c432814b6d82a3a10e521dd29ea30caed47e87a97cc1ff9535679e47bde15ce476d8f70b5420d33c51d5ca19003ef961f02491e53398041b9bdcdb4dc9e957925d71b4751d64a53f52a5e2b40b088a82c031d47dc3d2a12a7ebeb7a1b54cf8d2023118191287065b36a2fb91f5a4d55dd12fcbf80989a0033530f08ea1ac36c9020219237ee2efa4b6deffd86733b7bb1fa02f9685f13aef3199f1079f5b163a53468f02bc225f8f43d09d8165cc6330b5aa32618833a1e6f79b0651d5a866668e68cf54ab6fc6cefca424f0e9e6a8c079b324c529ae2c41ac32f2184969732ca83e88f4a228836c69017c9df6167cf6afc4435f3d5870f258de9a82e238c008013fe71eb73d8a0c373f547f29e93e347d15e3a9667af8d76956789c23ad365b52b234c7fc110fdf8c389236aa2218358925c85f776b7b5185e1585bd93ea2e5f0dca13011174e68c02b2c87aa6bfbae8d30a19b245e53664754360a29de925bdcff837f7e14657e9d9773d0c06756a4746728eb439f6528032eb5d9b5fd9eed4f5887d257a7dd00174df9514377609c0718497499fae02d3195b76faba31032276638ee7c45cf4e9202e6223fc0393a4f76798cbfc3b258f20e3a6151223f0c1c6e181688efc7ebceb1dcd386e58c4522915407dbd7503287ab5cc25882a972b0fdd4a602798746985f534335baac77fd173a66a827aa0e9d57677a4dd30be70b72a6d8d9b645073945926078f8639edfe02921c87f3d73f5a9d9494dd5764db0b8cb57617444ef053bedaa01b781c4bbd72741c88a88b6e7b5b1b20eb22e936654bafa8f9fbf148fc6fda1c781093db08807eb2b26f3537e65e6f45d07d5cfe11e8c1f1dc7ff51c86536d4ad267d66ca64a8f0416da9aad63bef31c22d4bdd7d6b728d0c16cbc70ddd37c608af5f8f01e13dbb7a6bb378dce28bc33a9b09ce1dcb9d56d94f2a42d32449b2783625d0640be40cc12d603dfd49b4ab7f38a23b7b679f8c13c62ee8fbfd9030062680102bd86621a038e2fd1ccf307e7fcdae9e473bc4d2eabb7c17018773b3f6004db912e0946aa73d58b8d08966f29e4be50fbe8c29e69907a6fdef3ad8cd46a113c1914de43f1c7bad3c923f977818ef6ef1f79f34c4818f3e2a182a9ac33fe6a5f000e58df5059db5e121f744371374e43a0334cbc96a4be6f1c85453a7d88ba8de67b9b3f852f08217f32a59efea87891a7da796bf18b5233a92c2e500dd9b4c52d5c4b7e28a16af58b831016a71e371c018ff3ca511414d25e378629953da52d4f335cae9f8876851a8562900f4bb95506ba3214ed2b8c48394097a362f364986fecf66b1a52cb571a7193e63910a8202dff77b5211269bfdd5612a8502c5dd1692a442d32b88ee2217b1d7563d9503cf68b3bacdd97d490a4b161073f5d059b5a680a06edddae8bdacc8e72f671632652f5bdf10a0668bfacbb6aba6c2c77634762818d9ba4b60a8fc29ac39ef75bd202fa9546d1ed4576bee7f031e5d952481935b97109be1b1c5d564ecf345d95966fde59b906e9cd44e40854a79e1bfece1513dab73e1145a84592fdea18ad472b4511e928daea7f7bb5d858ad2d84e2668fa96c96f3e562928d47c1c22e653e8fd0ba12c2956cf05a494a5eb031203a82da74040f52f9a0824eb952a714b827dc939be304a89b7abf828a5f7f081fdf955d8639e4c75c61c32e97afdd74df5063a958ade8489a48e8de6ddeddb8a1e714c6778e7bccfcac17239c492eca24ea34a7205215ef9f74ffc0f4f77e0058d2415b0967f35399ce625ecd6d94b1effae778133e789ae082dcbd1f68b5f558ce6a6710358903e10a4793480521adf74f2f19c15b42c9fd9246c969c59a2506f95e90895daf495f1d1643b2efd82dbfc236bcd582e81dc17f8c34d4928e2f383827c47824032cdc745b4c7b787d8b5d6bfab6d7b24348b980239cf31fd15429e9603f2354daf095bd499faf4fda3b247401df82f6b4aee7c8031437f3f4c199c43f9d299a631b70cb037abd8dd0e88063dbb627309ab31169bd0894f4cf30cf450d572eda6933b0bdf9f128285e2881b1866fd7f22a6f198f0bf05ce8bdb628a57ebff5d6d589b28fd36cef8386fcf0bee9a4ba42df90e0cf0a4faac5df6c6f523a6804cff29d65248e84238506c9b9"}}, @TCA_IPT_HOOK={0x8, 0x2, 0x4}, @TCA_IPT_INDEX={0x8, 0x3, 0x43}, @TCA_IPT_TABLE={0x24, 0x1, 'mangle\x00'}]}, {0xca, 0x6, "9e79fb6adec6569b6da1e89da5f0564e0bc8b9595dee8efa58e0b4c1e6de28747643efe9cc363a461ef0c2c8a4ba2e35335b1d9fc7db6fc5cb4c5a58c34788ff935f8a1c816a2f0a949b2117b635e4aa03c0b35d37644ee7ffc410e536b6bec9b0fcec5bd46925c8360c7c308fe034b38e6c8e3799f40073ca03255a630627515630341df7e2a04de9b5af0bce652cebe74e78ef90df6facf8b9af4f067e0c7d77fa8b1e4157b553b32c72d14ad556e20ae74030dc6de510d1ac1d52b21f1722f5b77638d2b7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xbc, 0x2, 0x0, 0x0, {{0xd, 0x1, 'connmark\x00'}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x3, 0xffffffe1, 0x5}, 0x7fff}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0x8, 0x0, 0x101, 0x2}, 0x3f}}]}, {0x52, 0x6, "8f35396b1e2f1bd331dd3f764f48a80a7ac1793de1cefdc69a510a6e1014dc2f6a1dd8e3dcf933da74b97a2d4b7a468e79abd1dbc4c20e8c75b984b385e64d4f2f1f680ef476c52964b98111c1f2"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}]}]}}]}, 0x14e0}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$can_j1939(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000240)={0x1d, 0x0, 0x2, {0x0, 0x1, 0x1}}, 0x18, &(0x7f0000000280)={&(0x7f0000000340)="72cabec8f415e7ff2c17113bee1f1af8e65688cb8702a72e207294b77157d841330b335d49411ff4b76734c754b9b382c215030b0636f9944e6d26d73a3128c511964e8c3e624c3a04b45bf9949e0264469243a8587d2cc1524474e39ea3cd2fdf1c4b3c50410a64d12ea734f6d6200c6c10afa799dda8d8ee98d103dffd7241094da6f30ea6fa5224c729afa69d35110fdbaed081ed07acd14b85ed07106278ceff3e4af7e0bbdbb0713038f814fb2e03a6cde8", 0xb4}, 0x1, 0x0, 0x0, 0x4008080}, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PPPIOCSNPMODE(r2, 0x4008744b, &(0x7f0000000080)={0xc021}) ioctl$BLKPG(r0, 0x932, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r3, 0x8983, &(0x7f0000000040)={0x6, 'bond_slave_0\x00', {0xf}, 0x9}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) getsockopt$inet_sctp_SCTP_EVENTS(r6, 0x84, 0xb, &(0x7f00000001c0), &(0x7f0000000200)=0xe) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000180)=ANY=[@ANYBLOB="01000021bed458ca8bbe8532f0633b79f69e00", @ANYRES32=0x0], &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f00000000c0)=ANY=[@ANYRES32=r7, @ANYBLOB="00000014"], &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f00000000c0)={r7, 0x8, 0x2, 0x3, 0x4, 0x40}, &(0x7f0000000140)=0x14) 22:04:27 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f6a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3455.114412][ T7829] md: md0 stopped. 22:04:27 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = openat$cgroup_ro(r1, &(0x7f0000000000)='cpuacct.usage_user\x00', 0x0, 0x0) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x6, 0x0, r4, &(0x7f0000000040)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x16, 0xe3a, 0x0, 0x0, r5}]) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r8, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000340)={0x1d, r9, 0x2}, 0x18) sendmmsg$sock(r1, &(0x7f00000053c0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000280)="bfd472b716302eaf5585eaad4df708d7109ba23902905222723125240d70fd6ae3550e9283140a46f61043167922f6617f502e96b2a3e437a3b3cfc4f0f4998084fde4428daf865629ca9428ed434830a58c37132268c8eeacd6214f79620fca46326574deea3fc5b9d4074057c15839fdf22221ba3b7e0e5f2882383d69275b42f9953893be4d9755eea605faf3900221aafcbca832a14726e0da15760e417b70eab408bc06b51937ab7fe965b58bfb7de5c09d4c2600d71b83b2e5987fd3d184af3d36", 0xc4}, {&(0x7f0000000380)="f3ab3a23522cb71ba23dcd79526ebaf1dbcfb96967b8df956c1c366c65c1e1292f89a228e79ae3e506a8038ce8ac9aaa2c2d7a5cb1fca6b1d991fe9d2203931139e080b383b1cfdf02f7c698d2e53a43e766a61779551caf9b79406bff17ff161bd5f316df882ac79398524d34952fd5511a33e6a95ef6d33b215f278bca7206722eec28ea7c164a5a94a3ba3aa80b7f606b0a749a046c055fc3505425ca5ea3efe68ab093fc06ad1d46172b99d4187594efaa2ce1ad2de150e9207b2431ace0f628f1ea656704bf8f32582358e6962f", 0xd0}, {&(0x7f0000000480)="aec4a26be7e380e70a0bb0699259fe34208531c970d4d750f6ee7e51ab476439e4e5f45ac9e94ef3219b30b8cdea3882ad2434a6b59334170ce869a6490d98772adc423ed556d957006b63a913d052884b185387a65c022d50090acd6d7b7b02545b840126c6495c94174c40fba98c6ea998082ba6d160b11815f2386a2b32d1b97a871dab8d98f56583856b59aae4c07ddbb117ae2ba597a6a1443a8b1038d1191c2a289e355f3081bb4f", 0xab}, {&(0x7f0000000180)}, {&(0x7f0000000540)="23087b1ca794eb715cbde56cfbbcec8ce26f8edb0a2f065bd06ad7bbd5e555b8c2920c4415fb658956b51c8115210caebd04f971907355aaaeaddf5f6ca433c0a603a38e", 0x44}, {&(0x7f00000001c0)="b72ec716e484aaf8b6db590085438d179bb1086ced5817", 0x17}], 0x6, &(0x7f0000000640)=[@mark={{0x14, 0x1, 0x24, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0xa44}}], 0x30}}, {{&(0x7f0000000680)=@alg={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-serpent-avx2\x00'}, 0x80, &(0x7f0000000980)=[{&(0x7f0000000700)="d9be17641b6b793ba74d93c7dc7115dcd7aec72d13bbbbeb8e5c01f78cca4fa0a7b63e9ffb3e7c24d0d240f701d614a99d04f039b02d9dc12695021647b6360d10bfe7a426fbecba1010fca3ab09fae13d4d18172d3f534217dcfd2b819de7f567c32c16655623e632a2c0e95b1247d43d764728644d2835bb4683ca6212fc68836d6a15b361b8b400102f4738ec192d55f94dcc63e2c440c9b955aea6310d74efce1f4c7b6f6f3eb14f90d2d1c8d9410badbf227bfdce0ddf42a8bd566765a156cb37560838eb36e8cc8c09e3c1893fde83307a", 0xd4}, {&(0x7f0000000800)="1f9cd7dfafc0c8a281a0ce881270d3e233f1a45b1ae7475143bd87cc58638c83d9080c4a5edec5ddc58b17693ec9dfb380a1965fdbce31d599ed4f52060e484c2768899d7de757954789b8a4f01ffd2123f04deb334fb0223637d602924baa021f90b8b6c1df0be1c5132f5def6ed1b2cf8b9769d9663da5b55ebb074cde0be1e014d9fa4b97cca52a9a0b375199db6388e8cc6f32428e86519cb1d0c48e8f33662408f99a405c7daa7d514799b1af657bbc61a385f8b21b0636f0e8e61708bc3db526d678a3cd03656e50a3da3a0d7bcd6b708bb55fbf4700ad5af9", 0xdc}, {&(0x7f0000000900)="eaf65c5ddc29c8364b5fac6558a3e2f8d980258d6d4e54fd08a9dce1dc70282254165f8701ec39647cd9607d6db68de5aee59ab87e", 0x35}, {&(0x7f0000000940)="2460660cc944fffcb551c1ccae8b204218bc1b785cb2ae1b4e15e54c2246c3681b93e20c2c8a4a789db7791327d23079e0", 0x31}], 0x4, &(0x7f00000009c0)=[@mark={{0x14, 0x1, 0x24, 0x5}}], 0x18}}, {{&(0x7f0000000a00)=@sco, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000a80)="6d3c4fe8d6d87a247591784beb612ba2242f1a7a1f460a0a2b452778da38563e6b6f8c0ff26b9b101f4e70162a127e73761f22b75846892da8a0d6bcada97dd861394a0c54c6f1e5e9c4fcfc922f2d07da50cc020bb4033964fffa7055", 0x5d}, {&(0x7f0000000b00)}, {&(0x7f0000000b40)="c64e718c11bf77eb3c2fbf2bc61d950fe103c2cd4db1c982829eaf41b28668d1198e5092aa699b0d5347b5aec3d9715ea7411b1c991c46383b0f0a89d6f48ebcf00a2d94c6a858d06051658b1646f78fd2e0d654268ece39d85291d1d2ad49d1985225789ef06625a5a8a6142e855944b46e3a67a0519f7f53fa832369da9ad7b07c282d588e0a79ad2809725e1a6335c236af8683061d0a94b9b8bf06a8c75c8216ee8a27aaa6aa07371f262be57fac22cb09ca1f7f8f78c09c2f1fb26f7c92a6fdf84f16558923ec56a0c36da7a9386cc3720d3170fb1da2ecc400cdc57d2e6b047faf12cb25882e52f432357d5158482d78b63fd11d", 0xf7}, {&(0x7f0000000c40)="c866040a6d9c76052a44bbef26de06521a194a0c5ef9c9791efd247a99de", 0x1e}, {&(0x7f0000000c80)="1ee6cd69731ac3e4d6a747fc614f28c8494dead802ac7d17385f1a9bdd9bda985160949dffeedaa73f2492b78695b8ba88da1d8e3f6c5686eaf66a2d50827c589b7bfe2c0f988f1d8b7bfd077207dcb80022768883df131f91e82aa6c6e4eca8536f28d776799f6597c47d7b68b69f593088c27d7dd089fc4dbbc6dc5f76b5d1e5543b8b8b57174c0e0d85f2576e1093193c745e544131fb8943a61e41dc2c988633f42a7fa9d71dca97cd0bb0bad8584a980f222badf513de9c399c4d8b08e983d09932f4b0097bec2058422b97836f3c4d89bdb7fd59544ba6fc0aba27b3af519f71cc", 0xe4}, {&(0x7f0000000d80)="a89c2cd04a68ff0e496b8a3425e7bbbd0f356f01179eb93ea85985b9996deb3414", 0x21}, {&(0x7f0000000dc0)="ebaf093b60589506f021cc614c127f481eb90ef8a5a0aa8635e557736ffc222416976fcb07a02cb060a00aa2dee1a4248d28dc9bd369f66515558edee397a96d556a8042a71eb9110e0e125a5c6b3d457f8a10b61e6a878a48a1122fa6cafa8337fa0d999b6b2de0877eb895bcfeb40ab6b678", 0x73}], 0x7, &(0x7f0000000ec0)=[@txtime={{0x18, 0x1, 0x3d, 0x7bc0f7a6}}, @timestamping={{0x14, 0x1, 0x25, 0x3ff}}, @timestamping={{0x14, 0x1, 0x25, 0xffff}}, @timestamping={{0x14, 0x1, 0x25, 0x8}}, @mark={{0x14, 0x1, 0x24, 0x5}}], 0x78}}, {{&(0x7f0000000f40)=@isdn={0x22, 0x9, 0x56, 0x9, 0x6}, 0x80, &(0x7f0000001400)=[{&(0x7f0000000fc0)="5eab3dfcc22532e7d2a7d6226b6ca7b24975957a489d33cff52a608ffff23d62d7e54f4276e514e63fceece47cf64da611f246dada371f1eee0539ecc71bbc490a052e2dfcda07c6cbe5b40d26", 0x4d}, {&(0x7f0000001040)="03f45a0216002ef205315e41459f18908e9bcd3b2e1e12345b264c105edea5d04c0b032ada", 0x25}, {&(0x7f0000001080)="7d13cf2aaecd4038c3b638310cab994cd6a635e69ad1ca02937bf6b41d76555edeceacdb0712434c7e4c64618eec238528d1f73103b339a6ceb2d8ff6b555f8df41e296806e49560d3d4a5ebfbffcbe0755960d4e0916b914b6f324a024db256ebc50fe8132e246418b90978bde7585a63ec89b9e770a44ec6a7620105dc4e09240bc6f991c52070afb091d6b0efe303b37e527b043b979f03fe056e8484a2b0b75ba424dd31490629ff477ace8328bf260c776e9d84e494d1e878687eea44682871ca762822148e823e8bcd0dce629ec8c622048395276d04e25e79c50bfc", 0xdf}, {&(0x7f0000001180)="f893a95f2746b10bddddd3af3323a30fac4a629ee24328120b0988b8dbca32b57b97b75be95ff700bb55c94ce9350f9fbc6b567f17a938d200a3bc40d0810893b56a569be869bcd224503ad60fc34913e2dcf87bfef255baadbdf695dc4551891e0ab04cd1f3b5c75879aaf28a45e4688d258a2bfb2dd09edc4618ac606ceb17374178041e946ee7429c41676207e4c9a8a69281848ee45b612731cef5666dbd49f4f62cf02f5e7cc5cd889024f01b53b190f315fc1a7d494bfd03917662bb48", 0xc0}, {&(0x7f0000001240)="0ff24e17c52635929b031139b578681bf1c886b706402fa6194f862a5478ea0b7943af3ed2cbde2f04303b0f901a64", 0x2f}, {&(0x7f0000001280)="d877057f52d99908418cac05e021bbe2861842de219ef8f3ceda4be36400501270bc4686267b067f284e039fab3c9f00b929775481ef9d9f1b981e9af78d0401fa523eda958ce96bd83a488b848713c821ae6700fc7dc4079b66bda0dcf64fc1eb5e16d53a5068c915f4a754287b110c8c8e23f5dbdb09c9386b9d9a7de8551c1dffb8f13397a5d20859b3923cf3cb63bfe309cfe8f1b2f9361220fed2124307b10f659c5f1396c641d691a5b0b9d6ce03db49bdef1455531d3865ef4da830d3bfe1377c3122e81d190e44bcb8758975d0ef233547fdcf71ecbb1b1c1be29ba03ebe4a0f288245f2efd6489e8c", 0xed}, {&(0x7f0000001380)="e13fc17efd16fe74b273b40d605bb0c70956a0d3d0bb7e0d5546d589ac2910429d8809db2f41bc9cbbbfdf28091cb95ae6841eb063a541a9aa297f70c19649573c7004c054a9a4c5a535c5713c302133d2a2a1e0d3", 0x55}], 0x7, &(0x7f0000001480)=[@timestamping={{0x14, 0x1, 0x25, 0x5}}, @timestamping={{0x14, 0x1, 0x25, 0x8000}}, @txtime={{0x18, 0x1, 0x3d, 0x1ff}}, @mark={{0x14, 0x1, 0x24, 0x7ff}}, @txtime={{0x18, 0x1, 0x3d, 0x3}}, @txtime={{0x18}}, @mark={{0x14, 0x1, 0x24, 0x4f25}}, @txtime={{0x18, 0x1, 0x3d, 0xfffffffffffffffa}}], 0xc0}}, {{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @multicast2}, 0x0, 0x0, 0x2, 0x3}}, 0x80, &(0x7f0000003880)=[{&(0x7f00000015c0)="bbf77562fef838a82e609ae6782ba2c5fe22cf44b0f640a5fbf713d153fe6c6eb9d0fe539e0f111a68593e4e5f7abd480b67add0f79589c1b1d79d6f33ca38f3187f5ce0cf58eab32c5ce1c5d37e49cb2c87039695dfc7d4", 0x58}, {&(0x7f0000001640)="23f2a526659d67beb8348ee09023e27b44776414f47b4cc0ea8921f41f5cf6b057ea23e36299699abfd7a83994c37d6ca0865b370f5777ab564198b70ef9a6a1c583ba54f929f7f61ca668ce9a9da49ca0333573da3b619160c0b3c674aabb5551da4d772ea723f8ac66a92fc69471574e0de29115d3ef58e3e786bcba354b517b957144d0151fd3c8ef9abbdd975009826c7134be1cf23bcd17152af62291726553e5b63d2e5b54ca18620b31c4a96e5be35022017ff47e936259315ca3d5fa82bc4b1f1ef915d0c3e98601b46df605e480fa2d1e29f626ed1fc6dbd1bf5b04f6bc38ddec0b18e5770bfa4b27ed15ae70131b14e6c6da5d20e7e3defea60f6791bd06b9b56e3b607cf160aabc0d1df01bda049db6af8ff6bbf3dccafe69e038699635630aeeef6d48e5e01cf7bc0dd98d5b3adf80b809cce8ffed79a3e10b20e378b35792dbbb63a5ba3e774b4bfd03199f188cd2236ffc0f564a3f1fd0a1288de26f7cb6962235d83d4d10a97e62a443a358cf91ba17aa7d49c6a7ea6dcde9636a08d7e3fb24c4b1a82c054266b0958bb0314188036b0b372f6b1ff21ba25153ff681c550989105be2c4039135bd0e924fabbbf2a58ed887e9bad038e4d773cf8f9e1274d9e9332e5db2698c5cc5d4d370a04c24107be9dbce1eee295c0ff9de8608f8af244049e5001fc68b83a9e9ab0ed3ff92999c678d3af1fe05d54ae4877c9d73cfdd3c3d5c181f8c0d5e40f5e0bc5fcbb7d83e8011723205a6b320ef431946725687aee294ca04f73257a82e98e4547e6f729bc064de6fa2cecf597c0d58942ef80014e99c40eaa0a5ffc3d0f462c27e8419de51f985811264672f20f6bec57e2a39e128319e37db63024ce5a0f2f764f802560cbffa326c6ca02fba8f6787ba69fb55d68226835b6a67da6e6fbfa2182e5ba77b064a5f3bffe907761945042b6a80fa87b1a0fd05bc96b8428589734358b69be9d00ea839ad4c8b0ee9dfc6d963169e3a3e31188165a93c2580b220b3e56431cc1ab41a6d9ed8ad406a45b4706143e444d87689fb857965926550bac715a25f0d61fa2b16e91cf60f3c91c4112deded677fef4523c2af44a6c8d89e9ef3c45ccf9fb54a7b30e259c3b12cdb7ec4cda901699874e6739cb9046f3e47659c4dad9c015ba6d5b68e5b9eebd0c24189875713cb5e29968fe37dc990286d7bf5d35e35d0801fe947b567548efa1b78edc07a5b4259303e1f81584afafa5c7c2eb9309d1b0e683545433bb57cd5560152e7709ff1a0172a287a79bd16ca47077372c73dd66f9f263d7588bee6231634f4e9be4c3544c2ab86fcec201532d2d74eda7d0addfcdf1cd65ebf4525f50629d97aec74271d1f52b810f1ceb241af58947ac01c8405d803ef3292a08f898904ae0a28e27547ba5cd34f6e38f09c873d74cc4e1c7343957c1727cab992cd6d10d09eb2baf026febc4ca62b885fe74cb7b6bcc575503ac07d079922133666ea1377dcf88a2d521ed7d7f5b72d345278008e40b684cf87869d428395978a7836f789dc96939d21213259607807adbfcf54da26efe44ebd5c2f6cdac805462d9c3d593110ba4ef00c2d4788ab4710edc6d3512b408cce745fd6f13f709b64406db203dc9bc5681f059b8ced72d39ad154c573eea7d47d6042e5f981f78615aaf84008885c647ec110452600467d20a9a19a4ed23bb7d2b7572612b51de2dfdbb0fc113002aea815d8421e22445f381c59ff2c2f87ac6e5a8a8bf2e7ca803639fc1953ea5143420761426ac9a0025f31a2b85f55852f2cd582ba46dbc5877ef5c7f1be6f5300bc70495212cf6a50430511c6c76b8883c9995fab09d7b5156826c1afce55f604a669bc252744bea3c5571ad077a8a9133f47c0bdaf85362272e8c3d94373848ffb59830c17a815fae8453f4c99e8eaf88ec9380a4f4f6fb49872d0fd42c88e6ed493e01fdeb08191dde4cb8f01b501b06f986b3d0fa14b5c73ec6b8aa0fa2caa24425bd273aa44e0daaba509ffb1799d200ef5bc2ae88c5da35c12de4dcb017333a6f7d2c9774b87af8326ee1366bd2ce49eaa58fa8e54d4773b228e5bc82e7e1103f576a76a0017dd3b57deb541cd1ebc114a1d8659d8c0358f1dace69cce784d8584b2066ca5e04a7e416f8b1b2728b3e22d9eb7f3888725756596a21ea2bb74ef8009b732fbdbba51cc16cc3b7931fd9c8d1fb0d1158f45492fea41b3dfb0a1e8eb17bcfba66757177e562a8e717b0a7e6cab58b9e44e2c4e5bc9daa08b1e5bfaa4940c1dbd26bef92637a69290f8d290d59b33e262a7c8565610eb4ca3db1e8c8684b17ad7ce9ce52987b9073ddfa99511e8b801c3b7f7c7f8426cfa3f2e038e6f4332c7ce7fafecedfacb567ffc31abe09e550842cf5810a32fe6964416bf41404e1ca2f03a1c73b0ed053caf4f3090d663ad917c91b44bc07f2024200b1df1cbf2e0a5d565c13e0e73b99b55fcf370dae7b6180664584bee5bbb5106363dc2add70bf82c72918a55919a8e714bd98f6a7e34fef3ba8b43be49f8e780a6e9c328549efe70a831c610b469ddd67573cb1592bfd415dab66a4ede46ceea2246d5deab42f4314eac9f485c1ac8604d0a2c74deff867cdca05330d2407bd2b4826bc0d775f9bc437fce07bb1f60d0b8f4ddb4ea6fd2a53c1c86ebe5a6f9934c691ce3e86a9e32a5adda1c1d7b73d06d747e388f5c66903ff45e95f7dcb00ce34965ba392c77a4890e129770eb150d7e75c44b1ec869ea416872c6316e4fe57a55b5b7f8476b032b15985d3d18d18fd3dff74c8f9d8c5688aced70f2b593ab84e311afb4132e22597680dbc23421d590a3892edb932c0249522dc9ae6ee6457a3f4e424d92fbf8e010fe55ee0c34ee2744327fd7c09855d0cfa468a25c9c02a4f2d06233f58085a23eb132d2afb5146544931c23e2f3d2e8e353556b7d975be7786942bcfdbfecf2150e49031f14eca73491f364051ab567ddc94b2ff8e940add38edf7b4aa466c75ae1c3bcee68a38597b00978cafd81e1b8e565a9d9c21c44a774e76c1d6bad5f8de99cb721202b90e8f63b93ba802e78eedcc45dd15b2371556096f48b02cde75773b4c0864e2b1662b51113f310c5d0d86adb7211763468791a59573c868fa83b8faa6cc3fe48b80b2b50ebdaa912cc816ba84889bbacad5f657cfd0a745bf36ed67429faf2735519f5fa67b5d7e61a216fc347bd734fd81e13cc61a262acb2363f279405eee2772520ed9855d5ca50f1b32d3b84514bad6984819b79b0d3724380916ddf0cec3234c9330fc571113aeeff3052f6d0c131561086fdc9b8599426f2c70e07d2934e575251f9d40323453d04690555264a2a6ae169ff5d328d47f1325be6be69351a3d3e0c13793d5ff10a192abba46e0f8d49bf04a8773ba6b2a8c999ce86af379010bc06a641324664cadbc7e3860b437166c7a27d88ecceda173738de2531a92e9eca3e957a07df6e3a8846f53c5903ad82238c860caf54459fdf25fbd3e12f28462d05c92ae2c3ac2e27755166564bb1d4ee13bb890c4ec0a69e8824bb5928212c98f5d9649ab4505104ce51d906d6bcbad42f27df5a61f52db8dfae5dcaf2c59d693295ca8da31524fc7195e4eb68382cdc1834035900dfe84ef0450d13242aa5b5141e28d0397f5fb37246018b90d044e37e473de8cb88bbc9c26574cb6165ba85eb1a29cc02acc2efa136f54c4cd39d9aa0e4f4cce4334393f2753a434d8f5de9b82998b3025ceb5ad4b783c00e27ea9f720294fee09ea33debda71b8d4542165e2e79c4a238906fd351665e297b0fa537904662e255b7214dfe7f873b37703592ca7983d53aba4636631c766df7cbc7d45893ae1ce3a50fe44345edfde9a5d8c9c57848e900d2b0488ffbdef26d69d2d9a2234d7425195cbdf967191e734a81082ce3bb8853d9c6bfb597fdfcb7e81c28c80dc32810bc306c455a0051d3972cce72238a52a395f092bf02592336bdff6c16f1c5a35dfa5ce6834942ca474647dc7f2dd1526824a91967a01b9c1839022b31e9383c4a756d4dd6d3975e0aac63f4b341f2403ecf77e117fd8c3a4807887e78e7cd67e38ecea83a624d7c471f38a32f6b9bf1dd5e771ce76c785f1b614de8532d96b2546dd7cc8b4c370f342f11eae3774a539ce9dd38fe2ab32ea2a64a762aba0f6df497cce0c3ce9f931ee034b4c4d078973635fdc19350d439d1d586c588ad9268445dd004a259bfc811cbac990bec79ad3d9547bbae8a36d6d2759623413922a4039d6c4d20faff5803692a4d4db557a3c0c2d5caf65a2b4024dfb4a8e0aba09939d74d549218b280d6948c0580787bba1bc940afc00aea3b29f5cfe52f4d18ceaca188404fed154ba7999e4bfeb51df0664061a1fce8bdfde7862783850ff2cd5cc20d3b552d42adaee1c85fb17b947d316ac2425b77410319b7ff5662a8e801930a5d72d6f49cb8841eaaa1db21b20eba2345d7f68928d10f14d0bbf354fba9e0624d8b7dc8aebaf966c28fcad0312ea85fa4fc3c93f544038266f66ec203f2ef4985f3804ae0c97a5b04fc18c78a2a2a1391d04018935cdce88a32f411aebbdb7f6525253785bd2fa071196f13ddc836fa0b2b7cee5a9246cbc2dcb24bda83876163f552ba177c18e8d3c4ad15db5b447360cdb38f146a67a8a0ba83a097ad6af200c43a7d8552b06a728f126470db43801db0711886aa5cae68e4993e955f6f1bbd83e5ae08c3d102bf856d782629915cfa084c2eef82a58a73306f3c394309c30e5b0915f73138689e4467409846972371c2c34329fa85cb0a805d74a3b52971d7079c5bc9149a36767179ed0b9b97839d1c752017c376837ab19390d51ff90719d9113943601746e15fe9c4b763ce997bb52b8954c6f3fb920478f30c7ba4059d7bdfd3e20fe077771a38610232c2672aade11c7528d102d98de3e63f6db8e8bbdc329d84da7c058ba9ae80138c1a528c5c819d86a12e6d98c436f5c622260ec68667a3ed9ec168a6b643fcaf676d64aa622015e8ca22536f0e8eac73dff30154249c5322234a9c5d759afc47cde368b3a4251ea7673847300b2cb4dcc5392384b00a30e09876094774c112dbc2e4a6c75c1e2c84db49672600ce901c39b70daa1b033b76e2ebdfc7c0f5c6e00a15df8df4b524562c00fd017ef007d9c21dd48813db85d4009f11c09b08c93ebf7e6a1197127686f31a6a2ba5be92bba83d1fd3ecf99a7bcf6d04cf6976b1814b606ab906b1df372af63eca765fdc921425cbd4c0d26e2703a8bc5b53701d703de66657e8f310d70bb7dfcdd9c31072954d2fd9f1928dd509477ba4a4af95f4e9910eb0b2555b6e93ff5cc18efe9a2a03fe57ddfa1530488007f0fd539478247e71cb0af32a6cf7f111285f157857ff9eb0f3583aad00ef6315375f77c608d69de394d1a44d2fbfff1bd4df518749b8234d488de8dbaadbd707a9509f1efa8d03bf444ef1ae64c3375438d5f9c09b96632458ac2a0635a89dc41d2bc316a9fb50ad27cb6daa2795de8b8c9a4b719d744afc26a3c8723a871696737c23e360e32d422b95093c623020bf07f669c99e28adcb2bfe07451b4a57f5c9ef891de4bc4d052728100bd91d1149e0453ea5bff49b0e6ec5b22cb9006f83848321b6f8132937a78e98140c68bcdeb34ca8c823c299afbd7de444cc3571323e5147c6deac0a28ea3c5f21ba514b8cb23d383574a5fdf0aad7d1fb98cb75dad0acbb53b60df89d7a0cf9737a074c8ba9f5665690f3d8840f46dad70c6ce878884287768a8ac1f5e", 0x1000}, {&(0x7f0000002640)="72229b065eeb5336df5668f869f611431c20a2c04a78e7de1aad5c275c9a51f76624c0a34a06d9794d52ca30285cab6a58c0394900aef29f6700303c7debacc3feeffcaf1231baa7f9a79ee62014c57b0cc5ae07ae9023537b96b57b3bfcac8e72991bf5dc67ea8e8b0261c40d6eb9f3a1d0aa639f68cb78ca5511d4492881c23c9f683cf2bdabe293a2e634abf422b5b82cc08f101a14af585ca0a6a8c637ad672e5115c94f3832980ba310dcfcb6a2de80cf7ce9f5e457206d34103b154806acbbf4fdb6dd40fda7276d92a0cc735e99d79be505c2ba3f9c6b00658b9b199a122c3b1b4a5570c87e5ca23c4623aef57aa8dbff8d6fd7573c6deda4edbf849fbae0824c8466215a7e92fc7e1cfed33d72c2b712c0a8364d952eef79e3751c67f90660978c6268d181baec41a43b3ba5fbef2540b31f3f20fc943ae7e1d88e5139d8d14ccef206771f61ec3f7200957cd1f4204f250aae1a346386d8333b5898760cb66b54a3a998eefeca8a04198a673c2f0a968be658da365b3e5608fc88a040d445eef0ff05d5313188565f0bc8e41cc67ba90fafee168149adb8b161cec52e16147959b4d12d869d0b6310e54d5b55d997b84d8b8e6e40cae0c5c92c8f7cc5e18bc0fc4f927e39aa4ae7d01c899aba523b519caf6f1f496cf8c00521cd31f06bec39ea58ad163ee51be751e6bde42b192573647c70df4ab0ef1db430a5eebc0575c73357fc59946608e97bcc03d06311f4a53198e38e443f348b22e2f0eee2867a8235942c8d97f40efa266094d6f3b1630da25817a3316044c3e174d373456fb7e0df0985a9303a1c7adc4e85ff17085f5ad1f7696e20cb804af98695079f6dfb7f3b78408e719d5bf0cf447f75b919cc00e33c82c3454b2526245510f08bfcd3549c645fa62c008c67b2b367e160791e469de39e6dd6626d06410bcfc7d419758edbca56e8bd202fcecd76dddb8adc1dc3097c084cc33c19475fbd73bff571ce732038191971a28fed348320314c70442b28c7c75cd44a7f930f52dec539228f2d0e479103c22fa0a3b428d7865db1fafc54fe080572df8bc4ad889425127c2fefc39caf09ebeec0cc1a6bd3846f8b825ebc18af1cc7c87744fec4d2af8c570faa8272968ab6b2d2d457954089c57e6c7f45f0d3c9f9985a999640fba7022eccad63122095ffd49c8ae78f694e1b216f454fb761c2161dde0a3960ee40e09a54e3c1f251e8001d499d48ccc407ca567fbb2871c5d6bd61163e65ebac797b19b059624b0e037d318cca6260fa0cdfb13c8674dc855c3a66e86d3f4005a1ba32c5ec38a45abecec2a2df06d788a1bcf5699a988ae58b4b44f86309260f54e840487266b214f74a8dc71d60ea24afef00075a5978124f75b0f897eabd236006925f352a2e9df98d5ca0de9fd837fb8bb5cc9edcfd5d124c6fe8520583ed059c712b54b1252c8fa37e439caafbe3eafea9357d7a510bf0d4cbb48af9a9e89866fb4c7eae4e96e8c712af4860875e8c02c7a9ab59f291dff7af73d7f625c631f5b2b856d8f20612ae1580ab80532426c028a2302ad4f16b46eff251bb8c7e255491e8a39d4b11f5291e065ad63d315151d43f857ca481952835a86b7f38baa68e44d9b55055ff5dcbcb5b3d9ffac19f2adf2752b17aef3f64c1f56e3e36d3407c97911c90fa86b59657e1c4bcc4401da9198d96e3a2127b894f0d9b669bdf270eb774a413d9185629a634c7a8889cc86db4412cafe975594270b4eb7271dab0acc254a4beb91e3e500217ab4b519e83d924d9fc19c89b745bfb63e2ea6f9f0b140143a86833e51b327c3db6c8e35f77e2ba3434d0ba72efcbbcc5a2591ebbd95bcd1d55b5946b7d9363b9e80d19db3409ab26754676aa6b3346a6bf9a3e4d98af91f5b8f3ebf5530f98532700cdab23e2f0af0c55e0f879f23ada2d34147837a3ef1765cdd9dddd5907bb0cbc8e11edb1d7efa4bb4c67d8bea062041fa8ecbda9617fc2f7122f3848fb090001c0c28025fac41ea5241ef8f62565f17d9aa1c4cef78d8a65d20fee14014cdcfda785ef61ecdce0d3f1bd9cd275611b25ab0420b7fdfd4e89358b1398d3ec55672aa3a97e8e739d15d9afd5b73fe599b3540218e21e0da378bdecf38bcf3a164c6d7eba61e948c980431559a5387057ec51f258b69f1012a074866a37fddb69b972115c017d9bdb324ebe315f2ae047ddd73847b82b2c9be7e5b2bd7d92d9268c7dcdaad9632777cec7e4e02d8cfba3a53079e1c768e050a3e46f38c8d3244697d23ad94d7c30d2b551fd42c3f8ea59abedd348950e44603181709bf735d7842918fe77e1d86c92b7d8cab2a80d91b4b6a42777e8fe559ef252342eeb6ee9c28c7d35ef85530cd9b489f126e8bbd3ff25c7f2b732dd519d11ac37cc0e76d0e545a2c161ec7028b75e573d55dd065207697bcdd980498f792ce5e7e6bbd9cf385856fc56f5f68279f30bcbb448403f6c8e22d131ee5743c3f214367aa1137d849374f42cf80971be1d67fc50b4803d784d20aefb52f306d8c406f9acb186fd2d1c2c6e9b724335f4b4b3ef10b945994205989a20137622afb44aa4e7d794f288d07aa0a5fcf957db845d3ff52d317e4c98672d7a6c2e07e530ec0635e3453747f443b45305a164fa193f59cb342bb50fb536dd4eda912499059b6d2fbf00afb23c0b64b502ca42151ba4713b58bdd830a2e4f15a44fe2d212722555d1662f69ece91d930220e739c149dbd6875912d8401da16e5807b0b00c4aadd01be3be3d3cdd1ebd5a8e1e9a67d09252907e8a405fabeda645104d6f5913c34975c98120f967a687fb070ee4bc694bea5871edeeee14514a6b874b87a8c234413af5240402d51a3f62bb276e8e8100d2d9f0605fb1f3538c2238593d6912d551051005d3b20d21010e72fd4daca81a3cb2113a122d8204c25986f92bf2940c787e3a69a016ca84218af8713388864205c27bd2ea5ddd29282c4099dd0987150cac46848cbba17228f63b5f788294646ac6e539c2398e79c6af216b3056e9fa990c90f946f81c792decc766d57e7c4cccd5a9f478c8a75531ce12f662aface61eece32e465ae708ecabd6b76fbe90b0383e912059bcf4772a198035f178084d6853b9ad7c4563bb36462b14dc051c1eda0f9a9948fc0a01980e3ec421b27eda51d5fde6dce1df935bb3dbd968ecd5beedda4ee4dc8b3bef2517d060ee09efbc2a91370e16b6c17349af9c44e6d037e4a2ccf825266081f09d5d37c4f87951fdd1ba470ec4a9ee09625334b3df22ece833217a408c6b6eeac905a77a800bfb1675fa5f04bf979d577411c1be985caf4f40fc8231229233ed93070f24b064dbfdec170a541c219d2fe8a8b36c8bb3795c2054b02e195eb691274836a8dbc8f22f3f7326b80b85006820eae270a68b95eb062d5635199081be7a654ee2521a18caba4614c2817062b1a4f16380aea8839c38e1f4d7e7cccdcebfbf8c551a7e8f041e6c82159fadf849a7742fdfd7856da500ab0f1a98cfa338a8ef5864a525cbef1aca0a85bd19a25561c4a26015ebf9829fddb380f10b20f537aba6bdfbdb123b8053f9a8d1b5a8def1460f1a2237e5c63383a40f4e34583fcb51504c51218e07f0967b2561f37f3f4b1b7bd22cd91ba49e5044975e6087845e72a0a41ce2e6265dfcb2ab39f411f6e5c0148c26e947d57ee7d84df2d3f8e7c2fb6d59576a90e08a4610963407ac63404e3e6db33175aec7ec875a060f7529522101f0d59e88da61406a83d0267fb79faa35744573d32ee140ad48e59d99d2c1b7e40e734a880e694097064be424a34962d6827ae86c1e8d3618ff106ea99addf59b309a35cd90488f767183993ef6c4fb0f04d7bee2f9caf3a6545f1e17cef8c8df5036c18006b1a1945612a548d12560562dd3116288c4b4ce835e646ee42374bb050fc2c2087f82fbf9dbd8141d911e63067c8c9b5a6a21744365c63cc2e8817bf0823a854e29fd211044a1ef9e75e6662c516d4058079b2fc4217bf5173d79dfad94abb36d8a8c3721793df3e3382a5c0980e2a1d3f0acd19f3675e3370eb630f29616a57266a5f5eef4c44732875f4044299f4f33bd727b36f6c5f839c0881336e7052f47690eeb4bf3e418d78c86e4d123b286bc0bdb80f6ef3f0138cd3714c580309a491940556ce072f51df483768c6b1299d90aeb71c9a87fc1b7ba489796e746d64835878a3510bd8e8233915216e40391ede4f8ad8fc04a2a664efb93eacdc9ee126cf1abb1e95f8648a9db4985dbdcac863417d6bdf69463b3467452b847fbdc2cced9875003b11613d586f569bd836efafa646ae3c6a9a6c3cd2d738d84fb90a9c6fc3703e15e1fe44718615375ffef85f93907b9eff7ea987dde5b0b521d5c6b121210ecddd3c156ebefd9f5898e3e534b3e0d282c9a233b8eeee847e4a31e2227ea55a354df54d47d1dc0633a7bdcd8f60ab534135cf41283d7ab9175a7974fca28a7dd3a75f533454c6a401ff2b9cd97bda649ac8b78675a3d3af1c409d8e4b8be86caeb0135e708d1b34bbec8060930f18e4830d95ab80951eccde6fc03142f1b71b5c144e31205e8b64ac85cf5ae34bce1904485e6d0b3459227b57cedf33e5f8c7da64001ba00747fd96e90f8cf631a4a814f833247f09de9bcd063db05c6cb1e12921b47bd262d06cd90a41a6952e7c8a7bead4bf40960c79faf8b23a77a70d5ee8cf5906bbedc224b3c67e55b9d6d408622091d08bd1678a814f5f691279d8f2a6f28d91008d40c3e1cc4a6111fe0957f414cb7f4db96f4e9b85b96ade64727d90030b7c459e1f554d48ffd88539c2dbb7981924d55f90e52adbfca06c6272b09e602eb7a08fa040d0ec60faedae9fcc9492f8d32bd24e9fefbd3603449dedf1f87a06eb091a636bbe465edc9819a5dbd40ce3844ad49d44952544a7cbf36d0831c781be21759a6065d363fc0969a52787bb98eb3aa292f9d5ff7a46ebd2ff8d5845d6d73679816b5da4c28e9debf467bbcb788cef11549f009f8ea121fb8772b04349126db672a44df6a4cd5f14884b69263d2f1f5cdb3ee0476fc4fe0ed1ce9654d3f8f956b87ab93316918a027f0a638a76bdf6752b6f0151a7a525d492f39e5a841c6e406ac5474b18c2aa90e4b85bed2ec1f845b8c5429f8e174fa9730a93067509d8bd100b27d17469112413afe72a70474f1cd7f7a406539b4748aa01f198975d955c74c84428d45c33fddd10b01c09b694853f5562a5b2111b0fbd6daad1a867922872a738d3a26ab7256f70bb9aadbfd9f79fe2b6ef29815b3e74da28c95a2a5527dad1ec53f3d4077746af3d0008a9fb9c2eb2bbdf475f9e93e778cee70fcd3f004693f8009b54c1c5369a560fcc4c7a09289dacfb320e1a8558a317ce2ae91a0b46108c810022b039e00b8046efcaa88c8350140e28e6bf162fe460b8575d8eabc088c4b0a15210cd27d617f4c2de2c537934d28713497682ca5a6f63a616c53d72c15910de9dd6c97da6ebd17f04264cdc38cb85fc742e5c710dd90f680123c8b292cf84452445cb34eff567c6b69fe4360a03d90cec101f83fb7e41312c3412408abd235c0c721c510c228369222ffce6f517a391e7d50cef84033ead0943d5492121ac07c3102566b1817550f62002770d2cf13e81ce2aa3ff74c617f35ef84ded2bb5c8aebb1e192b7342ed308ae60c04ade9f35f367a28e5106bb7a8399cdcff9e1bd9340e3e607c0bc7ba3aa08e9f35502e04e0f2afb62e155dfad667de75e6e30bd8cb27bf602cb0fa5374bdb7", 0x1000}, {&(0x7f0000003640)="d028cc151e4111d20104104043ede924770a3150643db79ff8a3910020a496883ff68c25105b801beeccf857aebed7d89515b0356ae9", 0x36}, {&(0x7f0000003680)="f096281adc7361e8b2ff995e3b2eea35e3edbb98f12a2e70535b89b6a8db33173f885dff0793d93f494332179aca43c860bf0d585fef3d1a6a97ef902ae686f4fe27a1608142dc65c981e1040fef67a69fd7629ac22d4130653c77b9c44b7131ffa64ffc9a8cc0b0c3566d832ff9b8f77e28b3300e9edfa15b4fa5e1d98b2ae40e660f35eff2f37e510ff665200bc40a9f838cfeae502d8145265c138ad9011a224c2e78f23ea5502df444cbab0a4db42e4d621235d809f399bc05611f71c9c31cd4ce06c12bd60d8c33099b9989f50a25a89b97883c2f29a430445cce7e12dbab00ac6ff5a8c86b", 0xe8}, {&(0x7f0000003780)="38dd0c9eaec6e39146b49d962494b7515babb18fe83a4701804c6bd20aa330368e0d015450d10aa16e2a68f4620a62387969bb74d9008b793ee9053857571272b89b08938b75cd331e87cc437a9259115aedb1bf05a78d13868c31775064e01ab9eb994a2c0bc3651322da53ba03a04a5eabfbc0e6abc6243ed28eb33da49498e9c79e5bd932236e018f6a1005d40922a27225617fad1e0ce93b1177ec8e6c6f28dc58cc5b10437950bfad15508bc32b4772428e2e2ccf8072f3c5f3bf691a334c978d17af", 0xc5}], 0x6}}, {{&(0x7f0000003900)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes256\x00'}, 0x80, &(0x7f0000004d80)=[{&(0x7f0000003980)="7d2c809eaa4e4fda2062c9477467e6a9619437e1b67acc1bf3ece19ebb475223c70ccbe33baf8ea79c35252389daaa6c41deeaca84e49c896e93c4a1a0e6e726b4e8d358e86672317c05cc9b048667078ac00e8abea12677663076aad6cbef97babdfba7c58ec2f14a61391d2e20807a8b3cbd78ea40ce66280d7d4389a777b06f3b01371c75edd8b40f0b3907b7696cda099f8bfdff3cd15d64c68d019a4b043f11813ac233de418783c3", 0xab}, {&(0x7f0000003a40)="ff868d9530a3d4665e156801fe06992d4b41c4fab59a619022769568a959490620bc6cb6edc23fbb766cd9782ce2847efc990f634dcb83b1a3fa929c12dfd26cc83b37d9e82e058e6a42a035f559fbe0d4f79708bf16557362bb045ac3ae0382c149a43623ffc75d7f5d78000425971a49c0348c784547c5b0bb0de76a32aeb2ac722e8c166b67c7ad3cf8cab76b4ae5ee354543f80c16b35c8ec813", 0x9c}, {&(0x7f0000003b00)="e4b19231029c01a54b78a80985f865570ae8877853842b5e8da8e7a33d3d02dedf678820b0c8215060264b2d798add4e737c4ef99d18687896afc40ff07854ed4edf54bc0de9c81baebba1764b339ff15813141d6af1d9d3ff7f883d2f6f6abd372859059462534564a109aa7be5cd67f2166842016f302f4da5481ba15855190be6e64958862a6795aeaa42d9e33cb35a610e6e2bbb", 0x96}, {&(0x7f0000003bc0)="41039d50c991c39e37e833598f588fe8c5c5d5e556157f1dcb7336f7c093f42acd3cd053739aee94ca9b95f2e2f23ac475f125155f98b82624346e06b5d11dd346ba6ff0ec93910643261801e88988c11570", 0x52}, {&(0x7f0000003c40)="f5f6d9fa1fb4bcba433be73aa102ec8920857d3285c35cf31c72382bf6a2b3c0f730b08f2fbfb1a04650f525980ad3cc6dcd3eb34a1bb034", 0x38}, {&(0x7f0000003c80)="a89cd484dbf84930032f95eb9403d0df08c381539c14b8f8e0be2de3679c4c15201d57d392193ad57594", 0x2a}, {&(0x7f0000003cc0)="d22e8de038a742e6382659609dd52cf4b07bf977e5b8b3da4535accee317003c27e20755eb6ae39914eee86da1a5ff795970feb3cd5599e4e1fc91bc56214b8fa39f546e63ba4e13eaf41cc63b170db7b9948c239e6764decb2b0fa277fab594528b6d2a4c49", 0x66}, {&(0x7f0000003d40)="b27ea35808669b94fa5340353ecf5a0c", 0x10}, {&(0x7f0000003d80)="8e964b8c44825c3b0a59cf6ea99fd8e390eb5cc8f48c94401f339bd270118e9f528965cc6b3b2cbba80c7b020a62be1531f89debc0d1a52adbd6f84684015a74c98e8273488fd4f32f516662c479f2f93465e3b167a3d0529e980ff9638817fee8d694f67c0056e6b6843eb789abf6a231bbac56fbcb7e1c008d39bee7f9a62e250126f07e4fa9a3e8313ac628fdec67a696d9910c1ea635eabd9fa83e430ee0d9f15958533d24e01a22f5b6b9259d35ef94e0218c8808538265f5c1e7886a37663fbd68f2f020c2c2bdceedd230dce578630b13aa525bf6e4aeeeee04420731e4a508e78ab9131460ced7cf9b025468a70b5c08d9b62c76d4c82f665203c9e7e6597897cbe19f9b5bd797247318af201fe71c75f3d931077ee43d0c210300e651bba7f11846ce97de70fc2c960f4877d2ac19be5b5401f1918d629182272d314b28b831dfeb9fe2fa2f4a933418cbf50abc7174ad0d05c51944b0fe1aea9d27683a1bb4cf3bea8bc18e85a28a69cb3d16e9bf1d7f3e15c64fdabc34ae63a51557ee76ef92e3061f1eed175944642c2cf182f44262b67aa0469bf132f6d88d1c27583620e201443f3fbe8a0d767cf659fc892694fe7ee6c1b49ffeeeffea28cccbda28e3f26c91ccd4d6020979e06828644aa75ab407103d1a9650e828a7a5702308cade423732939d279526145ea3a506119ab9638330f9cc14a91d0548d13780a84784eae10b18e0b86144543b706b8ce6d3d208ca956df1f5bc782104d405426b76bf15484794c2ccf727003eca3bfe5e726185a56a6dff434ec858a5b1c07188416c49c87e4d3b2a78734300cb863ab2c44d2b322bd520c989565c6eee5a8b5549b5f70a49101fe9b3599df3cd2e12c5030f41637b09be5d61f6b319091ec77cb52a59abf9bed3caddc6966d78d60ef4d937c1370de1f617339b5b9ed8f6ba73f63dd237aaaaf1acfdb5ace9d2c2820a099ec3b253e3d84eb7ee958d7bdf2f907fa39455649d46f3568899f68c5a87773124af7088925a0d95e9031f0e8e2a8a3a25a95eaaf86f545c78e6140f4c06fc99d6fde96c1d513dcfd46a233f7c966069edf688634b1cc2ca6242a27ec1cc60cad40cf3348e7dd67949ccbf72d7aa4a4ec5c3288c582bc0e28ea9feea4d694e7f2111713e2c42b0bafb6a076faee00746fc1a99b9cb3bd612eacbac0e59cbcd901a22763f53166a91ca760ce8b1e0b3498f2ecbce87acb7eefd6f0b8f0d41a7cb3c8f2812c7f45df6d55d9eda1eeabab61c560ffa5a79bb8af705fc90dccae03a117f5a9d8b4b365b5feec49fc4ffc725b9226019081140ab68b42794e3b22ce8a44bd7fcc4efa2ab18a04a103afd9dbfd8daae3d15715ef1425861cb92c8efaeffe1aa1cb477022804ec3f0ce448fe66c307b590a77f7167d94d2f4b00111fcd9ddc24fef09460875351743036a43d1c7bd74128acdbdb4a4550607c3b05bdf4686bdd4918ea1ab1ca4d6b6e4a9cf443bd419dc009657fdff22934e8d72252a403ccd466a7ef7ba90a354f6e0d55332dc1584404dc53d8d7ce5a0dad76c07ac0a9804b9286dfe5f317339de48e0113527bfc2e8f1f0b77aee506e7777598b3865259c438c07c683010024410d278b867e084d7bdd493eb85f61427d9d87d5c1b3cc1c07cfa9dc883e39db7bc01640c4c84dafda7d8b5c4a99f60b94bda76c31450eb4d363ad19b9707d6a3821f38fbe1e0ae94e81cada3fc490b6d78230001ad013c56b7fb73d354a45b617f920e7e1a07aadb68ef7f54c9be7264161ad8223528fb149787beb20dc37826250674075d9fd486cfef9d9216333c2336b241aedce02d2b2401fb92c9e0d3cc40accc856089bdd07a8f0b40a34ac0d9c5f6c2cd19f32dc9301a17fa68e21237c313625d774e6177cdd5fb4cf38f1f449b750aef0a2aaac561551922ac41f2998a43d72968b731e497ae48a94836b9b15eb0eecce85f6f30bd0cf585c07aa578bf22bfe779497be61c63815ef7da0eed917a21f7d97852c30300844ee7f0fe84d6badfc35936d57b8bb8d0afb24e8fab1188cff5266ffa1950be42478e20ac486b2b8dc053431cbad5e2f1c098071366b0c4c703387008c05cdc79a37859e7e58c62ddb71e031137b031b7fdcb5aa0ec3e4a73498f99614767b425dbb4b883112915e1fddb5888141ca8c86a1ac2ea0c09d8325caba877d14abe9248aab77d4c5e33500086b68e6b41965fecd421429f5e089b7a844234d984f19233458f89cdbd0ef4299120a8be70af8b7ed3b5125d37d4322ffa547360686136839f45034f7b40b3276ae16bd3723c306468fda26ed48f01cb91d3947afc81c8f97495a128fcfaa5318929fc2f39228cd577eaaf8d4fe17464ea451de28d0cde2a692c297dfbe7ad4eb832bd569f56d85c1d41feabfa96359f6cda8268016a9ec4c7e5eb7439139b2270229e89395c35f02c940824be03df1312ac07547b514b22d09b4b2338297c2fe4bd48c594f0c7ff9a8c81c0be09bff8f3dfc38d314df93ae068125ceea256c0cd6996091f1d78cf7a1471cfeb9fd9f64ec7a5be4fee446071f1656d2c41d3143c5a3d5fedf7618e91b624f6705e34fd02c20c4667b469b3912f83c1326c87b5812f1e9cc803465cf2b7f4a0e796302a518d3540462f6299424cdc3764abdc8fcfceda424f06f44db6dc683902bcee8f07980d90d46ecefa453cc9e21aa01561554ea30e0a08c26c44356f671ebec8bf25b7f22d49501cf5b8892272a0b13eecb24cbdeab88958d2b98871c4f305d6b77863f81eacb979849d0fda88efd2c09d579dbe19164a14e6fa8197492527df8481df535b962ee1f66bd10dc7467dea585d8e9324b7fcb042fcdf88dd9d5a2056a736804bc6193eaeef9811587a9dcc192ec95b4e4602fcac89701323e5be987d30c883e7c7626407ef275dddfa78602d396a827ba141afdd6784571631f3450b85451b993c679bdae8789cb0584d15520013f9bc771eb1340e311cc10ca5b6174ee3768550eedefa1576c81db5c9930c82daa252e90e997d5b2c58e50f9708873847a02401e24e9e043429c76d52bd744696044e27335aa21b87db27ebb51b9aa4892827009d3c07fbce022d7513e75adfce7663dcd5cff0abcae75a47d3e1394026ac264cee0cf717bdd8ed04a62c4199e4376b5add1de282407daf17f09d5170eb18ba9adf43897b9ca99344cb5968ad7e0f8d7e230459e11b5f5da9bbe2d59e7b70203096271a6f265c84c54ba8d989648d20a29e755bf0ed440ceeb03d38f3b1325cb9e4c6c39175e54c3680e009a0cf52bc44fd53909cf84b1be0d98c73d940bffdcced638078b2a8903fae222ac8cd0baf89036635676a395aba18450932c4a02b097159929c208e0a6362668380e5ec96a2c9bd590e8645b4bc8fbfe2d32899f1402d6f0b6ec19a8526e3ab45e175a78e1c6370e055292a9926a150bf3752dc6b0290e7ebd29e480d94726a9cc9c225f02b46fa2fbfef6ee9c3a63d38e7150ebc933e6e113c87024c062362b1081b69fc2c403cc3d480f6dba9f23634daa6740bd929d7621f4b22974f2d52f3a014fa23c35c4b88beeb03c8510c8a7e20a0ab58de9b18bce2038dff0fe8a895215b6528aa8868e1a2e1ea4f899c03203d828339d91c23136aca7534deae4d94d6b1ca48a7cecbc14429bf0a74150561e8f32be8eb25f4be62a9c09299cb31ea016d6576fa7d30605f019046ea5f05ca604919d1c9c8b256ce78c2b4f8863174d38d13e72d061de202b04373c8fcdf974b03cdb4f806d0ad806c64402c1dbcf84d55a33a32f00ad68fc6d7cb786cef308bfc0fe3f6b83e5959f1da83e63bf450d2310f548ab4c5f51dee6054b34a89b980404776df0a410fa5880c24b357b3c0128967f8cb2cbbca3e956c12e30eaa9af8a83f6ade7adf41f7fd47642e67677ccbdff59b3f34ccf3eafa730d4d6ac7f77cc83bfac1ff644656c01879db39666a4c9604872eae8bc386ca5dd5d3f022e9bbce81b217b780809e7bceeff6b6dd9c0474eddd17f7ffa553e7798d247c00be80ef6c6428eb57465eeebc03d5cd7eb3dff880a90cef7ed5d9c1066a4e7ba1cf65718d950d21979f86bc85559193398e2fee6abc703f23a2431384b16435bf252505eacdccf4c9af57e7fd79f4a8057f669dc011b14b976ca5cc874519b99096390c537027957083893857177a9b96b7fe96ac99e75ceea5c3924b959b2c452715735c19c6e3466216abf9c4b71ace0a9e6dd6e9409c635096eb3cc9b4733a86e8ab7aa8253a372a8cd91a93f58e548c109f365bce4f5b346b22966d057e269fcfa74af82c27209e923208087fb70791b9a2b96741bc2e2335c5aadc2019714d7f5b5297c69dbfc84a891663f835a12a0424caaef2547a5401955778e22cebb8437980c607ef5a1ef1757fc9ba776fa1d27a132fc17373163262b60e0f604b9e548b505e4424ab61d867c11552f610c32bca99381e76023a81710b0ff194b37610b32844d893538d6db8476360b1ca96d6f04e919b97b50ed816f2718ff90aee739186ab36a50afa16655e20114ba391039e824ded58f6cf84197e42777f66f701176876619ab3bc1e8646431bcda119b5285b891fe3c64913591fc1c097b1190e6b21cff01049e4bcfa2b69e6706c87dc8be6ac983010c7f064a593ffe4bfdf8920832c130ca9b42546a57da9facff9d0dffcd4acf21c3d8df287bb53097087d10118987183cbd4ac42e95d33d3d984d7e6531dc48267fe5db79bf972a3d09ad3438fa829d295725248f985df4aa9b6983915bffad3e244186483cc34826eeb6a0e75d42e25bacad64adc914776ca983558137e0cd0e7322c353c940675e0cb91ad7db1ef9ff6a0b64f6101c5cf31b8ebfd913f3bd738a675e7456cdf616f4b854254767cf3de14fc951ac83e0dadeae6f43b929ab57be4bb1dcfac9bb21b08029134906e84f77c8b096e10d5b00e96e56bd3d8b5853df6d0a337ab79dbf2c71fa0f5277ee9931d3010d3136ac51718b7ce7cd21b877deeb0433f45237607a5932ffb0e4208b399ff487b1f2f969cbd7636ba6a8901b16d4771db41a9ef22e46d2df8c2b8f25533e986b63fd521130ef4a8eb5935d5d362bfe80b9dd06d5ac12f518f7958fcacf4d7774a9188c630e1390a9f5df884060194e8b6ff0406e9795ee33142e61a727577206c03833c13288d2375b6905d49f08f8026fcabb8c349f387f0d91bcc9832bb429935caa89fe4f05c5b6f056af4f7360dc8432eb18874326bc4982e95f5291cf4b100e44e0241c5987115eaf0091076b3a329288aac0175365380b74617534b7d3322a3ac7546d39cc9520671bf79ee97185fa589271f490eafac6b0812aaae1706975c4471c8b76d3291be33f86b342381630d74b38aaa3e79b378258193540f645090c7070a44167ce96639d838b27e8af29f958d9ed5dead1c053cbed0f38eb4f60e4b08d70cc8b718a67e3b688c084876d6873b227a1677db697eb98f5deb52f10e3cf4374d16fe27aa68c49d587d0a4a7648a5b901bd36b369a1392c473a6660f9d300ba585ab7dd350358ff67ffdcbf0cf4c4e529a6bce6395c31f53279de5ad0843d9a3047a5b55c83cbf5e9573c0bd89b4273287f0484429adc46402f92a78ed76720ad472bbe6b11da0e8e9fc0e58252396c503a6da03aa5bae05a5245eba0f223e15a88b560509f79438988123997837707f3514db9f1fc1275c94f99de2fd642121dda4deb83a4af8792f484e5f8cc8ff70b0be4ae849d48f5014febc071ba", 0x1000}], 0x9, &(0x7f0000004e40)=[@mark={{0x14, 0x1, 0x24, 0x1ff}}, @mark={{0x14}}, @timestamping={{0x14, 0x1, 0x25, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x4}}, @mark={{0x14, 0x1, 0x24, 0x20}}, @timestamping={{0x14, 0x1, 0x25, 0x6}}, @txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18, 0x1, 0x3d, 0x9}}, @mark={{0x14, 0x1, 0x24, 0x10000}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}], 0xf0}}, {{&(0x7f0000004f40)=@ipx={0x4, 0x47cf, 0xbc20, "886649244130", 0x83}, 0x80, &(0x7f0000005300)=[{&(0x7f0000004fc0)="28c0b51b0e809d227c104f1bb86de7511c70d08a3641861e3eb1e12003b88d14fff2bb0dbef1de3e17aec72b456cecbfc1fdb10877a36d34e8c5d1087c7c7dc8dcfd09489b712ff62e96ae7850c503df8a11d9dd86512efba34421967ac790c5f1fefd83954a60814ff0a4633b17694a62d12ce9d1358623bddde1376867634fc05223e5f448829193c790b74b747ee1727c8179cecb7c43f46833fb0e54907d21ce9f8eadbea8a578144a1dbbd4d0d166885b804755bbe34660ab79", 0xbc}, {&(0x7f0000005080)="65cbac5c2dd7a3fc5a8134e9cacd7682b955236cb4ece1a779c3957144cac995a993ae69faa5d090fac32926ef784b316aab61b8e579c27937eec13c6f20269ee3328a7a0996b54270c53cd06eb1dbfa9dd82dfd74eb010e52198b5b58f3c5359f69c2ee0cf2c34ace9514391c427dcf04ef6970759c1bdd303026ebbc629382eae76b6675a6d020787e5f0e77c27d39b47c459e4275e2ac9557276aae32a920bbbcbf1531ddee", 0xa7}, {&(0x7f0000005140)="af38e67ba46d4dac2b5a2e79c8c43edb2074e1fe6c5e0fffbe54f8debb8cc32e957823aa90e668d403edff2c34771539219ff7d7f9bca9a0de8e5b875d6b3c2977bb6d675e8ffe1d5c735a6e0811ee9019066eff155c8531b728d4c4d1ddce1ddde32380e5f4f41ebca96ea2a0f39539b00b2cddeb50d0a4d9c71b3c7fd62b5fbc62003cd5d57958184cb1efa61f7cba34e38588f731037f1455c2222ae63636f16c0c7abb9e45cea0e82f6ed8d6d2d068eafce2ba84b2007a6f30", 0xbb}, {&(0x7f0000005200)="477feb8c6d7f6ac725d46bfc8a786b236680d102da0f3375b897534fdedf6fb80ea6983ccd44c9dca62b17c969", 0x2d}, {&(0x7f0000005240)="bdb25f721493b23961753161adc2120528a5a643221c1afa3c2b8c494b72640d8fbd9cd03b9f08b86d3f683819205706dceda34cba4eeb2b1f0db1c7cc9c4cef7589ff9ef4a02759c365dd4b89715b2ba5abe799f0bddad846ba79bc14adb6580e804b0e3534f82380fc1ae009a4cf8a60de347c42856960be565ea0f9094af49aacfe154c8be435b54741a29db62531865dc96757a05bccc34c265296e7b8c2ca9393", 0xa3}], 0x5, &(0x7f0000005380)=[@timestamping={{0x14, 0x1, 0x25, 0xffff7fff}}], 0x18}}], 0x7, 0x800) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$VFIO_SET_IOMMU(r7, 0x3b66, 0x0) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:27 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x10) [ 3455.324916][ T7800] XFS (loop5): realtime geometry sanity check failed [ 3455.343523][ T7800] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3455.383124][ T7800] XFS (loop5): Unmount and run xfs_repair [ 3455.412396][ T7800] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3455.434815][ T7800] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3455.451329][ T7800] 00000010: 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .l.............. [ 3455.485341][ T7800] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3455.531137][ T7800] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3455.573944][ T7800] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3455.587493][ T7800] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3455.598303][ T7800] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3455.609144][ T7800] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3455.619893][ T7800] XFS (loop5): SB validate failed with error -117. [ 3455.914778][ T7835] md: md0 stopped. 22:04:30 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:30 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0xffffffffffffff30) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:30 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x11) 22:04:30 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f7a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:30 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000074000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:30 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x400000, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x4000, 0x0) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000280)={0x3, 0xc9, &(0x7f0000000180)="a5924ab7c50dc6a4402467660a96426dd60309b3a3c9ce454237e552a6db91c1772e9aaf0572a7978c1a67770d89d06e3582b5820ce4b1fd210105322ba88745e2eed42dc0d0e25391e8f693eb744f3eac99e278ffe739170edd943001182620bdcee51b6449123202c16c86ccbd9abbd52544ecccc26c03fa95b2143f13e5329e9e379150689dcd956e6468ef33ceb982b8d50f722f43377e9b318d52875364edb785ad288c83855ddcdddfa522fb4125cb48090c068d334d6587ac0038fe194334ef8b35bda2aec5"}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40300, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f00000002c0)=[@in={0x2, 0x4e24, @broadcast}, @in6={0xa, 0x4e24, 0x249, @mcast2, 0x2}], 0xc7da255ff3a140e6) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000080)=0x8) pipe2(&(0x7f0000000340)={0xffffffffffffffff}, 0x80000) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0)='ethtool\x00') sendmsg$ETHTOOL_MSG_WOL_SET(r7, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000400)={0xfc, r8, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@ETHTOOL_A_WOL_SOPASS={0xe7, 0x3, "ebbf386350ba7c9f6ace873d8e46dcdf69757b0a9f334c34f1df7c1b2e6f351325af95d8429c0ce46877f0f711c92d26570773f0de24c96b690afa25e7dd8d9380c17c6ea9f39b979d1efbc30002e2094eec271b025f4c021883b752b32b6389ef4d55ed2c183a4c1714e37c16ba0c7ba61544adb9854d970d8c8bfa34d0310a392b4ca249112a4a5eb93e3529baeb81eadece4945ce7191d05f1d63d0f0a1060056b0f3bd21efad23668b3ea61001defa56892559c40803350475cc37ab8b12662b2d8bc2978e4e8715f201db9e73a06f6c9d819734f13c1b797d7ff4ebb527d7e598"}]}, 0xfc}}, 0x80) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f00000000c0)={r6}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000080)={0x1, 0x6, 0x4, 0x0, 0xff, 0x271, 0x9, 0x80, r6}, &(0x7f00000000c0)=0x20) ioctl$BLKPG(r0, 0x932, 0x0) 22:04:30 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x12) [ 3457.834734][ T7881] __nla_validate_parse: 6 callbacks suppressed [ 3457.834746][ T7881] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:30 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x101000, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x2) 22:04:30 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0xc0305302, &(0x7f0000000180)={0x2, 0x0, 0x10000, 0x3, 0x1ff, 0x7}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f0000000000)={0x0, [0x2a8, 0x4a8, 0x0, 0x2, 0x1, 0x38, 0x1000, 0x2c1, 0x1e, 0x2, 0x101, 0x2, 0x8744, 0x8001, 0x7dcf, 0xfff, 0x4, 0x4890, 0x4, 0x6, 0x5, 0x4, 0x0, 0x4, 0x7, 0x9, 0x1ff, 0x3f, 0x7, 0x5, 0x3, 0x5, 0x0, 0x9, 0x9, 0x4, 0x4, 0xcd, 0x3f, 0x9, 0xae27, 0x80, 0x2, 0x4, 0xff, 0x2, 0x9, 0xd35], 0x1}) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$dmmidi(&(0x7f00000001c0)='/dev/dmmidi#\x00', 0x9, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$DRM_IOCTL_WAIT_VBLANK(r4, 0xc018643a, &(0x7f0000000100)={0x1000003e, 0x9, 0x2b}) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r5, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) [ 3457.968160][ T7880] XFS (loop5): realtime geometry sanity check failed [ 3457.977419][ T7880] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3458.002129][ T7888] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3458.011928][ T7880] XFS (loop5): Unmount and run xfs_repair [ 3458.020219][ T7885] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3458.020548][ T7880] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3458.040987][ T7880] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3458.050921][ T7880] 00000010: 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .t.............. [ 3458.060546][ T7902] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:04:30 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f8a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3458.090722][ T7903] md: md0 stopped. [ 3458.098257][ T7880] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3458.121484][ T7903] md: md0 stopped. 22:04:30 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x13) 22:04:30 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ion\x00', 0x400, 0x0) [ 3458.144100][ T7880] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3458.172043][ T7907] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3458.207919][ T7880] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3458.234361][ T7880] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3458.260564][ T7880] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3458.280790][ T7880] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3458.313143][ T7880] XFS (loop5): SB validate failed with error -117. [ 3458.325746][ T7915] md: md0 stopped. [ 3458.355832][ T7915] md: md0 stopped. [ 3458.406238][ T7907] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3458.642976][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3458.654119][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3458.681201][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3458.705983][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3458.721131][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3458.776005][ T2595] 00000010: 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .t.............. [ 3458.809770][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3458.845202][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3458.854175][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3458.864705][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3458.874519][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3458.890821][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3458.900808][ T7880] XFS (loop5): SB validate failed with error -117. 22:04:33 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:33 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x14) 22:04:33 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) ioctl$BLKPG(r7, 0x932, 0x0) 22:04:33 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f9a00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:33 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r4, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0xc, 0x2, [@TCA_TCINDEX_MASK={0x6}]}}]}, 0x3c}}, 0x0) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0xa0, 0x0, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x3c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xfd}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x91}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5d}]}, @MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}]}, 0xa0}}, 0x8080) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) r5 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r5, &(0x7f0000000100)=[{&(0x7f0000000180)="4b8796292fbc497a36d203d5e8c3e09478ab999fa57e25aa7c1ad7f4a7d7dadc940a7770ecbd19e7aa57c5eadf1af3a9f1e760fab98595656464aa7cba3ade9d906c7121f3ee56e9fb94beb42247590a68c672eb67899da571c11a44087512c705", 0x61}, {&(0x7f0000000280)="f027d2e62970d48eac74c97a4a3fd3fc3a7097644253c53b3a5bc4a30158beb1f2b81ffd9166e832fa09c3b7df8959cda31e015724b100080b11b4349f3c84c8c0c05cb602849f39b6b4fd1ed97a8a0180b413f56dbd1ca6932539cd57c9c32529b3019768cd4cf70ece85cc234c76f23f2ab90f236c9bd23d15018c2b00afa4f0c255211a19aba43a5bae3e5690a8ea164d192324434a8cb285b9fa8e5e663cd3d0a9", 0xa3}], 0x2) fsync(r0) fcntl$F_SET_RW_HINT(r5, 0x40c, &(0x7f0000000000)=0x6) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:33 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000007a000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3460.908457][ T7939] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3460.979678][ T2595] XFS (loop5): realtime geometry sanity check failed [ 3460.990697][ T2595] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3461.012555][ T2595] XFS (loop5): Unmount and run xfs_repair [ 3461.019501][ T2595] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3461.035519][ T2595] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3461.051844][ T7944] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3461.063136][ T2595] 00000010: 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .z.............. [ 3461.078306][ T7939] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3461.081775][ T2595] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3461.101075][ T2595] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3461.110849][ T2595] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3461.120774][ T2595] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:04:33 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x2c) 22:04:33 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) r1 = syz_open_dev$vcsu(&(0x7f0000000540)='/dev/vcsu#\x00', 0x9, 0x6080) fsync(r1) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x200, 0x0) syz_usb_connect$cdc_ecm(0x3, 0x5b, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x40, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x49, 0x1, 0x1, 0x20, 0x61ba76e5e56f19e9, 0x1, [{{0x9, 0x4, 0x0, 0x92, 0x3, 0x2, 0x6, 0x0, 0x5, {{0xa, 0x24, 0x6, 0x0, 0x0, "1aef61d3f3"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x1f, 0x5ae, 0x7ff}}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0x0, 0xeb, 0x8}}], {{0x9, 0x5, 0x82, 0x2, 0x20, 0x0, 0x9, 0x9c}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x7f, 0x5, 0x5}}}}}]}}]}}, &(0x7f00000004c0)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x310, 0xaa, 0x9, 0x20, 0x8}, 0x1c, &(0x7f0000000200)=ANY=[@ANYBLOB="0000000000f6000000000000000000"], 0x8, [{0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x801}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x419}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x500a}}, {0x3d, &(0x7f0000000580)=@string={0x3d, 0x3, "e7a789e9b799f0d8247703adaa2fe1ea4d1d6e341ce887009e5153e11c177a2394b4b2758b8a7b78951f32c62a7d41c8786342f20252e2e6caa1a3"}}, {0xba, &(0x7f0000000340)=@string={0xba, 0x3, "ad025441c4e1f7936cd9becf58ea652bcc473eb9c19e460351abe247d4fc6344372ba2d0d00461b85829e1d8213c07d4e803821bc807bf18f49f6bd1db9d2b3b9478f887a314354984c9881a28adb085518fc1e0c392f598fa0a3c5245d5e974b1f2e79cf1a2002ecea4eabaa7c17017503de4f6a3a120f85dac5714ac83f1ac96d8ba24e8589caa9d32837d9c72024c4b3d86a4a6a0e60af8aa53ebca6944c23b185bf3413222f2912ebbee65fefc794011a18124f9ffd0"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x92e1a142c9981b29}}, {0x4, &(0x7f0000000440)=@lang_id={0x4}}, {0x4, &(0x7f0000000480)=@lang_id={0x4}}]}) ioctl$SIOCX25SENDCALLACCPT(r2, 0x89e9) [ 3461.132082][ T7965] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3461.132207][ T2595] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3461.152333][ T2595] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3461.162933][ T7940] XFS (loop5): SB validate failed with error -117. 22:04:33 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000faa00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:33 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x2f) [ 3461.323296][ T7974] md: md0 stopped. 22:04:33 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x68) [ 3461.491225][ T7940] XFS (loop5): realtime geometry sanity check failed [ 3461.499424][ T7940] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3461.511991][ T7940] XFS (loop5): Unmount and run xfs_repair [ 3461.518152][ T7940] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3461.525942][ T7940] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3461.535298][ T7940] 00000010: 00 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .z.............. [ 3461.547081][ T7940] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3461.556609][ T7940] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3461.566010][ T7940] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3461.575268][ T7940] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3461.584448][ T7940] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3461.593774][ T7940] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3461.603483][ T7940] XFS (loop5): SB validate failed with error -117. [ 3461.605509][ T2112] usb 1-1: new high-speed USB device number 12 using dummy_hcd 22:04:34 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x1f1) [ 3462.049982][ T2112] usb 1-1: config 1 interface 0 altsetting 146 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3462.071620][ T2112] usb 1-1: config 1 interface 0 altsetting 146 bulk endpoint 0x82 has invalid maxpacket 32 [ 3462.093457][ T2112] usb 1-1: config 1 interface 0 has no altsetting 0 [ 3462.255695][ T2112] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 3462.264916][ T2112] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3462.273298][ T2112] usb 1-1: Product: 倊 [ 3462.277636][ T2112] usb 1-1: Manufacturer: Й [ 3462.282211][ T2112] usb 1-1: SerialNumber: ꟧馷眤괃⾪áµã‘®î œÂ‡å†žî…“᜜âºë’”疲誋硻ᾕ옲紪ì¡æ¸ï‰‚刂ꇊ [ 3462.315897][ T7974] raw-gadget gadget: fail, usb_ep_enable returned -22 [ 3462.635581][ T2112] cdc_ether: probe of 1-1:1.0 failed with error -71 [ 3462.647771][ T2112] usb 1-1: USB disconnect, device number 12 [ 3463.041271][ T7974] md: md0 stopped. 22:04:36 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x1f2) 22:04:36 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000fba00300", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:36 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000007e000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:36 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040)='devlink\x00') r8 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000002c0)='ns/net\x00') sendmsg$DEVLINK_CMD_RELOAD(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x3c, r7, 0x536ae464467e3e0b, 0x0, 0x0, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r8}}]}, 0x3c}}, 0x4010) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r5, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000280)={0x1c0, r7, 0x100, 0x70bd28, 0x25dfdbfe, {}, [{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x2}, {0xc, 0x90, 0x5}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x8e, 0x3}, {0xc, 0x8f, 0xffff}, {0xc, 0x90, 0x7f}}, {@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0xc, 0x8f, 0x8}, {0xc, 0x90, 0xb126}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x200}, {0xc, 0x90, 0xa7}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x8e, 0x2}, {0xc}, {0xc, 0x90, 0x8001}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x8e, 0x1}, {0xc, 0x8f, 0x2}, {0xc, 0x90, 0x8}}, {@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x8e, 0x2}, {0xc, 0x8f, 0x4}, {0xc, 0x90, 0x1}}]}, 0x1c0}, 0x1, 0x0, 0x0, 0x4001}, 0x40) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:36 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000080)={&(0x7f0000000040)=[0x0], 0x1}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000e40)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002f3753a9c3b630bf92dd696125265586f2043649b89eb3b91dc174d5701424fa24052b2fe97409000000058e4bf0391702519694cd73608fadb119a5ffc8f1460c55bcce412bc1cc14a1f64ad78f7efc6f2251217bae2233bacac999cbb0468424c2e8ab6cafc7bed22704254d5e3e970ab940986c4ef20a09f4a46c382c1e7016a71a704c7b3cddf5306b500fda7b4a72bcdb7c33a4c7e1f0c42819df5c26d28b450e2a9980b62fe2a57ac040892270e005a2e4ead36494a405cb04000000b544edf5491d98896b66851b823d3dc390934ea9062dd57a13ddb0ce78dbf6619bb0148e4dbb7ac738e4eb6e8061fa9d376fd0a4abf451611aa4aca0816a07a126f3a4453f7c12035ab1b2b55c098a78182c4651c0c3b019f94858fb0dc2ebd1ec689d889bf0839a7274a7886eeac67b9493f9c8c764310e79aa8bd1e9e2371ed3ab91e6a53d265a75ec4fcd4d8b2d06c73ca7efec28b59fbeccfa1dbcd25032f328223bc33acc2449b6e9da679198772e8e84f4cf1cc7f3886628dcc16c8ff17ff6ca528ef87741fc3e0f242a1037df395cbf0a99070700c17f704441360695072ca871e4c957552588ffe778b60794a8eccd0000887fad5755245963cd49619b6f87c86689c0e098ea15e8cc37f91c0d8fbe61e4ff8c85a2afba06844f5cad1ea6c07d5acd741b6442884dd99c95c41e180093a9f129db50c1e6ac5653fcf0b3c8fc57d51754bbeea6c676de473f5ed80b539dc9382faa75c7183de5de8b821433923feefe4457bfaad2e64a2cb3bd293dc991718b48e2502e8656a4f09cb67746496e4500000000000000000000000000b0990670db219d5b3ee8db3096ca6aee1264b6e004af0ebe6f39a2e080476c2e82f755eaf3f8f92f55b3cfcaf05893c6fb80e8ebaf01132fee3e6b55c2a5509243799f88c4b53d0e4e812b3e88ea5aee9e7c2e49cb7c55d211631130ff3c6fbc2bd09eb001cc6c81a3eb0bb48ba89bc03e91ffc567ed277001b9b59f977702f5ab58d88700"/852], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000280), 0x10}, 0x78) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r5) r6 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r6, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r5, 0x84, 0x1b, &(0x7f0000000180)=ANY=[@ANYRES32=r7, @ANYBLOB="0000000042e29c81f242c985538c882557ba495a761b353071706f48b330b22493ccf029d9f52dbab854ed120b6669aba1737e44046826575a9a0e0000000000000000"], &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000140)={r7, 0x7}, 0x8) r8 = gettid() fcntl$setown(r2, 0x8, r8) sched_setattr(r8, &(0x7f00000000c0)={0x38, 0x3, 0x4, 0x7c, 0x1ff, 0x4, 0x6, 0x4, 0x0, 0x5}, 0x0) r9 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r9, 0x932, 0x0) [ 3463.976791][ T8024] __nla_validate_parse: 6 callbacks suppressed [ 3463.976802][ T8024] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3464.007367][ T8025] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3464.034215][ T8028] XFS (loop5): realtime geometry sanity check failed [ 3464.041916][ T8028] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3464.067223][ T8028] XFS (loop5): Unmount and run xfs_repair [ 3464.078683][ T8028] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3464.092644][ T8028] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3464.103868][ T8028] 00000010: 00 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .~.............. [ 3464.120942][ T8028] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3464.132203][ T8028] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3464.133960][ T8047] md: md0 stopped. [ 3464.141438][ T8028] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3464.154252][ T8028] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3464.163476][ T8028] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3464.173080][ T8028] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3464.184261][ T8031] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3464.189584][ T8028] XFS (loop5): SB validate failed with error -117. 22:04:36 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x612) [ 3464.227412][ T8025] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000400", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3464.303545][ T8060] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3464.337754][ T8068] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:36 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRESOCT, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3464.424214][ T8063] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3464.451793][ T8070] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:36 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000002000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3464.580870][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3464.609166][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:04:37 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) userfaultfd(0x800) r0 = socket(0x10, 0x8000000000000003, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3464.646031][ T8091] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3464.683231][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3464.712556][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3464.755304][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3464.764207][ T4206] 00000010: 00 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .~.............. [ 3464.855420][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3464.883172][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3464.893539][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3464.903956][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3464.914434][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3464.924910][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3464.935028][ T8028] XFS (loop5): SB validate failed with error -117. [ 3464.976650][ T8095] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. 22:04:37 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0xa16be5a1a312b9a6, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x9, 0x10800) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f00000000c0)=0x40000) socket$inet(0x2, 0x3, 0x445e) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000040)={0x81, 0x3, 0xfffffbfb, 0x7, 0x6, 0x6, 0x8001}) 22:04:37 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030048000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3465.138395][ T8119] md: md0 stopped. 22:04:39 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:39 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000034000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:39 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) ioctl$SIOCRSGL2CALL(r0, 0x89e5, &(0x7f0000000000)=@default) 22:04:39 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x8000, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VIDIOC_ENUMINPUT(0xffffffffffffffff, 0xc050561a, &(0x7f0000000080)={0x3, "9b68dba5eb9bd95ff00b9a6bd3a0fe3890327f96d8c62b3c85460f99efc2e386", 0x1, 0x7, 0x5, 0xc000c, 0x1000000, 0x2}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f0000000040)) ioctl$BLKPG(r0, 0x932, 0x0) 22:04:39 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000084000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:39 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) io_setup(0x2, &(0x7f0000000140)=0x0) io_submit(r6, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x9}]) r7 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r7, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r8 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r8, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r9 = creat(&(0x7f0000000280)='./file0\x00', 0x0) r10 = socket$inet_dccp(0x2, 0x6, 0x0) io_submit(r6, 0x1d, &(0x7f0000001700)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x5, 0x401, r7, &(0x7f0000000080)="152734ff6d9c115f13faef76ddf47277eb5209a4481d63be502898c2d0e7b99dc984338c3a1abb60004af4875da54340d5ae65079e2ade51ebc54d82f6454f91d5245e00a73bde7be26930f18cf5c2a70dd4742af58277f1a0499d8a21c6fb41d16211dbf3467542b522df3c6dfe7bf25638fffb", 0x0, 0x5883fa9a}, &(0x7f0000001580)={0x0, 0x0, 0x0, 0x3, 0x1, r8, &(0x7f0000000300)="80a59b235fe44fd9646145bc3d8505bffbd6f2064af595ceaa3f06fa774cce0f30583b7ad372ae57f16986a239e70dcf5f6b9c0947ef584e4bc59119543c6b95c2000b472e30a5d5c0ff44bd6e190289a4207cb97a62932e2c7271147162b73ad220379dfdbc251272743c0287139fd420b0e25f84f61d717dfbafeff0d2eeaf35cc5a9dabeeb9f23f0e5e7d4507f4911371345f4943aa6b5f77b0b6d78419dc182ee5ce87e341bcc6c53af7b7d8e2fee0f54c04", 0x0, 0x18, 0x0, 0x0, r1}, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x3, 0x5, r9, &(0x7f00000003c0)="b3c5d933666ca0749027fc636f301e79df91db7d7a3e947aa499007f446a720d7eb1d4fdbd621b02e3bf4912290b547152e9df251367ac34f435779af7e2182b8bf65922fe27de86734e02f0e62a74b8b0da289f9b124974888311a30893721ef2af91aea5dbe31f798a72f5933f1df8232a793417b2f2f9681ea2c8727fb9bdc628ad461b70863a3d834af0ddf8a46a5fa2ac4433045388a65ae6eb3287f58549d8e7a09891290e5ab4332baf8b0ebc4bbd6eb7bf2af956267d134ace032466c3442a5eb8058329a4c3712cea8a6b2907d6c4f5588d1b", 0x0, 0x2000000000000000, 0x0, 0x2, r1}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x3, 0x2, r0, &(0x7f0000000580)="423f20b6827b2854f56473af1cf8fa3bb7b5fdc3af74bb00fa224fa0f12b47083f9f3acbf5bb543c18d7dc9b65b59bb2f0a993b301c1d9705021ce95fc16bd4b81bd6f06c8326360514c572de9173855616ad9f6e7ad2a659b03479d6ea6650a2eff48dbf8b8612dc0a55f8666db0e46b667ebf4cdb3c4ff3fa8fa3a19453be112c624cda3d7aa1fd03b11d7494282040d2ebd3ec38524843822ba7ccf0c2d89f7d76ff1396fd30480add7c636fd4c4f72d5c0dd931937523da2d81966a800f8bdc9e04a28e17f6fc2075929fcfb3e948f8c723e684de84bdb7280e6bdd2f0e39efffccee142a8e42df58ad82bf70ab0f8c949112d7fcfdeb56f85c2f059e998886d1ed2e56648e9b133f920abbcc7805abf8528ab138f998954adb659885871ec6d8d82dd8b8ce9e5c8aa32e2aef10c42365713adf49c4a881dab421d7b75258e7ad6d47ce8e0471ce70eb7361891215118891948f05143e9df02a5f17a36741a51418cbbc0e191d23c78d7c46a0ad43a4c79276dd336dc6b54200320675a53b0297569a5a1b082615aaadefa635764ec663777b683fdbd867c70060cc0dd7ae7255a48341ca822ac17a92ecad2fc13b46b9020cc610e6f17ca22604948a054e3e5f4b38d24c7dc2e21c252a3d99e9338dac10374a1169721b500c1489ec3b01448493867169304bb61acbe6907c2cddc436a5c718e86dbe9807d303312e33d38ee4e92e9141f676fde7ddf7724849924962a6a90541e0713ab8a209dbf0696847f26486cd571489f0d7e517acab442fc57979458a180e57601ce8fca1f6ab7ce40c301c2dbc6ac4b55f193aebb54f3538e718de7983f77964ed9d83ea814d46172ce0b94704446a75c8e1e9decb6ed2a1815f00177c0dbb421dd6a020b72497475186ee3c10f4fb447f085b9bb194bfd44dd772a7e1201a42fefa6f4b8aed9225b6cffa91ae44e0adea9591d45163ee4c01c41f65f824326f3b417d52fdd2a13fd4788d92d8fce157751883b588f57bccfd9c16752230685295bdc98dfbab05a5ca865db1fc1e6d3338c4904cba2d0dfd1860cbe8b9bcc2676dd7cca9791b9a54c34a3cb45930789c047b42e80625612f9cce2ac21675d0a47f8e487771c416204e1524c10c3e10e6cd4861bdc549622f6bd8f9655214dba20f33b236aae5342f82679d70186adda01d9f987d4cf63811751f08091b97b1bd018e1ec9854dc60716156f42f81f1aa906e859406296f93e69a791e2409ce9b5513e8a6f65da25ab79bf37b8e60a6a45e54bf18f417b57fcb89c6627f0c986c5f8a0d012fe1a8c5d318595f0bc62ee8b3e725bf85d900f2ab74b4f0fb5dcd2e0c839bd354ba3190264dd702d7f054809eca7881df0418778c25b45b0f0afa23357a71f096ac408131397f6317d485612f07553ff043a71791d35fe8d8dd47624339990ae14589f6391abb2966ae47e3d0a4a84fc7ab4625356c0005d9b5abd1ac2090fdced5453b06ad5a0674fe967ecd9a9cbd250b551c230856f462a8e5960f2e1d24de8c68df6b2f24a6295addae67de5c43e6378a96ac5498085edd6f2e58320d0b6a110852cfaa3b05a0f9285a99af9005703178738bdbf1aa1336959c34b00c459b9cadeeba2f074f906da8db1aa68db35b3959faf24cf495fc73d7a772ee1edf83ace6f643cc4ba1292b58ee5df239c8562234373661fff29f835c7cc28b26ced45a3b72c0b609253442052abd2a21878941e44aa6164e4ec2b3a5755d09cc83f328788d90fb08766b5ebf4213bb332d0ae1a9845ea864fe751979b450d6fc0eeec9650283917d79cd27e7250c9d57de21202a4a127b101aabaad43a97e779d82cf2be436dbd462e94a8ca2222355ce98c26911515c814ac2a7b83c0daa9327b78d665b2c488e375b5487b18235832e8c7af6b3a6678edb041f581538ce4a9f4d4a0ddd6ca501fdd9b656730750d608d6dc024021fb2565c6dfd046f537e370722b2947c54de27026ef4450171bbcbe89a32bea4ab4ac55d70dd27c8ce56c9f861ae7b52206c23f51baa4ed9816c75f3afe62dfd47344ddd5aa54728063fdfd11c3383a5988d562f73902eedea481f2cf743ee210c3ad42e2e03dd5a3da6d117e52c9c9ce59992ddaf685703c91d21c19ba9a84317565d888303cb1ecd21bc620eb3a77c9db7086fc4a3022c9b769682e7efbc1177388178d69b56f4a9a871ab9953b05097ea7de80bff2a7304106859dd456a4a69211955398fcb009c9425f295cca8c24e942b2b80afdcb3c830e922bf1fedf7862371bb52fdaabf52bc63132e50a6a55421a1545e89d951f83534709f1bc51243cb55f99346371351060a2e62b3fc2baf79b9ca5a047cd10aef3b5d1378ceb784abd389aa538a542f8edfaa7402112ad3d0f1efb74d8c8fa72b99b030ec4427a6b87482d28ad9a70b8e78e005b739fca7833aeed68200e1d89645500394a60e818a386966082d639df78dbbc8a431a8511489659bd7def700cb5a2c503f268ee9da2e8f508710caf2e8fca46d819fec1062f787b4dbf1281106e9138543eaddde9ca9a7f3211fc4b7c2446bdc22617cc7815db6badcc5131fcb2ffbed7e9d5667e639409bb075887cd1935c8255d3fa45719884b4f8d2debbd0c12fd43e51066bb292a045f9642d8ac43ed8ec25227088039c3fe33a23b75caa9b8433589ab920653c4dfe33c37038720d60635d5e33d089f9e9a15d685a48adef9755f3c811f3c325e346dec4567b3c6bb433792a9240682089d1256caead6177a65ae03d78a3c18032e538a11974501f6e500dc20f78c5960fe739ba4eb46b1ce5a029b958affddfa8ebdaf2535f0f9e68029811fbeda98ca65dab0a9e1e69df27ed8748ddf31671fa43c3a0ac4dcac3bcdbcc9146fb0dcf493a9f60913667dbab8b9a7ee7215e40522cfb03f868f1d8064608e9836a34cc1d38210e0a0dd7ee3baeca446eb79caf8cb9983603b9f0e31527891a83f0fac3e9a9f3b43ea59e922f052b99ea50a3fa1b877f169fff7833d0e27bbbeebe74225644472600a4214625c7a83699a9097c73da392ecc5fcd5635d8e3a932a39e4e474c29a7c881a1cbeaa6cda7c754e9df32796c5d05ee6da08564fdb616a51fefa69322918c86655f2bd42070b0b5b22373867ce4bf6b1074a5f70085929a4515dfbcbe8a9a4ea8c1be89162006dacdbf29551f4d0c55bf9a7e999c5568d168c83aac68acfc439b6db2e0d15096a7c03236fae800392cfe14542affb21caee4062848cf5248d8e77af4a820f437ff6f8fa2d413466b20af48e063c597266a5b4c16d42ddddc8fad41dc9bed176a0ea39e32266584ac029a92b7e0e073958241014b64979037cf131d33544d18035d1e8a1470b9bea627a24300b0a417aa4d482aaef679a728a6e98bb813cd599a8b681c1578640bddc2e88c23482925fe1b07bf374fa04c4e988fc843b3763a1118dddfeaf8c1b1249a14fd4e4079c7ed39ed6d932a4b4b19d5b09c75c4b50422c937bf34a0f8501c51c43d4c51f691f8b452f106aea934416a0795a7fe92b9a6f7d69213127f2fc30c5b09251be849f08fd4b76087be7995b94556ef7261ad492cf74c0e1870be2738af4fa02b0b6490fec749045c6796ad9aa4a46e35687755dd2e17eb61e9e8c699f755ca016b2f6cfd957e77dc8f61fbd63d94e90a1d1e46244a0338f1c6803cec2e154474ade904139a49fbde3003a215e2c27f3e29be66acf43b440e0544de0193cff800e69413102d68c4b3d04bf50e024dce9a2f8b38088d9a57aafa720f197eefd1c1fc50c4ce57865436876e18b4b0243aed8d97dd9aca9478cf86a4063f7ba4efcdcdf92a0bdbc688ddac0056c22d440379d96318903308f51241eb4b9108807ff180a4c396eb8e037bc6f8f43d98ea05f488903b0230c5cc40dc76930ec03c6d8ba8c55d45451edf3cba48b064d846aff2c3b09eda6e0630cde5c368025acabaed297853681b9ddf31aafd458d98da24c09cbb1a43223bd081412602be0f499c6fbbfa119af20dd3a9eb84376f5ab6dfe121710a3abcbfd496299bb7ba70bc2e856085efaeec84afa09ec3c4d759e0f615c44390c546d144e4de6a30a02a36ed7ff0456c4ab21c8414614d1cc57c877819f41e9382a0d03cd7fa3b6ca456e3b1943155f69354a46f8487d601bd5b5a8bbfd9675e676d89adbaba3371b34767051b61221a1e9b15f9105fbd731a5caff93de6d1574996ef36429b5227f8062df4a79083b160bbe1ff6fba6a91351dc1944c4a1a2f2bb201066887a3baddc9bb332e1a86ab42c267156c8c2b0e22d604efe3c6b9dd3b242f16a0eddee2c561268628bab0e98b4701317c18fe99189fcf8f70f24b418a284f3dd781c64e0acae42b1a52956f6c3529e97ab582910954b7482f2961f1e72d062052d9af90927880d2c72a1201def11d469310bf55fc11602e9033a9b2e6fafb9c205fc6fc7327f90c01795542580e4b2eab7b8c05d445986c55f645239b619d7e6dfd28e6141b4789e349601c290117accc39f512a9393feeceb2777940978c953605c3c330d39fcf38a8dd7bf9b16867ddbe5d495376c7a62ed9c7cf0e59e024fe543dbf07ea55afe0d1f9e285b15aa3078e90602a46d5c72333c88c3efb128bf9e1ca830f25ee82909c0fe987b107378ed69f586b0204a9c0c6f72076d73b369b11936a8ac7c6d2bdddf0c5b901ad0dc2a144a11009649f608cd2411d943d147267648fa2981ec10f14b5e22d192cca03d07603e6f4cfd9b3ab8d97a0320169c6f048915145c143f0f487a737060c43da9b891369d927729577c8ec6fe522ea2b5678c1afc7cb4d58088711cd84da2d471ea453944e4bbaa8bd93996593dfcc6fd27d4a151ee207274f07e015a934476af2349741cafa28ab55539bd8e8d6aed667f0b0826567c54e53a22566c4472d33f9c99a1c10cab4937c38a3c2caf54d4648effd738a644696744511822bdef5854b71033b8f626ea3fe647c8255ee319d43fa35b70df769f8792a5ce0e26b9712d0e387de6ab0ad5bf8fb7656105ec1f2c14853a0d3071f0ae3e016bc8cd04b965885aec639c103b88e35395ba938efa915c83da73dfe0c30e43d33fcfe93accedcf899ad632c6a0b2944e0942e209451a78b53cca228fef43a56d05907476ef6f1ff6b685635a509aad1c2cb671cad31b97d4f758f60502c4661543471169e0329f090617f563c40a44a12391cc1b2af0d6caf1d7879660c3d2d00ce8f7d5981f263869ecc6711318941ef0d1bc987211982c70fc19cc152bd56328cf52f69be96bcecc1e294f7f9f70689206261688cf9f53cc2161ccb2ee9bf90b20df9a0c8d24dc3430cf6b93cdc97e07320a94bf3ad32851e831846b7041a8e7e9a02ba6b9355a46ef6fcc51b70f26af46d78a29dd693135b7d3ae9563974f427bf783c7f4f0b9bca677936f8d1b3ef709db0cea0d4178c981ce8a1d4b271bbebb64c3f7d3a76f3837c052240f9707c2f0f8a8d8e986008bf9be6bd071a12cb929b66ae6bf100f655d04be9c4eb5acda7953ee27f8a5b8a332e28f283f96f8bc37974df4e755a8e59da2fc0dcff887ee87285880567b9922980406550f586772b66e7c582251053a4ed512d1199d5cd32cff9434aca83b5cc600f5705b83079f5195fa422aa2ceca0363432391baac617aee05ac037576cb38d30ec008009d30dfb8fa886314c8a8a0ed0c589c282242391d96873451d62e225141d0944bcad89a767143e2844734f19abc39b0b9ff3775448d9215b44d709d5bc4a19bd96", 0x0, 0x729, 0x0, 0x2}, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0x0, 0x6, r10, &(0x7f0000001740)="1b4e92351a11d8131bfb8a8ba0392ef310d9e7ea82786f2d017ae5fe9b6a56505e9aa79d5d721f3f720a5c30704942b6029169dcf15c586f", 0x0, 0xdfb, 0x0, 0x0, r1}, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x1, 0x9, r5, &(0x7f0000001600)="b302cc57e75fa51a32847d7c1e5365fd0166f655eb4c8e", 0x0, 0x20200000000000, 0x0, 0x2}, &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x8, 0x8, 0xffffffffffffffff, &(0x7f0000001680)="e8ddcabd467c7d4d74e84107eb76e91b86f9e7f3980ba39464a9dd177327065087e0f7b9833e999e2d68dcb641c15fe1", 0x0, 0x0, 0x0, 0x1}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3467.125033][T25648] XFS (loop5): realtime geometry sanity check failed [ 3467.135556][T25648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3467.153193][ T8158] md: md0 stopped. [ 3467.158617][T25648] XFS (loop5): Unmount and run xfs_repair [ 3467.167425][T25648] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3467.185760][T25648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3467.203217][T25648] 00000010: 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 22:04:39 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x80000001, 0x22480) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000100)={0x21, 0x3, 0x0, {0x6}}, 0x21) r3 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r5) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r3, &(0x7f0000000140), 0x10) io_submit(r6, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r6, 0x2000000000000072, &(0x7f0000000080)) [ 3467.231869][T25648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:04:39 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e90a400c4b3143ff50b030008ddc45df6d1b1cf29c8000d04c3925600190000"], 0x80}}, 0x20040800) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r2, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000140)={0xa30000, 0xae, 0x7fffffff, r2, 0x0, &(0x7f0000000100)={0x990a6a, 0x5, [], @string=&(0x7f0000000080)=0x90}}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r3, 0xc0bc5351, &(0x7f0000000240)={0x7f, 0x2, 'client0\x00', 0x6, "64bd20f15c7ce4e4", "1e9af9962b163a4ee2e81a6600bcf6ed5c05c5d879977e3216c93c1133d96d28", 0x4, 0x3}) r4 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3467.271756][ T8158] md: md0 stopped. 22:04:39 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0xcc03, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3467.319968][T25648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ 22:04:39 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0xe7a140, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3467.363992][T25648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3467.365967][ T8172] md: md0 stopped. 22:04:39 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0xa0801, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3467.419244][T25648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3467.452077][T25648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3467.482273][T25648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3467.513081][ T8189] md: md0 stopped. 22:04:39 executing program 0: openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) [ 3467.539180][ T8145] XFS (loop5): SB validate failed with error -117. [ 3467.872516][T31280] XFS (loop5): realtime geometry sanity check failed [ 3467.883763][T31280] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3467.946012][T31280] XFS (loop5): Unmount and run xfs_repair [ 3467.953996][T31280] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3467.982496][T31280] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3468.010094][T31280] 00000010: 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3468.034966][T31280] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3468.071366][T31280] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3468.089195][T31280] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3468.101852][T31280] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3468.116130][T31280] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3468.127210][T31280] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3468.137184][ T8145] XFS (loop5): SB validate failed with error -117. 22:04:42 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:42 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000fffff000", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:42 executing program 2: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r0, &(0x7f0000000140), 0x10) io_submit(r1, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x2000) ioctl$KVM_GET_TSC_KHZ(r2, 0xaea3) io_submit(r1, 0x2000000000000072, &(0x7f0000000080)) socket$unix(0x1, 0x5, 0x0) 22:04:42 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$bt_l2cap_L2CAP_LM(r1, 0x6, 0x3, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r2, 0x932, 0x0) 22:04:42 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="8000000010001fff0000000004000000000000004e0ae2b9614069c37b91b8310f828d4a166aab9bb40dfb90959505a7c330ff5a5e8d4a868e029cf1b04bb1ccee3f197e2be2d7204fea618ff647fea038149d15ad949f4e45a391b80386620100000074420a427b43912e54937c446e51ad8552926e8d00945b9f380c241bf4d331a830f9d2e4cbdb63fb46115fd93b41b3246221", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700084e2f9b5028014000700fe880000000000000000000000000001020000000200000008000a00", @ANYRESDEC, @ANYBLOB="3f05000300080000000000000000000062d758c32dfe1c615239f78043ff359e09e2ba7448555cfcd6934441885914c0ef9c2144793294e9cd96650be3c54566af651f451efbbc4c25f008c0ae3d9b9392e5e448abbcdd8790ed25628035668b750ed3c0fb31c70cb44a15d823484e036b9be2bfbf73f27651edad6b7bfc73ed0724fe76da6f2c453895b32040240ca74fcd0a6e"], 0x80}, 0x1, 0x0, 0x0, 0x800}, 0xc0890) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:42 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000085000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3470.140691][ T8220] __nla_validate_parse: 8 callbacks suppressed [ 3470.140703][ T8220] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3470.192194][ T8222] XFS (loop5): realtime geometry sanity check failed [ 3470.199603][ T8222] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3470.216933][ T8222] XFS (loop5): Unmount and run xfs_repair [ 3470.223251][ T8222] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3470.228663][ T8237] md: md0 stopped. [ 3470.234024][ T8222] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3470.244896][ T8222] 00000010: 00 85 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3470.255553][ T8222] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3470.265951][ T8222] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3470.276810][ T8222] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3470.287495][ T8222] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3470.299688][ T8222] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3470.310274][ T8222] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3470.321303][ T8222] XFS (loop5): SB validate failed with error -117. [ 3470.346551][ T8225] netlink: 96 bytes leftover after parsing attributes in process `syz-executor.1'. 22:04:42 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRESHEX, @ANYBLOB="ed11060000000000088890782e23340012800e0001006970366772657a61700000002000028014000700fe8800000000000000000066000000010600eeff0100", @ANYRES32, @ANYBLOB="0e0008000d00c329ff00000000000000f651cf00000000000000"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) setsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000100)="403f1850ef22caa1e84cc013542846baddce29547d096c6c28e9efabcdfd0533b5d079751396a3b5068303a53ec82c05cb889ec055d8dbb91c05887aa6fd768a4d4fb2a552d9d8b05c19e621c49ab4189fec8bdecd9ecbca731368fde269c6e1a18d12", 0x63) sendmmsg(r1, &(0x7f0000000000), 0x0, 0x10000008) 22:04:42 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f00000000c0)={0x4, 0xff, 0x6}) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002f3753a9c3b630bf92dd696125265586f2043649b89eb3b91dc174d5701424fa24052b2fe97409000000058e4bf039f701519694cd73608fadb119a5ffc8f1460c55bcce412bc1cc14a1f64ad78f7efc6f2251217bae2233bacac999cbb0468424c2e8ab6cafc7bed22704254d5e3e970ab940986c4ef20a09f4a46c382c1e7016a71a704c7b3cddf5306b500fda7b4a72bcdb7c33a4c7e1f0c42819df5c26d28b450e2a9980b62fe2a57ac040892270e005a2e4ead36494a405cb04000000b544edf5491d98896b66851b823d3dc390934ea9062dd57a13ddb0ce78dbf6619bb0148e4dbb7ac73808000000000000006fd0a4abf451611aa4aca0816a07a126f3a4453f7c12035ab1b2b55c098a78182c4651c0c3b019f94858fb0dc2ebd1ec689d889bf0839a7274a7886eeac67bbf871bc527cb1e3ba7e5c55886aa4d22949df9c8c764310e79aa8bd1e9e2371ed3ab91e6a53d265a75ec4fcd4d8b2d06c73ca7a34c19da905032f328223bc33acc2449b6e9da679198772e8e84f4cf1cc7f388cb48b3936c8ff17ff6ca528ef87741fc3e0f242a1037df395cbf0a99070700c17f704441360695072ca871e4c957552588ffe778b60794a8eccd0000887fad5755245963cd49619b6f87c86689c0e098ea15e8cc37f91c0d8fbe61e4ff8c85a2afba06844f5cad1ea6c07d5acd741b6442884dd99c95c41e180093a9f129db50c1e6ac5653fcf0b3c8fc57d51754bbeea6c676de473f5ed80b539dc9382faa75c7182ce5de8b821433923feefe4457bfaad2e64a2cb3bd293dc991718b48e2502e8656a4f09cb67746496e4500000000000000000000000000b0990670db219d5b3ee8db3096ca6aee1264b6e004af0ebe6f39a2e080476c2e82f755eaf3f8f92f55b3cfcaf05893c6fb80e8ebaf01132fee3e6b55c2a5509243799f88c4b53d0e4e812b3e88ea5aee9e7c2e49cb7c55d2116311301c3c6fbc2bd09eb001cc6c81a3eb0bb48ba89bc03e91ffc567ed277001c3b59f977702f5ab58d8291034fddcdd0d4c30446c13645cc67ea00cd00317fb7b4046494fad40126f37714f06dc5fc370bef79d7b3eddc23dc2ec9767d6ba2049300aca68f0cc739db501d9206c980071eb2c8c0b39b836a26f0a546362c448136bead7db0e5ec36f9e2c6a3ae728ad5f127874713d1e4b9d802367367d74242ab03e25a3ec6332fe95924b4ef16f85263bd736441360b7b4a134"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) r7 = gettid() fcntl$setown(r6, 0x8, r7) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000140)=r7) ioctl$DRM_IOCTL_MODESET_CTL(r5, 0x40086408, &(0x7f0000000040)={0x2, 0x4}) ioctl$BLKPG(r5, 0x932, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8983, &(0x7f0000000080)={0x3, 'veth1_macvtap\x00', {0xdb00}}) ioctl$TIOCGRS485(r5, 0x542e, &(0x7f0000000280)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) setsockopt$RDS_GET_MR(r9, 0x114, 0x2, &(0x7f00000001c0)={{&(0x7f0000000780)=""/4096, 0x1000}, &(0x7f0000000180), 0x70}, 0x20) 22:04:42 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000001", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:42 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000000c0)={r3}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={r3, 0x400, 0x3ff, 0x200}, &(0x7f0000000040)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000080)={r4, 0x30c7}, &(0x7f0000000100)=0x8) [ 3470.536238][ T8254] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:43 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r3, 0xee00) r4 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r5, 0xee00) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x200a0, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@nodevmap='nodevmap'}], [{@smackfsdef={'smackfsdef'}}, {@appraise='appraise'}, {@uid_eq={'uid', 0x3d, r3}}, {@fowner_eq={'fowner', 0x3d, r5}}]}}) r6 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r6, &(0x7f0000000140), 0x10) io_submit(0x0, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x38}]) pipe(&(0x7f0000000200)={0xffffffffffffffff}) io_submit(r7, 0x2000000000000072, &(0x7f0000000080)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000180)=ANY=[@ANYBLOB="0100920087f7522e2332dfb4adae693f21b51c2a43d5902125f7dc11fc03b66ba9c5c8090c214d631284c0e376ee8bbd54715f370a2930b97a5d4d843a38feec06c2dd7aa9f125585ab402ae208c63afd0e80b85efd2", @ANYRES32=0x0], &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f00000000c0)={r9}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r8, 0x84, 0x6c, &(0x7f0000000280)={r9, 0xa8, "309857e403e601b8ba35339a1b0111867721bf147f340f863b41d3e000de557fe67423a79dcb3f251eaac1ad9c8bccfabe17f43702145febe0a4df7c153d8f020d7e87dc319d50a9f0479b735d52a2fad32c38d2c83b6beaf7e00b08e87232d73cd73645a80d3b9c2e262799c1433488138ae6096acf6292710e3e895eb618b56bb43c222b72aee19d692739c60b6908230f4e9c78cd2e8ade5515381fd22e886c39872fa4c22b71"}, &(0x7f0000000100)=0xb0) [ 3470.737361][ T3182] XFS (loop5): realtime geometry sanity check failed [ 3470.750895][ T3182] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3470.767454][ T3182] XFS (loop5): Unmount and run xfs_repair [ 3470.769239][ T8256] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3470.773192][ T3182] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3470.773225][ T3182] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3470.773238][ T3182] 00000010: 00 85 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3470.773249][ T3182] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3470.773261][ T3182] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3470.773273][ T3182] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3470.773285][ T3182] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3470.773297][ T3182] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3470.773309][ T3182] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3470.863643][ T8222] XFS (loop5): SB validate failed with error -117. [ 3471.025472][ T8254] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:43 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000002", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3471.133787][ T8287] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3471.243869][ T8288] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:45 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, 0x0) ptrace$cont(0x7, r0, 0x0, 0x0) 22:04:45 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000000)) 22:04:45 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) r4 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r4, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) io_submit(r3, 0x2, &(0x7f0000000040)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x38}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x10, 0x5, r4, &(0x7f0000000280)="11e74b09a9a3263fa469d99cabe8e516d2334539d606f9a5066a9679a937d7a987f5b0c113e5a165f8a9f30700f83d76013f68c8b268ec3c339ce4281a104e23bf9a991b9044644e906c90ec6ed3141ccf6843df32d2431b97b882e2756f9c2126a7ef89f8aae46bb088d073d435a4702b4cea87c7f8defc3a394a74cc9cf48829ac2b5f79120c0a8ead1e50273f7705dd38d24146aaa31de487402f29babd46b6646a517e56ae1e4c418097", 0xac, 0x5, 0x0, 0x2, r8}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:45 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000c4000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:45 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000003", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:45 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x84, 0x5b, &(0x7f0000000000)="6dbb4615c5b10fa89d1c4311ac16447453a403dc2020ec57414495e334b28fa5c25a7468adcf98e95f805ccdd6a776c69944f2db2d8bb8f4dbc8d3cd8c370e1f4f09fc472abbc960b507dc44e7a98dfe52a72233c2503212ab8b8149f4fa924d4b41899c0e42c82514558d207791dc085a3548a4343d0fbe7c9922ae5ce3c61c3fbcc4c7", &(0x7f0000000100)=""/91, 0x5, 0x0, 0xf1, 0xa8, &(0x7f0000000240)="fd91630587ba7a94911fcc67570d9de0741f194da4c391ab3ef41371c088097b9bfe79867c92cc5c8d04de753bccae8b39b75b9fc0c6ae2c9fb79df0c0d60181aeda96644190901fef37be57e108e5b47776cb70e94f178a3100e8de3e0c46e424e75d1aa40744d421eaaee450f4688dc84edfce68afdd86d0db38f3d0681e8576d9b065afb6e33bc9d912c97dcecc3942e7e8332a353fe747e9d9907f1264c24748aad56aaf659b6c08f16f695493eac0357e992de65968b7cd9da7a888bc008eafa99cf15bb64a1772f004ed804901bff4b6026298ea241d06ba17251374953963a31d2e61d548eca1deea7ecef79555", &(0x7f0000000340)="29a70d5be0fe2318fe4dff44c63ae4880f4d0e6efb91ee5fb171cda6d24505aabdf4247f555689363339bc69d3fdd4d092dcfd6b53b878e877fa225f2d943cdf5e423bc5c3e43858f5d10a87374d179fa81619623435227a23fbb1ddc4d143219dca7d6e0f579c83f882c0eea6cf840e775c89c9dbd985e0ff1cf5abad6999ebb15b3efd81400dafbcb8fe02179fb6d6ba5f31eb71ce9aa83bb5ca3a93cac7f3a1a5fefd96e4d321"}, 0x40) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3473.214054][ T8307] md: md0 stopped. 22:04:45 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366756657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYRESDEC], 0x80}}, 0x10) socket(0x10, 0x8000000000000003, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400203) sendmsg$inet6(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000100)="0d62192e1287099f307b315c82bf3116aecdff4ca8a2fb2d7c09e927f623af944037768e8df5a06765ad251e35ae63850203b07358463a554ce343a031a561ff3af216ecc1fedc175ee5469ea5a68954553c8c7db43be2953141b3ce330ebd2b27dcd5f531012fc7c7bcb52ab669aaf20c8552815b265c2a02ffb4eda2d84714ee7be8d2f63ebd9752906c0c275b38acd6d9f1fc065c0b246eb60c41148ccbff9bd19248e611dca57c6882dea8b19283ea7b83659f50f5ae81a6b33b289395d2074ac58942beec611a4ccb4576af9621755afa65ade5f5e6d189d17ac72e9c183f9b8476d464c39fcfe111680a154ab8355e0a92d0b5e824b216", 0xfa}, {&(0x7f0000000000)="c68dbe5471759a622cb4d194126c375561ffd882600ac5ebe72434e904b7ab94ed953e5217b776b2e2cd0322246a06ddf63a5cb06d0331c0312e9b67df4eb65bad2805cf49fc07ad2ba46393bf3e7961a196ade5355b", 0x56}], 0x2}, 0x20004000) [ 3473.236440][ T8307] md: md0 stopped. [ 3473.244576][ T8309] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3473.310158][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3473.320182][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3473.334993][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3473.342220][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3473.352219][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3473.363107][ T2112] 00000010: 00 c4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3473.374845][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3473.385359][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3473.394762][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3473.406228][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3473.417606][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3473.428309][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3473.439130][ T8315] XFS (loop5): SB validate failed with error -117. 22:04:45 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f0000000040)=0x8001) ioctl$BLKPG(r0, 0x932, 0x0) 22:04:45 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000000c329ff19e93d2237408f990b2e76ba354fedbd9ae4a45bc07a1c496ed25d103d684ab61c0afabfb7719f79ba68167f929e18b46c0de6282f0646e652c24970007a32e2500dbe460dfabc86015d224633abe327db4bf2551f3f6a87af3323026b9b7e6b35e53fdf76e437d815ec4886673f9f45ee480cd57006719336bc089d7e69f4ee3480910bb97f367b4dbd890744233483293502e340f9569ee317ca30e4227ec720ae34bcb180ae26e4aa07dfbd9ecf87bff0cc41b63dc99e2de431fbd2e51c95b88a2d15df64f21a756334f3e22c6a9ca30ffe636d086574e2510041b4fe997ad5a3a80f36869f92473db55b795dc501688909300cfb44776e6aa380cb53066ce70a0fafa4dbe719399526d638b0d4ff0e8a8c7a3a4e1f86f0f2bcd018a1e11a3bac4e4c2a867f2d54a470d2c1719f236a35c73342523206fad4f59b9084eef61bb5464b7bde5f8a289229b95af20000000000000000000000000000006cfc49647c118abb487a297ac3b8fa6e7af94ad7280b9ac92d1a7bc7d9831a141fe8fc39df270e383f68d855efcd54cc0278cfa2d3296663948bfafdaa3afb5765b55af6e28bbf7e15ce198ac3709ce066e9506e846fe3a3e2ab4e519972daea2a00c7780b18c4af88d06c49442b421f041ac44e552d995ee708ac2a43e7c666a4c91dfc396bc0aef35c4892f5d3d68510ab41f6b7cd2eae1d0311d40bed0637d20538ba27e8da012ae1f92cf59d19cd3f6a3000af99ee08cff9698eadb344b6873975fcad716f415458c6f038c76872e051018f5c285bdfde6bac1ca70f04f26882bc6ef9965709"], 0x80}}, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2600, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r3, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0xc, 0x2, [@TCA_TCINDEX_MASK={0x6}]}}]}, 0x3c}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000040)={'ip6gre0\x00', r3, 0x4, 0x7f, 0x1f, 0x3, 0x5, @private2={0xfc, 0x2, [], 0x1}, @empty, 0x1, 0x2, 0x5, 0x4}}) r4 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3473.497274][ T8322] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3473.626383][ T8352] md: md0 stopped. [ 3473.635819][ T8349] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.1'. 22:04:46 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000004", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:46 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0xd0800, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) write$P9_RLOCK(r4, &(0x7f0000000080)={0x8, 0x35, 0x1, 0x1}, 0x8) ioctl$BLKPG(r0, 0x932, 0x0) 22:04:46 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20002, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000300)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r3, 0x2000000000003}, 0x18) ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, &(0x7f0000000480)=ANY=[@ANYRES32=r1, @ANYBLOB="06000000030045ada8a30eb84577f4d14c47cf75c048fcf4261b0a4e2f7c93d8fe85d027888537e79bcbdcea4299ff937fb8df766c6acc79d527e054b4327de65fb8615c90021443f5d622422ac50af0756688e05f99656e6b9bacd99d7e6e8d6b92c96a56a1e3a4a8804f40d793e9e4f5301b88e77980a688793f32ac726f9c0cd7739e85f920829af9cac77c2ee01d35ce8e19118986639695d7dd4db240e8d3bdba2ae3c55551695775998ee9ff8f727bb77b002527e4ca1c8051f990c9f885b7db974418ac06435a4afecc519c1fd4a2ac1f2b05da23c735d4e472453bb89a88f6e4228eab7b618dde1e073a2c01a1f1a729ed97798790ab45f8aee4ba95c296ece68b1426eaaf83a71bf12297dc"]) r4 = socket(0x10, 0x8000000000000003, 0x0) r5 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0x8, 0x4080) getsockopt$inet_sctp6_SCTP_NODELAY(r5, 0x84, 0x3, &(0x7f0000000080), &(0x7f0000000100)=0x4) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3473.846383][ T8315] XFS (loop5): realtime geometry sanity check failed [ 3473.853658][ T8315] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3473.869471][ T8315] XFS (loop5): Unmount and run xfs_repair [ 3473.876880][ T8315] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3473.888535][ T8315] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3473.924093][ T8315] 00000010: 00 c4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3473.959606][ T8315] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3473.988760][ T8315] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3474.000789][ T8315] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3474.011854][ T8315] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3474.026184][ T8315] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3474.070410][ T8315] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3474.083858][ T8315] XFS (loop5): SB validate failed with error -117. 22:04:48 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x2, &(0x7f0000000000)=0x9, 0x4) 22:04:48 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) listen(r2, 0x9435) r3 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$SG_SET_DEBUG(r3, 0x227e, &(0x7f0000000040)) ioctl$BLKPG(r0, 0x932, 0x0) 22:04:48 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000005", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:48 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2c, &(0x7f0000000280)={0x7f, {{0xa, 0x4e24, 0x7fff, @private0={0xfc, 0x0, [], 0x1}, 0x7f}}, {{0xa, 0x4e20, 0x9, @remote}}}, 0x108) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:48 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000d4000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:48 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) [ 3476.296094][ T8401] md: md0 stopped. [ 3476.313129][ T8406] __nla_validate_parse: 2 callbacks suppressed [ 3476.313140][ T8406] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3476.333204][T25648] XFS (loop5): realtime geometry sanity check failed [ 3476.340585][T25648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3476.354576][T25648] XFS (loop5): Unmount and run xfs_repair [ 3476.361843][T25648] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3476.371832][T25648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3476.382733][T25648] 00000010: 00 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3476.393616][T25648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3476.404026][T25648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3476.414655][T25648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3476.424939][T25648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3476.435577][T25648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3476.444970][T25648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3476.456307][ T8400] XFS (loop5): SB validate failed with error -117. 22:04:48 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3476.507634][ T8412] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3476.540218][ T8406] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:49 executing program 1: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r0, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYRESOCT=r0], 0x80}}, 0x0) r1 = socket(0x10, 0x1, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000006", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:49 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000000)={'hsr0\x00', {0x2, 0x4e23, @multicast2}}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) [ 3476.799109][ T8400] XFS (loop5): realtime geometry sanity check failed [ 3476.806117][ T8400] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3476.820952][ T8400] XFS (loop5): Unmount and run xfs_repair [ 3476.828015][ T8400] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3476.841613][ T8400] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3476.881604][ T8400] 00000010: 00 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3476.893111][ T8454] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3476.930047][ T8400] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3476.974508][ T8400] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3477.026311][ T8400] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3477.057889][ T8400] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3477.085624][ T8400] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3477.133637][ T8400] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3477.175550][ T8400] XFS (loop5): SB validate failed with error -117. [ 3477.218202][ T8456] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:49 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000007", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:49 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r3, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000100)={0x4c0000, 0x8, 0x1, r3, 0x0, &(0x7f0000000040)={0x9b0952, 0x9, [], @p_u8=&(0x7f0000000000)=0x80}}) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r5, &(0x7f0000000140), 0x10) io_submit(r6, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r6, 0x2000000000000072, &(0x7f0000000080)) [ 3477.404485][ T8469] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:49 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000e8000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3477.696056][ T8479] XFS (loop5): realtime geometry sanity check failed [ 3477.725025][ T8479] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:04:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000008", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:50 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe88000000000000000000000000000136cf861a248f44aa31fc043a", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}, 0x1, 0x0, 0x0, 0x24040000}, 0x0) r2 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x8) r3 = msgget$private(0x0, 0x0) msgctl$IPC_SET(r3, 0x1, &(0x7f0000f00f88)) msgsnd(r3, &(0x7f0000000400)=ANY=[@ANYRES32], 0x1, 0x0) msgrcv(r3, 0x0, 0x0, 0x0, 0x0) msgctl$IPC_SET(r3, 0x1, &(0x7f0000000580)={{0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}) msgctl$MSG_STAT(r3, 0xb, &(0x7f0000000000)=""/48) [ 3477.810031][ T8479] XFS (loop5): Unmount and run xfs_repair [ 3477.834476][ T8479] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3477.869775][ T8499] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3477.873035][ T8479] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3477.942067][ T8479] 00000010: 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3477.973656][ T8479] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3477.989469][ T8496] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3478.005391][ T8496] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3478.018854][ T8500] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3478.065403][ T8479] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3478.074328][ T8479] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3478.106097][ T8479] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3478.117855][ T8479] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3478.130416][ T8479] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3478.142108][ T8479] XFS (loop5): SB validate failed with error -117. 22:04:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000009", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:50 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000000a", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3478.540904][ T8479] XFS (loop5): realtime geometry sanity check failed [ 3478.553045][ T8479] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3478.568775][ T8479] XFS (loop5): Unmount and run xfs_repair [ 3478.574848][ T8479] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3478.584213][ T8479] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3478.596192][ T8479] 00000010: 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3478.605452][ T8479] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3478.614482][ T8479] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3478.624201][ T8479] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3478.633260][ T8479] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3478.642320][ T8479] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3478.651315][ T8479] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3478.660435][ T8479] XFS (loop5): SB validate failed with error -117. 22:04:51 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 22:04:51 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000040)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8923, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100)='NLBL_CIPSOv4\x00') sendmsg$NLBL_CIPSOV4_C_REMOVE(r3, &(0x7f0000000240)={&(0x7f00000002c0), 0xc, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRESDEC, @ANYRES16=r4, @ANYRESOCT], 0x3}, 0x1, 0x0, 0x0, 0x4}, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="50200000000062f6e9a5d02bf5de58aeef00"/28, @ANYRES16=r4, @ANYBLOB="01002ebdf927bd7000fbdbdf2501000000080001000300000008000200010000000cc90b800504030005000000080002000200000008000200"], 0x3}, 0x1, 0x0, 0x0, 0x8c054}, 0x48080) sendmsg$NLBL_CIPSOV4_C_LISTALL(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000500)={&(0x7f0000000a40)=ANY=[@ANYBLOB="6a19119ba4295bc2b02a0b00dc73b8fe70da3f", @ANYRES16=r4, @ANYBLOB="0101000000000000df25040000000800010000000000080002000000ac7417ff6fbafb6a69dbc63e4ec8dde4000008000100ffffffff080002000200000004000880f8000c8034000b8008000a002d97000008000a000497000008000a000000000008000900b54e39620800090068c9595c08000a00cff9000004000b802c000b8008000900c67cb80f080009001698673408020a00940e000008000a00e40a000720000044000b80080009005dcbf63308000a000000000008000a00a020000008000900d941057c08000a00544a000008000900995d073908000a00e7860000080009000f865a1a2c000b80080009006ceaa270080009005fd48257080009007bdd540308000a0061020000080009004c0d3c0814000b8008000a0086f9000008000900001319c8e6000b8008000a003d74000008000200030000001c000480050003000700000005000300070000000500030004000000"], 0x154}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f00000009c0)=ANY=[@ANYBLOB="0061a9002200f4f071e690521d79ec2df20a1921292b81a9ff0700001853f6caa7bee88f97c39fa1a81e3bdd3b2a22728650938e7081aa8a", @ANYRES16=r4, @ANYBLOB="00032dbd7000fedbdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x40800}, 0x2044011) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f0000000640)=ANY=[@ANYBLOB="b00100ff", @ANYRES16=r4, @ANYBLOB="00002bbd7000ffdbdf650100000004000c802c0004800500030006000000050003000100000005000300080000000500030006000000050003000700000008010c8014000b800800090012bae65b08000a00c228000024000b800800090035a5b71b08000900bccfaf4608000a0012f8000008000a0098ac000014000b8008000a00f9aa000008000a0004c000001c000b8008000a00c551000108000900d811e136080009008a14551c0c000b8008000900248953271c000b8008000a00178b000008000900d1e1d74f08000900f7b8f96f24000b800800090035fc9d170800090061a4947f08000900ccb23b6f08000a0065ce000004000b804c000b80080009004911722708000a00dc32000008000a005fe3000008000a006fa5000008000a001602000008000900647ba42408000a00310d000008000a0009510000080009005ba5002d0800020001000000240004800500030002000000050003000500000005000300020000000500030000000000300008802c000780080006001000000008000500877e572808000500e77a94210800060078000000080005000bac245608000100ffffffff"], 0x1b0}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4241}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="a4010000", @ANYRES16=r4, @ANYBLOB="200027bd7000fcdbdf2502000000180108802c0007800800050061acf22408000600cc00000008000500491afe3308000500aebc2227080006004400000024000780080006008b0000000800060070000000080005000ba0b21f08000600740000003c00078008000600630000000800050092e45d0308000500789ae7540800050000f9e24b08000600db0000000800060084000000080005009705d052140007800800050052113c4508000500d1507e7d340007800800060090000000080006005300000008000500ac4e2b6808000500216a585408000500f720fa4408000500f7906e4e1c0007800800050089badb79080005008e3c177008000600c700000024000780080005008df06d1f080006000500000008000500b5153d7008000600ed0000002c0004000300010000000500030000000000050003000000000005000300050000004c000880140007800800050040fd4d45080005007303640c3400078008000500c485fd250800060069000000080006009b00000008000600240000000800060002000000080005006e8f684e"], 0x1a4}, 0x1, 0x0, 0x0, 0x24044040}, 0x6004) sendmsg$NLBL_CIPSOV4_C_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000540)=ANY=[@ANYRESOCT, @ANYRES16=r4, @ANYBLOB="01002cbd7000fcdbdf25020000002800088024000780080006003300000008000500320e107908000600dc000000080005009b1219360800010000000000"], 0x44}, 0x1, 0x0, 0x0, 0x11}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000080)={0x228, r4, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1971c2a0}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0x16c, 0xc, 0x0, 0x1, [{0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7ccda1e0}]}, {0x44, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x57ab}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x48b93665}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x437c0b57}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x78adf411}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x64a2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x9be4349}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x75e7f075}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x1385}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d7b0393}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9f7c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x1c2ee3be}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd7fe}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x28133965}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x3159041d}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4c9f1cb6}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x345ad4a1}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x74e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x785088f7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6e2191}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5d02}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x57d2b610}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xe24}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xedc5}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x51e9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74cda172}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x969a281}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xabf1}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7ed8e1d6}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5e96}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x512c238c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x242b}]}, {0x4c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3c88}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x4c9}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7a489f4a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5cee6aea}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x14934851}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xd8f5}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d769c66}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc41e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4c1e324d}]}]}, @NLBL_CIPSOV4_A_TAGLST={0x44, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x7}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x5}, {0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5}, {0x5, 0x3, 0x7}, {0x5, 0x3, 0x2}]}, @NLBL_CIPSOV4_A_TAGLST={0x34, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x6}, {0x5, 0x3, 0x5}, {0x5}, {0x5}, {0x5, 0x3, 0xf}, {0x5, 0x3, 0x1}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x40000}, 0x40041) r5 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r5, 0x932, 0x0) 22:04:51 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0xc, 0x2, [@TCA_TCINDEX_MASK={0x6}]}}]}, 0x3c}}, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r4, 0x8918, &(0x7f0000000000)={@empty, 0x7d, r7}) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:51 executing program 1: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r0, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r1, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="8000000010001fffffff00009391db810c0000000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYRES64=r1], 0x80}}, 0x240048c0) r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x109042, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) r3 = socket(0xf, 0x8000000000000003, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x8) r4 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$SOUND_MIXER_READ_VOLUME(r6, 0x80044d05, &(0x7f00000001c0)) writev(r4, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) fgetxattr(r4, &(0x7f0000000040)=@random={'user.', '/dev/admmidi#\x00'}, &(0x7f0000000100)=""/76, 0x4c) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000580)=@filter={'filter\x00', 0xe, 0x4, 0x478, 0xffffffff, 0x0, 0x170, 0x0, 0xffffffff, 0xffffffff, 0x3a8, 0x3a8, 0x3a8, 0xffffffff, 0x4, &(0x7f0000000180), {[{{@ipv6={@initdev={0xfe, 0x88, [], 0x1, 0x0}, @private0, [0xffffffff, 0x0, 0xffffff00], [0xffffffff, 0x0, 0xffffff00, 0xff000000], 'vlan0\x00', 'virt_wifi0\x00', {}, {}, 0x88, 0x1, 0x5, 0x8}, 0x0, 0x100, 0x170, 0x0, {}, [@common=@inet=@tcpmss={{0x28, 'tcpmss\x00'}, {0x0, 0x58, 0x1}}, @common=@frag={{0x30, 'frag\x00'}, {[0x80000001, 0x8], 0x4, 0x2, 0x3}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x8001, 0x4, 0x6, 0x1, 0x0, "43634b7bd1ab6edb17aa6a9f0894ba028d447df8fa83f403455710cad6c778637253371637e718d13f24c5c497e5d0e6d8c98831e79e974007a45c334cc1066e"}}}, {{@ipv6={@private2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xff000101, 0xffffffff, 0xff, 0xffffff00], [0xff000000, 0x0, 0x7f20a5a4a8368889, 0xff], 'batadv_slave_0\x00', 'caif0\x00', {}, {0xff}, 0x11, 0x4, 0x2, 0x1}, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}, {0x20, 0x6}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x1}}}, {{@ipv6={@private1, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x13}}, [0xffffffff, 0xff000000, 0x0, 0xff], [0xff000000, 0xff000000, 0xff000000, 0xffffff00], 'batadv0\x00', 'veth1_macvtap\x00', {0xff}, {}, 0x11, 0x20, 0x0, 0x1}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}, {0x42, 0x2, 0x1}}, @common=@hbh={{0x48, 'hbh\x00'}, {0x7, 0x2, 0x1, [0x1, 0x9, 0x3, 0xfffb, 0xff, 0x8001, 0x6, 0x6, 0x3, 0x9, 0x4, 0x4, 0xf3, 0x3f, 0x6, 0x9], 0x2}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d8) 22:04:51 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000000c", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:51 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000f4000000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3479.416309][ T8560] XFS (loop5): realtime geometry sanity check failed [ 3479.424531][ T8560] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3479.452226][ T8560] XFS (loop5): Unmount and run xfs_repair [ 3479.470823][ T8560] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3479.483158][ T8560] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3479.503894][ T8560] 00000010: 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3479.519281][ T8560] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3479.529452][ T8579] device lo entered promiscuous mode [ 3479.530967][ T8560] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3479.544511][ T8560] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3479.554218][ T8560] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3479.565823][ T8560] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3479.576339][ T8560] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3479.586373][ T8560] XFS (loop5): SB validate failed with error -117. [ 3479.589008][ T8583] md: md0 stopped. [ 3479.699262][ T8559] Y­4`Ò˜: renamed from lo 22:04:52 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$DRM_IOCTL_GET_MAP(r2, 0xc0286404, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, 0x3, 0x1, 0x20, &(0x7f0000ffb000/0x4000)=nil, 0x9}) 22:04:52 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000000e", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3479.893327][ T8594] md: md0 stopped. 22:04:52 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$NFNL_MSG_ACCT_NEW(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x0, 0x7, 0x301, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r4, &(0x7f0000000140), 0x10) r6 = syz_open_dev$usbmon(&(0x7f00000001c0)='/dev/usbmon#\x00', 0x1000, 0x6280) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) close(r9) io_submit(0x0, 0x2, &(0x7f0000000300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x2, r4, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x38, 0x4000000000, 0x0, 0x0, r8}, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x6, 0x4, r6, &(0x7f0000000280)="af188f08be42e7e20d80e5", 0xb, 0x6, 0x0, 0x1, r8}]) pipe(&(0x7f0000000200)) io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) [ 3479.962753][ T8560] XFS (loop5): realtime geometry sanity check failed [ 3479.974605][ T8560] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3480.032150][ T8560] XFS (loop5): Unmount and run xfs_repair [ 3480.067520][ T8560] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3480.102203][ T8560] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3480.138215][ T8594] md: md0 stopped. [ 3480.154427][ T8560] 00000010: 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3480.178974][ T8560] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:04:52 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff008000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat2(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={0x248000, 0x26, 0x1}, 0x18) getsockopt$IP_SET_OP_VERSION(r2, 0x1, 0x53, &(0x7f00000000c0), &(0x7f0000000100)=0x8) r3 = socket(0x10, 0x8000000000000003, 0x0) r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140)='/dev/nvme-fabrics\x00', 0xc040, 0x0) fallocate(r4, 0x22, 0x0, 0x5) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3480.245864][ T8560] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3480.262907][ T8560] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3480.274707][ T8560] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3480.293704][ T8560] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3480.305549][ T8560] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3480.332533][ T8560] XFS (loop5): SB validate failed with error -117. 22:04:52 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) r4 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r4, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x3, r4, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x38}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:52 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000000f", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:54 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 22:04:54 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/md0\x00', 0x0, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) delete_module(&(0x7f0000000100)='/dev/md0\x00', 0x200) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000080)=@gcm_256={{0x304}, "a69d9eddbfebcd0a", "d279f3a401a862d2039b956e6b87208fb13f3a08d83758a5fba6255da021188f", "44d4dc9c", "063287b5f6069cb8"}, 0x38) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcs\x00', 0x1c3102, 0x0) openat$cgroup_type(r2, &(0x7f0000000000)='cgroup.type\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r4, 0x110, 0x3) ioctl$BLKPG(r0, 0x932, 0x0) 22:04:54 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="060000001000f9cc1f9275e41fa567ebfc0000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4ff00"/23], 0x80}}, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x20000, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r0, 0xc0845658, &(0x7f00000003c0)={0x0, @bt={0xfffffe00, 0x6, 0x0, 0x2, 0x6, 0x1, 0x6feedf61, 0xffffffff, 0x8000, 0xc6, 0x6, 0x8, 0x8, 0xb, 0x11, 0x29, {0x1, 0x6}, 0x1, 0x40}}) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040)='devlink\x00') r3 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000002c0)='ns/net\x00') sendmsg$DEVLINK_CMD_RELOAD(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)={0x3c, r2, 0x536ae464467e3e0b, 0x0, 0x0, {}, [{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8, 0x8a, r3}}]}, 0x3c}}, 0x0) sendmsg$DEVLINK_CMD_PORT_SPLIT(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x70, r2, 0x10, 0x70bd25, 0x25dfdbfe, {}, [{{@nsim={{0xe, 0x1, 'netdevsim\x00'}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0x9, 0x6}}, {{@pci={{0x8, 0x1, 'pci\x00'}, {0x11, 0x2, '0000:00:10.0\x00'}}, {0x8, 0x3, 0x3}}, {0x8, 0x9, 0x8}}]}, 0x70}, 0x1, 0x0, 0x0, 0x8801}, 0x4000800) r4 = socket(0x11, 0x8000000000000003, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendmsg$inet6(r6, &(0x7f00000006c0)={&(0x7f0000000280)={0xa, 0x4e23, 0xffffffff, @remote, 0x8}, 0x1c, &(0x7f0000000340)=[{&(0x7f0000000300)="4f91db814ebe8704376a8fbda6b0cc71e54ea53ac4fbdfd8f89c2bc0efc20c4351ba", 0x22}], 0x1, &(0x7f0000000480)=[@rthdr={{0x88, 0x29, 0x39, {0x2e, 0xe, 0x1, 0x76, 0x0, [@initdev={0xfe, 0x88, [], 0x0, 0x0}, @remote, @private2, @mcast1, @ipv4={[], [], @empty}, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @initdev={0xfe, 0x88, [], 0x0, 0x0}]}}}, @rthdr={{0x48, 0x29, 0x39, {0x6c, 0x6, 0x0, 0x2, 0x0, [@empty, @local, @rand_addr=' \x01\x00']}}}, @hopopts={{0x38, 0x29, 0x36, {0x11, 0x4, [], [@generic={0x5, 0xc, "428751853d1de932585dfff7"}, @hao={0xc9, 0x10, @private2={0xfc, 0x2, [], 0x1}}]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x2}}, @hoplimit={{0x14, 0x29, 0x34, 0x6}}, @rthdrdstopts={{0xa0, 0x29, 0x37, {0x67, 0x10, [], [@jumbo={0xc2, 0x4, 0xefa2}, @calipso={0x7, 0x20, {0x0, 0x6, 0xf0, 0x6, [0x4, 0x401, 0x4]}}, @ra={0x5, 0x2, 0x1}, @enc_lim={0x4, 0x1, 0x3f}, @hao={0xc9, 0x10, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @enc_lim={0x4, 0x1, 0x9}, @enc_lim={0x4, 0x1, 0x7}, @calipso={0x7, 0x38, {0x2, 0xc, 0x0, 0x3, [0x0, 0x6, 0x10001, 0x2, 0x8aae, 0x1e30]}}]}}}, @dstopts_2292={{0x40, 0x29, 0x4, {0x6b16c8cf479d3a80, 0x4, [], [@jumbo={0xc2, 0x4, 0x7}, @pad1, @ra={0x5, 0x2, 0xff}, @generic={0x1}, @hao={0xc9, 0x10, @ipv4={[], [], @multicast1}}]}}}], 0x218}, 0x20000040) 22:04:54 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000010", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:54 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) syz_init_net_socket$ax25(0x3, 0x5, 0xce) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:04:54 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000044010000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3482.470720][ T8657] __nla_validate_parse: 13 callbacks suppressed [ 3482.470731][ T8657] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3482.497853][ T8648] XFS (loop5): realtime geometry sanity check failed [ 3482.507274][ T8648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3482.523436][ T8670] md: md0 stopped. [ 3482.530016][ T8648] XFS (loop5): Unmount and run xfs_repair [ 3482.541627][ T8648] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3482.553711][ T8648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3482.573958][ T8648] 00000010: 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 .D.............. [ 3482.592203][ T8648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3482.603610][ T8648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3482.638686][ T8648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3482.649862][ T8648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3482.653860][ T8657] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3482.660905][ T8648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3482.678768][ T8648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ 22:04:55 executing program 0: r0 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x288440, 0x0) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000080)) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x101000, 0x0) ioctl$BLKPG(r1, 0x932, 0x0) 22:04:55 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r0, 0x0, r0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r1, &(0x7f0000000140), 0x10) io_submit(r2, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r2, 0x2000000000000072, &(0x7f0000000080)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="480000009fbe5fc82a9a92293c024c00010000", @ANYRES32=r7, @ANYBLOB="b468c4070000"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r7, @ANYBLOB="00000000ffffffff00000000090001006866006300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0xc, 0x2, [@TCA_TCINDEX_MASK={0x6}]}}]}, 0x3c}}, 0x0) connect$can_bcm(r4, &(0x7f0000000000)={0x1d, r7}, 0x10) 22:04:55 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000020", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3482.689233][ T8648] XFS (loop5): SB validate failed with error -117. [ 3482.797131][ T8692] md: md0 stopped. 22:04:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x11b582, 0x0) [ 3482.855742][ T8697] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:55 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0xc65c}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={r3, 0x3, 0x1316}, 0xc) [ 3482.911460][ T8701] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=48799 sclass=netlink_route_socket pid=8701 comm=syz-executor.2 [ 3482.919866][ T8702] md: md0 stopped. [ 3482.935655][ T8702] md: md0 stopped. [ 3483.042510][ T8648] XFS (loop5): realtime geometry sanity check failed [ 3483.090347][ T8701] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=48799 sclass=netlink_route_socket pid=8701 comm=syz-executor.2 [ 3483.110520][ T8648] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3483.136435][ T8700] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3483.185626][ T8648] XFS (loop5): Unmount and run xfs_repair [ 3483.191666][ T8722] md: md0 stopped. [ 3483.214942][ T8648] XFS (loop5): First 128 bytes of corrupted metadata buffer: 22:04:55 executing program 2: r0 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nvme-fabrics\x00', 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r2, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f00000000c0)={r3}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000040)={r3, 0x8000}, 0x8) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) r6 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r6, &(0x7f0000000140), 0x10) io_submit(r7, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r7, 0x2000000000000072, &(0x7f0000000080)) [ 3483.250876][ T8648] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3483.294263][ T8648] 00000010: 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 .D.............. [ 3483.340739][ T8648] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3483.350596][ T8648] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3483.360714][ T8648] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3483.373583][ T8648] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3483.386693][ T8648] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3483.396561][ T8648] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3483.407415][ T8648] XFS (loop5): SB validate failed with error -117. [ 3483.448023][ T8722] md: md0 stopped. 22:04:57 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 22:04:57 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000002a", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:57 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000140)={0x7, 0x1, 0x101}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) sendto$packet(r5, &(0x7f0000000080)="643e9babbd622f87056ca2df4f0ee8323ed09f8cc10dedf9a246aad27d9268e9bd1363a35ac8d158020ba026ff6f60bd662d43ed50e145588a9163b79d7d0a992b89a80a7620323eb8b69fdcce5ffdfea0310aba9bcb866312baafdb99001d", 0x5f, 0x40041, 0x0, 0x0) r6 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$VIDIOC_LOG_STATUS(r6, 0x5646, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$KVM_DEASSIGN_PCI_DEVICE(r2, 0x4040ae72, &(0x7f0000000040)={0xffffff80, 0x6d, 0x5, 0x4, 0x719}) 22:04:57 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x90040, 0x0) r2 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsa\x00', 0x8000, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x2) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000040)={0x42b9be0c, 0xa}) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:04:57 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000080010000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:04:57 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = openat2(r1, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x40, 0xa, 0x2}, 0x18) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r3, &(0x7f0000000140), 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) io_submit(r4, 0x0, &(0x7f0000000080)) pipe(&(0x7f0000000200)) io_submit(r4, 0x2000000000000072, &(0x7f0000000080)) [ 3485.566881][ T8761] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3485.581953][ T8760] md: md0 stopped. 22:04:58 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r1, 0x40405514, &(0x7f0000000140)={0x1, 0x4, 0x7ff, 0xffffff9a, 'syz0\x00', 0x81}) r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x1, 0x0) writev(r2, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="8000000010001fff000000000400000020000014379b720655c1e2bccf4cdde1adfcbf1f29e669b35b0f5e8f0051ea527ff8a7bfc1ed88e8b3271398e3595b3618f06eae045c90ad17780b8d7305e7857e56a6cc17ca68f0fbdd6eb3965f3ec1e75eda2107e4316a94ec05b83406b903973f06f3fa0f8719f97c1eaf6b6b6244947e2e778bef79f0e57ee1e78ce46d83b0a0e20022c3fe8efa90c872d3202b1275b76041c9", @ANYRES32=r2, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r3 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r3, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3485.674910][ T8763] XFS (loop5): realtime geometry sanity check failed [ 3485.685588][ T8763] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3485.718374][ T8763] XFS (loop5): Unmount and run xfs_repair [ 3485.738424][ T8761] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3485.746444][ T8760] md: md0 stopped. [ 3485.763418][ T8763] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3485.781211][ T8763] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3485.813936][ T8763] 00000010: 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3485.834468][ T8763] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. 22:04:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000003c", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3485.871699][ T8763] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3485.883019][ T8763] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3485.893000][ T8763] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3485.902873][ T8763] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3485.913187][ T8763] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3485.924596][ T8763] XFS (loop5): SB validate failed with error -117. 22:04:58 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet6_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "6102dac56353dc69", "34fc60b0c488ed7016373190045a69867dc49ddef37d404bc0a78d4c49e6e81f", "35b00482", "f4068948c870bd1b"}, 0x38) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r5, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) [ 3486.024332][ T8799] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3486.219628][ T8799] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:58 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000003f", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3486.352638][ T8763] XFS (loop5): realtime geometry sanity check failed [ 3486.361844][ T8763] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3486.387962][ T8763] XFS (loop5): Unmount and run xfs_repair [ 3486.416792][ T8763] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3486.466908][ T8821] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3486.476229][ T8763] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3486.476246][ T8763] 00000010: 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3486.476259][ T8763] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3486.476272][ T8763] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3486.476285][ T8763] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3486.476300][ T8763] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3486.476313][ T8763] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3486.476326][ T8763] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3486.476381][ T8763] XFS (loop5): SB validate failed with error -117. [ 3486.651075][ T8822] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:04:59 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000040", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:04:59 executing program 1: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r0, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="c000000010001dff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYRESOCT=r0], 0x80}}, 0x4010) r1 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:05:01 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 22:05:01 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="5846534200001000000000000000100000b0010000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:05:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000000000000000f2ac6c46", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:05:01 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r4, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) pidfd_getfd(0xffffffffffffffff, r4, 0x0) close(r3) r5 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f00000000c0)={r6}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x5, &(0x7f0000000280)={r6, @in6={{0xa, 0x4e24, 0x5cf2, @local, 0x7fffffff}}}, 0x84) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r7, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r7, 0x2000000000000072, &(0x7f0000000080)) 22:05:01 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff81b000d00c329ff9d6efc"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) lgetxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@known='security.apparmor\x00', &(0x7f0000000240)=""/124, 0x7c) close(r4) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r5, 0x84, 0x6e, &(0x7f0000961fe4)=[@in={0x2, 0x0, @dev}], 0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r4, 0x84, 0x1b, &(0x7f00000000c0)={r6}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000000)={r6, 0x2}, 0x8) io_uring_register$IORING_UNREGISTER_FILES(r2, 0x3, 0x0, 0x0) ioctl$SNDCTL_DSP_STEREO(r3, 0xc0045003, &(0x7f0000000040)) [ 3488.760066][ T8860] __nla_validate_parse: 2 callbacks suppressed [ 3488.760078][ T8860] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. [ 3488.819291][ T8858] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3488.839731][ T8857] XFS (loop5): realtime geometry sanity check failed [ 3488.851430][ T8857] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3488.905335][ T8857] XFS (loop5): Unmount and run xfs_repair [ 3488.932218][ T8857] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3488.963400][ T8857] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3489.002814][ T8857] 00000010: 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3489.039522][ T8857] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3489.078481][ T8857] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3489.110802][ T8857] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3489.121338][ T8858] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3489.144335][ T8857] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ 22:05:01 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) r7 = openat$cgroup_ro(r6, &(0x7f0000000000)='pids.events\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) close(r10) io_setup(0x2, &(0x7f0000000140)=0x0) io_submit(r11, 0x2, &(0x7f0000000380)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x6, r7, &(0x7f0000000280)="7383ecf6afb1f1470b0d0c4fba65f1e6397dc3efe57e4c3c888b35dde025639dbf64965a2907a4f408bfb154780a3588642f2bfac2b7dac5f24c036e80ac77d0b8530be6e2d9efd2ce27f86d90497bed56a875c9f17d33b7239afed3133c29a375a55a4b0cab38e5201de89014e63f92a3b8e9bfed0aef866a721c32b1d787b01ba308971653547bd4fbfd951a318d52b0df25093bfdc60fbc440d1b84660db22e9b69b5d2c09853ffee5bbace43e1653af6cf754f4c6d630c98b8d5d67afd72db24afce8e501cb07eecab64", 0xcc, 0x4, 0x0, 0x2, r9}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x7, 0x3, r0, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x2, r4}]) 22:05:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000048", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3489.189755][ T8857] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3489.219122][ T8857] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3489.243835][ T8857] XFS (loop5): SB validate failed with error -117. [ 3489.316186][ T8882] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:05:01 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) r2 = socket$can_bcm(0x1d, 0x2, 0x2) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x10000, 0x0) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000100)={0x2, r1, 0x1}) dup(r3) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_FIOGETOWN(r4, 0x8903, &(0x7f0000000040)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) getsockopt$bt_BT_SECURITY(r6, 0x112, 0x4, &(0x7f0000000180), 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r7, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r7, 0x2000000000000072, &(0x7f0000000080)) [ 3489.478290][ T8886] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:05:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000004c", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3489.602868][ T2112] XFS (loop5): realtime geometry sanity check failed 22:05:02 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000940)=ANY=[@ANYBLOB="8800000010001fff00000000040000000000000048aab379194b47d01adbf1f588da719601dcfee90300000000000000971b9fe040a513e496dfa02df5ea778a8a7b17a01be98a88ed9e637ceca6f03a9588304c2fe45c4acdcc7416429c0f2934bdcd1a4723507ae7f163955427e59701a934d174d3141f15ed5744b533e43a980e103daa27d0c671413a4df1e659807e9027b6bf96923e8711346a10d68a2d4a38634ebb2478205135cc5b5281284bc95cee06cd84fb2247cd4bab707f37e6da1b15a8078dd7a5397b3dad9b3bbe5745b2c1b316a0c470699d6d7c6715df4880453e86c79ce0fe606416babfeaaba6a540a51b7fbe44614bada0c2f41f4e31956f816d5e846e2c06aaa485a20057a6f88574866100000000d96fe30aa0ee09f8f9453fc0546bc8608f0186ef63588037e1beed0ce7140d2f8299461f3f353572a7618293bfddd0499ceab796d3756dd83c495db060bca9432a0568e36f35f0c77e3da10adb8de9d5d55a330ba707d8355f1669368ceb755442c92603787afe19535d8fa14fc83e094f3b2499f43a47cae6b9a0764c617655791c14f4668cc2f94e7fad68b0", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000009800000000000001060002000200000008000a008d5a2c25185b1421f0e6e595156b343577028d2a1e330cee110772dafb414426a828d9e639eb3300b00db06d197b385abd57de63c6fe7e2849289560b9af5fba45a4382cf5798b77f6ffe91cf572688786782ed9", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000880)=[{&(0x7f0000000000)=""/170, 0xaa}, {&(0x7f0000000100)=""/185, 0xb9}, {&(0x7f0000000240)=""/190, 0xbe}, {&(0x7f00000001c0)=""/48, 0x30}, {&(0x7f0000000300)=""/71, 0x47}, {&(0x7f0000000380)=""/32, 0x20}, {&(0x7f00000003c0)=""/218, 0xda}, {&(0x7f00000004c0)=""/14, 0xe}, {&(0x7f0000000500)=""/54, 0x36}, {&(0x7f0000000540)=""/169, 0xa9}], 0xa) [ 3489.657742][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3489.677059][ T8906] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:05:02 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) setsockopt$inet6_tcp_TCP_CONGESTION(r4, 0x6, 0xd, &(0x7f0000000000)='highspeed\x00', 0xa) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r5, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) 22:05:02 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000025e", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3489.758824][ T8906] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3489.776553][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3489.811991][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3489.845848][ T8918] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3489.854449][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3489.930074][ T2112] 00000010: 00 b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3489.940751][ T8924] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3489.987181][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3490.035746][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3490.066393][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3490.084934][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3490.103020][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3490.113402][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3490.146460][ T8857] XFS (loop5): SB validate failed with error -117. 22:05:04 executing program 3: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x49, 0x49, 0x5, [@datasec={0x0, 0x4, 0x0, 0xf, 0x1, [{}, {}, {}, {}], ']'}, @func]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x69}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 22:05:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40041, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000040)={0x2, 0x1, 0x4a, 0x2, 0x2297}) r1 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x8) syz_mount_image$nfs4(&(0x7f0000000080)='nfs4\x00', &(0x7f0000000100)='./file0\x00', 0x4, 0x5, &(0x7f0000001480)=[{&(0x7f0000000140)="606d98ae4cc1aa8f751ff375ab45bc504aae90e38c72d2397345dd7ce1a76878320ba0295b768420c20f8085132e2b28dd97d430ad98e586a1390dab3ecc6752330affc1d5487ac13ff64a0343eb59c8cd0827b8fc7b83e81bbba17cfb4be12298355b0db0049b9eace151bd11cb370d15f4deaf17afab", 0x77, 0x3}, {&(0x7f0000000480)="c28d20d04e05caf53f1d5df234ee37f189e46cbf6c4a031773d95acf7a183ec2684a7dfb6632aab473a3f89573436a0a16e431bb15d3ffa266c764473843e89b971c4bde3670eb3a129996f388d1af77add4e731c752731857d7a88671055f295dbb47e7b858440870ca66e12c4ea5bb9739a8943130fdbfdbc49bae3fcea7e597bab9c82c6e78ab5541693bcc83d5bf28e360b93ac26e10c0d8dcc13d955b9aef661fb121db3a8b6eeb9680f312aa3f9ca06669f809ed505e21c32ed3f6bdb932f6678e4cb4a4b66217749f5d41050ceccf7f493716ce942c7f3a2bf9f2b4d16aa5ecfbf118b98bccafb5c61bff36d58ca0b08a65d182f76117be9cf92b7fb6d9cf1a4cb87958b804969676d701c7b941ee718a78dab144829a49830a8f0259e170c901d5d77f398f756685eead242dd36fbc58f6a777d15c9b7cdfce5e766bba23949fd5910b595fbda5c80d37c211e4c0b1ab97e5d0a580b6d2c2e8015d266dacbe04273abafb9ed00682e1a396fc7def5660aba7cec5a4445bf53b543deeea4fb0ce1b8a479936db5708ae471ccc1b3db0bab896c766921cd1bf88efb1bed365726ed1eb0a1f44e52dd56a46f0c20817d48a0ebd7280587bef91946dcaa637a5de296bc0683bbee834f9dcc3e46f6483572ec917c2163daa3f92827935ef844d3c18f884d87823a19e2da0a5377021b4537cde7e8b8cc540f49342fca79e4ebeab51b4c148071824263f220c5aaadfb667ee7c65113e3fa5cfa32216ce2e0c74f9704b4d222c05c29094864e7b5b22af78f1bad2520222ab310802e9f9054f6ba51865a7ab126f097ccd9ddf29ae78cf17724eed40b6ac9f027e259c22849e049100b161da0fc2dea806b120f2e60ada6c2a4f2a512ed4f9a0809a2065ff47fbebbd93555c41689dd9ce38a65e53d31b0bc5a11a2dad609b22904c96e2b3e8671ce72ba3d1da002810599037665f93ba9739c0450461f7ed6b9edbc96f4e7e4fff8de353c6e24bbe5c1ce03a2961dfe03a0f5a697f4400599774c784a87c2a1d4c849c42c31857a6e50c1658395dd3e50677db669498500063dbc3fb3f26d7406575571909f9775bc0e7a6ed3b443fb527a45aa111a729db53f935dfc68ca04645b3a3211c7456b3452de42722bbfd8cbe318719e24fab40ed8a873a1fe5010eaa6a09745e1fb1d7714c0738bf85a500f60aeae89e0d2a2ea675f91c96037e931bd0eba7a6444c4216da80ec5663730f8f09db62a55daa0c61b396b37ad456d3dc4201ce64e1a33b7f8e2ebe4d396f0354e1640b26b8dde47ca72caf12197767bae057ad748c6b06632fc70ea8c7749a12b3ccfb485190d2ebf95bed5dd40b51bebe737b40a232fd6f4d4172c6ed3ed5b0aa34b2186a26a6b498711e2814b08fae559aa103b620576246bce350c4b9dbd8041a64a9553529656dfbc7160cc34653d863e586d97d7dd6cd22b3be473eaccb7433c999617566ed5555709473e91ede9364c3ddcf8f5dd42fbc194f2a10f8740fcb66375a1e9545c7a61917a6083aa4b6b55f9206f0496d8e2fbeab419a558a89e89400235fa56bb349afd70e445051aacb33efb731516dc98253c676bae5819836fde5e5ea1ce538f04f1a62d86d80da57fe8fab1f3ba1e702110f9c83cfc4971554d1868cd443817828c49da5141cb988101d96c259b21986565d8be98fd909ce9863202c6e8488cce99346cc059bc315a70b0b2f39d89c1a4dd467af787b0de9c5a9159cd27e096da7710de9299243ff90f48107ff74ec3ed072fc30bb555070c74f645143e8aedd9f97392bd5c204a8eb3ea97e4682f6a56226a9c65a80141e67477dc6e91cb19692023c973d39afc8f9abe520d183ce8f7fd17354232e38fde408dd2927d29cb465967a485d7d11518f7f8f0003a15b1fe077eb8c0fb2801d4af8e3065325318a6fe5838100cae1a2f28e777f208d11a184f317c36cf4ac4bddda1892854ba3a849e067bcff9925b953713c992f49c960130a18ef979e07f43a4d3aeb0dc5282221f610aa2d39ce0b7373825efe214bba38ae699e9b1f07a2271e48c468cfac351d59db1e055fc5b074dcb06242480574234d07565b0f7726bb05b51890ed6e4f94212b3b8bba7ddc4da74d501b60adc8bbe0e1113d0af74f2649d16684a6a19c50e9ea63eb9cadfde454bb6ab573afbc85660bd43e898e00f03dce7b693fdde4023632fb8518f3905f0a797a35365e235c80401247e86e61e064d18bd469f4ecb89382030279c9da009b28358b6d8e7f042a4f5521619775fae5b4b866719d2336ec3a31dfe81565a3247661dd2148e548b7232f4d74feab3c5403de6c75e38235f8dd35a2ff597028ac6a7667b508bdf873f160310e658cf1ad8fd2dff7f0e378ba1353944e536786403e84599cf5e6ce62916534b622630b97d228cab26afb9246f2baef46ea3a91de5099323152fffc9313c0a09d95c2965ac7cc477b38548f862674d6356675b56625f1b978ef805f30a4fa0023cfd2add43422949cd9d58c5985f52df793086dbc0b2b189d2df7f9dcd2793df46a4561048029ef3d3f994fcb321170029e360bfc6d085306592bb86ae6aa769301b93974a64cf93fa405956a696aa48be8ff56616cd100c1a8c45eb4c33e5953e9902a65ed6b1d3a4a2d163e562517250983b3a463fa3b5c16ff4ae0b394b1f4067dad21ea5f7d8eb8dae7854e6168fc3cf7562174d5613a046254a94c0164dbfc3e7806d5914803696d5372bc4edd4260f40b81ae93743b17d05a63462305146b9e60694792aa8a2665cc52e49130165814f28316f2b6dc53efeea9095eaf9c91c714aa71d5e4d6da9be064501359c657e834d2f4f71611dc4c5fa875bd12de29a1c3f05232b6e19b10766fdad234ce2e43452f333243df571183f5f721143599ba26b58174fbc4d34b51d5fad7d903a4df221166c271f4b263e756218d20e7285a3bc114fef5c256ed4de4a67264f46f4f6187c4c1ada6075fe6767ba7759cda0e4828c7f077a15df9ae4917aedb0751cde4e5cfa2decdf7cf94221294aea626fac1821fcd3a194119367cdb38aca5846587279c2096dcb2155a2898964ad75e1d5c28ad493f5526bcf6d7ad4f7a2db5fdd9a03b61ffd7826e98a3c8ddb074b85bd9c03a1405115f4ebd9495250c1b7a0fc2d6ca24b3f26f6f1cef8231062ec19568f6618268995e88e8ccdfab5e080dba747f21d88aec93d20fd1c48122be524996c3a4d3ef07f5540673fb090b6645b0e10274abcfacc8697307d50f8856323ada1858fde5aedae95776b0e667ff6f2b99764fb4a54ec4d0de64969b756fc63a39e9deae3ea94942e90dcaf8c3875ddec160b2ce76e442b51df2dea69534c61c2495a9585d867b93b86c6ba99f08a448cb5454e08ea59957d580c255a3454cb2d1650ebee01e67469bc63382974ddd31f72e8b72d39345f9841c2652cbae5fbeda2d7395603ae1477fc4923c2232d6b47fc8f9ad0be71a8571b91507a363bedf62c70c599b490599aceec8df03b9f86cff3dbb75711c10a92e7029461913982731ad3648b26bcc57f56b51eb2e422618b6ddcbc2bd6cfbb23234cd44865b4785c1491169dbf45ae745cc1fa1c482b35eca4457180f06d74fb74c97011e7704a51928941e35f51294bc58990626e16a24bdf00b0eda389dc99261d55f83f9c784d50a4c338a80eaa5342f77f061cd58fa0d2de0f4bf1af5a9ea5ecbddd6ed2820ce139369b012f5b925f8c41375c3770c4c58c8ed38b498ff89af8d80de39c3cbfd4dc84fa562f0ea2cd0589b5847256ec338287fb392814f9dbd545469c0a718f30c2c80352a8192de2a8e8b463bfec0459eee203b679ac8bdfa6c07d9fd411edc47b9714e68e0c8ce8968f00ef431a3c43269ea27921999bcbe83778629b4b9ef1e0bf58fb23646250aa8d5ec9e781f4ecdcdcc246480277f8d029bc28c60824063260a18e429f289df8448713c582126fdab10415e62f28a0daacf167cde8c1f04585c296e5594e44c72a31d9887c77ce44c4811a5642e843e8a9f35e777d21b1e7373a838c18696720d336890b43b03f6e2d7201e53fa76f8b09aafb417eebeb201cffbb46efc1ce668d7431c9d092343be6216797b68c1fb084d69a8fd5125a555ad9c129ef0763a96f4804d645c424c016e9e6a32cf4ec36bcd0a1e825e58a1e66629fdd46a5c68b518dcc79e6979a6daa36477df9f84bcd124bf0d582256eff74ca7b6fb523429a30b107e450c7330274716e8c0b64891de0b365ba60308d3f149088ed9b460f0411ac4635bace87a91de89d4acba624c5c74844b5c534cc2622d0706abffec11c924cd9840e04b3a1131f2326a9bac9fe627ac2f1cbae83256465946f80ee053edad890fe9decada7aca783a1883050d938cb6b5c0b874b22cffb3ddfc599ad629b8e25c002db0e7e131e0a4ebf4ba63b6948eaf1675851460becb7a0598c6969a741d6212e13215cb10d6d3042648b3e8864e47c2b632b762f458280d37c15a022e2fd4ccbb4230b330e63adc31514b9919ee48d23a668f808cee880f66fec6b3cc9b6318908c3995a6801fa6bfc928458c0504e76d7c0d108ab55a30059849d047e8361aa47a1fdd30013fb68502c2aa8244d34a425a3c80cda906d2ed86a12d37535bca693c3052a4dc8add7771b544abda6c7c4fb814fac6090b678ae5f1d7a3b0820ca2f23be29d95a2ce69fa5819a3210fb61d2704ac609ad2fb39241490f51bded3e1ec511d7dd972e0b4cd63ca74d73ec8d8fdd5d00a7cae803d8eaee37f2a2fd50f85427f506434057be69c71eb4442de4191d6f1f915099675d33fac28d0e7d13c723125a21d2d6d90a67066b0f1fbef31e68b72f47f2b68e872ba57051fd50e3e9b7e007399bc5792754bf93716a6a7e8d9b6a45b68a8c072a35f7f02aaa284d5314966a1aa4283855fae616280b251d6428d09915bee1bc3a631ff89a8a30e0bb13b70270431c3f100a0963aefe5883f49d0cd79429f2f2cbf98b72ad0a92f8c8f5caa1e37dbd521b0f16e3855d6ba220a22967ca2b1f43adf27cd207279d5f6f593b75f3ee9aaec47b71596b108a46291e9878a5491f403929e632921661b2a4e4f4bc2485a8844ca0220c750c1e1dbb4de9b260cb32741a40f7e8fd832eab1528fb45adf2869e38aeb2267ca868221d1e77087571034f18db0c13f8385222a7ba308e32c7fa44215ba665857eca2b96fc9787ee9153c4ee3941ef0bfdbdab90c6155eb2e98af6df606460dbadf8e83f1c77eb3519616f1689f03db9316d457cfbae78400549c7bd659f30eb2c01709ea9208311cb0da491cf9237ec5939484ec0d9ee0645f1564768eb84ed06b5a41c2142fc84f1169844b02cfc50fbca1cb70fd00b3b41ed0817859b2a572a2e4961b10e899a74642d4e863be0a9b6e66465ca0c9179b4870be6325b3d3255ae75204061e6dba6eee423517fefdcdcbac1f826f1988c90a16f7c53c20a8fc6ba97666ce1cf5c91a470ee5f73a74221a2b1d0c078277b0ea2a98f6e9ba58fc5582a2c54d55bd6546b34fd4618ed2ead629745cb485052925792e49a754e24e3aa24a2e2803a3b627b9c957a5b082362bce8f0a8c4751f1cac909b1ae09f52e88b3d78edd6bd29aafd63d1bda85713c90ee13c57118e2e85612fd8eda8a481e7257652ec1b4fd8e96c970ba8282c3f683fd893b0f34255f894181ba82aa157ab4c57b105e021e0bcc48881ece93d724dfa9f5c0c287c985a6a4dfcf453ae56cb6a47a821459695c749173e0f85c", 0x1000, 0xf31c}, {&(0x7f00000001c0)="cca18249c63fbcec45a8d365312406b70b16ef62ae5b763465998d742d229e7d60efe3cc52ede3560bf6ef", 0x2b, 0x1000}, {&(0x7f0000000240)="67f0522cf839d211ed54d19f3bf800542f904adc3d3640a3842528a5250abfc4092dd2d24b78367dad94a61032fa06eaf840da8f39ba5ee33ed9971e280bcdadd076496a64f0997aea4bfd3f6b83cc776c00441806826da6b25304180b6e182f3de1281939066643374afa039260283e4250f8bfb1c0fb35f96ff21d", 0x7c}, {&(0x7f00000002c0)="419cd30836a4e07d33d8df2a21dbd9b0983c6c53b38e1e3b9bd72416d8726af0546ed1dc654931b6bb393f8e65db4eb7b2639bbc3e76d95f9c980d7ed321cefc400e73356a9859bdf8ef67cdd3070e1d5f0062a7e9b3cd44b675e99aa6c78cd3517132b5724596841b1b82a5a8b17fc6d07528adbd3c7d330701acf2b29261aa84227bf4f0039c7bf77ab0304321d99236c31449bbab949b1373235cbf5ecbfeb02399d70aba1f6d9963883073982f88b9244f7e54ea67029553681204e8c60c87aebb2a786c07e4ad15ee48ee", 0xcd, 0x400}], 0x20808, &(0x7f00000003c0)='/dev/full\x00') 22:05:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000060", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:05:04 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2000, 0x0) ioctl$DRM_IOCTL_GET_CAP(r4, 0xc010640c, &(0x7f0000000040)={0x2}) connect$can_bcm(r2, &(0x7f0000000140), 0x10) io_submit(r3, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)) io_submit(r3, 0x2000000000000072, &(0x7f0000000080)) 22:05:04 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$DRM_IOCTL_GEM_OPEN(r4, 0xc010640b, &(0x7f0000000040)={0x0, 0x0, 0x7}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r2, 0xc00c642e, &(0x7f0000000080)={r5}) 22:05:04 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="584653420000100000000000000010000004020000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) [ 3491.734215][ T8945] md: md0 stopped. [ 3491.749039][ T8949] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:05:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400c329ff00000000000000000000000000000002"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$DRM_IOCTL_AGP_ENABLE(r4, 0x40086432, &(0x7f0000000080)=0x81) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@newtfilter={0x10a4, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x1074, 0x2, [@TCA_TCINDEX_POLICE={0x1070, 0x6, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x100, 0x7, 0x0, 0x8000, 0xffff, 0x66, 0x101, 0xffff, 0x401, 0x2, 0x4, 0x7, 0x80, 0x8, 0xffffffff, 0xaf4, 0x5, 0x1, 0xfffffff8, 0xaf, 0xffffffff, 0x5c, 0x50, 0x7, 0xffff, 0x7, 0x9, 0x7, 0x1, 0x0, 0x7ed, 0x6, 0x3, 0x22b, 0xcf, 0xc2c2, 0x8, 0x477, 0x3, 0x9, 0x400080, 0x8, 0xffffffff, 0x4, 0x5, 0x6, 0x7fffffff, 0x9, 0x1000, 0x3, 0x8, 0x10001, 0xbb, 0xf3, 0x4, 0x2, 0x6, 0xa235, 0xd257, 0x80000000, 0x10001, 0x0, 0x7, 0x1ff, 0x8001, 0xffffffff, 0x5, 0xffff, 0x2, 0x6ec, 0x4, 0x6, 0x8001, 0x8, 0x1, 0x7, 0x7, 0x6, 0xf55d, 0x29, 0x8, 0x8, 0x2, 0x5, 0x10000, 0xfb6, 0x5b, 0xfffffffb, 0x1, 0x80000001, 0x1ff, 0x6, 0x8000, 0x2, 0x2, 0x1000, 0x0, 0x3, 0x4, 0x7fffffff, 0x4, 0x8, 0xb50e, 0xf5, 0x20, 0x7e5f, 0x4, 0x1, 0x1ff, 0x5c3af461, 0x41, 0x1a8d46c2, 0x1ff, 0x400080, 0x6, 0xec6, 0x6, 0x3, 0x4, 0x100, 0x2, 0x1, 0x0, 0x8, 0x35, 0x10001, 0xfffffffc, 0xfffffffd, 0xfffffbff, 0x0, 0x9, 0x5, 0x4, 0x5, 0x8, 0xffff, 0x7fff, 0x0, 0x57ae, 0x3, 0x60e, 0x7, 0xc00, 0x0, 0x4, 0x9, 0x6, 0x9, 0x0, 0x7ff, 0x4, 0x4, 0xfffffff7, 0x7, 0xe7, 0x7fff, 0x3f, 0x0, 0x8, 0x101, 0x9, 0x2, 0x76, 0x352a, 0x3f, 0x8, 0x22a, 0x2, 0x1, 0x0, 0xfff, 0x12a, 0x7, 0x8a, 0x3, 0x9, 0x7, 0xfffffffe, 0x8, 0x6, 0x8, 0x4c1c, 0xffffffb7, 0x0, 0x200, 0x8, 0xffff0804, 0x10001, 0x0, 0x4, 0xcd7, 0x6, 0xff, 0x7fff, 0x1, 0x101, 0x401, 0x9, 0x400, 0x6a, 0x9, 0x0, 0x30000000, 0x2, 0x101, 0xaa38, 0x1, 0x3, 0x100, 0x8, 0x0, 0x7, 0x8, 0x7fff, 0xfffffe01, 0x8, 0xfffffff8, 0x200, 0x10000, 0x7, 0xffffffc1, 0x400, 0xfffffff9, 0xff, 0x10001, 0xfffffff9, 0x68d, 0x7db, 0x3, 0x8, 0x6, 0x100, 0x0, 0x8, 0x5, 0x800, 0x200, 0x9, 0xffffffff, 0x200, 0x3, 0x200, 0x80000000, 0x0, 0x9, 0x1, 0x6, 0x2e, 0x8, 0x0, 0x5, 0x2, 0x0, 0x7, 0x2, 0xc0000000]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4e}, @TCA_POLICE_RATE={0x404, 0x2, [0xfffff3e0, 0x8001, 0xfffffffc, 0x0, 0x3, 0x9, 0x0, 0x4, 0x2020, 0x7ff, 0xfffffff9, 0xa11e, 0x2, 0x3, 0x8, 0x80, 0xfffffeff, 0xff, 0x0, 0x9, 0x8, 0x5, 0x0, 0xfff, 0x3, 0xffff, 0x6, 0xa99, 0x2, 0x4, 0x8e67, 0x1f, 0x6, 0x80, 0x8, 0x6, 0x5, 0x7fffffff, 0x81, 0x4, 0x1, 0x3, 0x2, 0x6, 0x5, 0x7f, 0x2, 0x7, 0x7b, 0x1000000, 0x7727, 0x5, 0xffffffff, 0x9, 0x2, 0x9, 0x0, 0xffffffff, 0x0, 0x7, 0xa6, 0x100, 0x3, 0xfa, 0x1, 0x46c, 0x5, 0x8, 0x2, 0x20, 0x3ff, 0x1, 0x80000001, 0x0, 0x6, 0x9, 0xfffffffa, 0x6, 0x5, 0x7, 0x1f, 0x5, 0x4, 0x0, 0xfd6, 0x8001, 0x7fff, 0x3, 0xff, 0x4, 0x1f, 0x3ef, 0x5, 0xfff, 0x0, 0x2, 0xe1b, 0x7, 0x5, 0x4, 0x2, 0x3, 0x4, 0x9, 0x5, 0x6, 0x9, 0x8, 0x380, 0x1, 0x4, 0x400, 0x4, 0x4, 0x6fb9, 0xeb3c, 0x6, 0x794, 0x2, 0x40, 0x2, 0xcd7, 0x7ff, 0x0, 0x6, 0x2, 0x547b, 0x3, 0x1000, 0x1, 0xedb4, 0x5, 0x73, 0x3, 0x7, 0x3ff, 0x4, 0x7, 0x8000, 0x1, 0x778, 0x1, 0x5, 0x5, 0x55382df9, 0x6, 0x80000000, 0x2, 0x8000, 0x0, 0x6, 0x7, 0x8, 0x1, 0x9e, 0x1f, 0x2, 0x0, 0x5, 0x7fffffff, 0x6, 0xd27, 0x618e2b88, 0x101, 0x649f7701, 0x0, 0x220a, 0xfffffffb, 0x5, 0x7, 0x7, 0x7, 0xffffffff, 0x401, 0x0, 0x401, 0x0, 0xffffffff, 0x5a3, 0x400, 0x0, 0x10001, 0x3, 0x2, 0x4c02, 0x10000, 0x0, 0x9, 0x80000001, 0x10000, 0x6, 0x0, 0x80000001, 0x3, 0x6, 0x7, 0x4, 0x2, 0x5, 0x9, 0x3, 0x1, 0x3ff, 0x3, 0x4, 0x401, 0xfff, 0x4, 0x7, 0xff, 0x3, 0x6, 0x1, 0x2, 0x5, 0x4, 0x3, 0x4, 0x7, 0x80000000, 0x8, 0x0, 0xb96e, 0x79, 0x5, 0x3, 0x7, 0xffff, 0x6, 0x2, 0x7fffffff, 0x5, 0x5, 0x1, 0x3, 0xfffffffe, 0x3, 0x3, 0xffffff80, 0x7fffffff, 0x6, 0x4, 0x2, 0x3, 0x9, 0x5, 0xeb, 0x0, 0x5, 0x3, 0x9, 0x37f1, 0x1, 0x3, 0xe00]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x6, 0x3, 0x4, 0x7, 0x7f, {0x7, 0x1, 0x0, 0x6, 0xfff, 0x20}, {0x80, 0x2, 0x7d4e, 0x4, 0xea70, 0x7ff}, 0x8, 0x8000000, 0x10000}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x6}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x4, 0x7, 0x2, 0x8, 0x9, 0x34, 0x2, 0x2, 0x8, 0x10000, 0x7f, 0x5, 0x7, 0x8, 0x8, 0x368b, 0x7ff, 0x6, 0x1, 0x41, 0x9, 0x3, 0x4, 0x5, 0x4f01, 0x2, 0x4, 0x8, 0xe6dc, 0x8, 0x8, 0xfe, 0x100, 0xe9c, 0xfffffffa, 0x2162, 0x2, 0x5, 0xdce, 0xb6, 0x10000, 0x800, 0x10000, 0x9, 0xfffe00, 0x6d81, 0x2a, 0x6, 0x1, 0x3, 0x2, 0x80, 0x4, 0x4, 0x8, 0x0, 0x0, 0x7ff, 0x1, 0x3ff, 0x5, 0x3f, 0xe, 0x8001, 0x0, 0x3f, 0x5, 0x7, 0xffff7fff, 0x2, 0x3, 0x3, 0x101, 0x20, 0x3, 0x0, 0xc63f2bef, 0xfffff000, 0x3, 0x401, 0x5, 0x7, 0x5, 0x40, 0x640, 0x6, 0x9, 0x4, 0x7, 0x38, 0x100, 0xfffffff9, 0xffffb423, 0x5, 0xeaa, 0x800, 0x4, 0x800, 0x8, 0x5, 0x6, 0x40, 0x0, 0x40, 0xa18, 0x6, 0x101, 0x5, 0x199e, 0x0, 0xfffffe00, 0x2, 0x1000, 0x800, 0xba1, 0x5, 0x9, 0x8001, 0xffffffff, 0x100, 0x8000, 0x4433c817, 0x7, 0x7, 0x7, 0x4, 0x9, 0xffffffff, 0x9, 0x4, 0x1ff, 0xc2, 0x800, 0x545, 0xffff, 0x6, 0x101, 0x10000, 0xffff, 0x3, 0x5, 0x1, 0x7, 0xffffffc0, 0x3ff, 0x4, 0x80, 0x20, 0x8, 0x2, 0x7ff, 0x800, 0xcb, 0x8, 0x1, 0x7fffffff, 0x7fffffff, 0xef, 0x4, 0x8, 0x5, 0x4, 0x9, 0xfffffffb, 0x3, 0x8, 0x4, 0x1, 0xfffeffff, 0x0, 0x9, 0x80000001, 0x5, 0x9d0a, 0xd343, 0xc71, 0x2, 0x9, 0x0, 0x6858, 0x9, 0x1, 0x5, 0xda000000, 0xe70, 0x8, 0x50d, 0xd0, 0x1, 0x8, 0x4, 0x6, 0x40, 0x8, 0x635, 0x27fda965, 0xa2b, 0x2, 0x8, 0xa168, 0x4, 0x4, 0x9651, 0x80000000, 0x5, 0x4, 0x0, 0x8, 0xf1, 0xaec4, 0x3, 0x9, 0x5, 0xffff1cb3, 0x4, 0x40, 0xf6d, 0x4, 0x5, 0xff, 0x7, 0x400, 0x1, 0x6, 0x3, 0x8, 0x0, 0xffffffff, 0x6, 0x0, 0x7, 0x7, 0xffff, 0x5, 0x1, 0x7, 0x81, 0xfff, 0x6b, 0x5, 0x9, 0x6, 0xf8, 0x0, 0x9, 0x9, 0xffffffff, 0x9e33, 0x5, 0x6, 0x100, 0x8, 0xffffffff, 0x49, 0x0, 0x1]}, @TCA_POLICE_RATE={0x404, 0x2, [0x9, 0x7fff, 0x7ff, 0x3, 0x9, 0xfff, 0x7ff, 0x3f, 0x30000000, 0x800, 0x7, 0xfff, 0x4, 0x7f, 0x0, 0x6, 0x4, 0x9, 0xffffffe0, 0xba92, 0xffffffff, 0x9, 0x4, 0x2f, 0x94, 0x0, 0x9, 0x80000001, 0x7, 0x99, 0x1, 0x20000, 0x0, 0x8, 0xff, 0x7, 0x400, 0x356, 0x8, 0x9, 0x4, 0x80000000, 0xa8, 0x7ff, 0x3, 0x7, 0x3, 0x81, 0x0, 0x3, 0x0, 0x1, 0xb5, 0x3, 0x6, 0x1ff, 0x9, 0x3, 0x6, 0x7, 0x2, 0x8001, 0x3ff, 0x0, 0x80, 0xe000000, 0x0, 0x3ff, 0x6, 0x717b96b9, 0x8001, 0xfffffff9, 0x2, 0x3, 0x7527, 0x8, 0x8, 0x7, 0x9, 0x8, 0xb7, 0x80000001, 0x0, 0x100, 0x0, 0x6, 0x5, 0x2, 0x1, 0x1, 0x5, 0x9, 0x400000, 0xffff, 0x7, 0x6, 0xffffffe0, 0x7fff, 0x1000, 0x0, 0x7b3d, 0x5, 0x575, 0x40, 0x80000000, 0x3, 0x4, 0x10001, 0xfffffff7, 0x6, 0x10000, 0x2, 0xa48, 0x4, 0x0, 0x3fc, 0x3, 0x1, 0x6, 0x0, 0x5, 0x3, 0x3, 0x8, 0x4, 0xa41, 0x1000, 0xfff, 0x807, 0x4, 0x1, 0x7a, 0x4, 0x401, 0x401, 0x69d, 0x8001, 0x8, 0x0, 0x87, 0x2, 0x7fffffff, 0x2, 0x5, 0xffffffff, 0x2, 0xf18, 0x1, 0x100, 0xd29b, 0x8, 0x9, 0x69d, 0x0, 0x1, 0x7fff, 0x401, 0x80, 0xffffffff, 0xffffb3a5, 0x1, 0x2, 0x8, 0x5, 0x1, 0x4, 0x9e, 0x5, 0xfffffffd, 0x401, 0x1, 0x3, 0x80, 0xff, 0x4, 0x9, 0x1f, 0x1, 0xade, 0x7ff, 0x3ff, 0x0, 0x0, 0x7fff, 0x3, 0x20, 0x2, 0x7, 0x8, 0x20, 0xa0, 0x6, 0x96, 0xfffffff7, 0x0, 0x0, 0x9, 0x10001, 0x401, 0x200, 0xfffffffd, 0x1, 0x80000000, 0x39, 0x400, 0x1, 0x8, 0x0, 0x2, 0xc9, 0x146, 0x1ff, 0x40, 0x3ff, 0x7ff, 0xffffffff, 0xffffffff, 0x2, 0x6, 0x7fff, 0x8, 0x7fff, 0xfffffffc, 0x1, 0x0, 0x7, 0x9, 0x7fffffff, 0x99e6, 0x6, 0x7fff, 0x6, 0x1, 0x4, 0x8, 0x1, 0x3, 0x4, 0xde, 0x401, 0x6, 0x8, 0x721b, 0x401, 0x8, 0x1, 0x2, 0x94b, 0x6, 0xffffffff, 0xf8, 0x2, 0x2, 0x7fffffff, 0x5, 0x46e9]}, @TCA_POLICE_RATE64={0xc, 0x8, 0x84}]}]}}]}, 0x10a4}}, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000000)={@ipv4={[], [], @multicast2}, 0x32, r5}) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) [ 3491.815557][ T4206] XFS (loop5): realtime geometry sanity check failed [ 3491.830147][ T4206] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3491.849137][ T4206] XFS (loop5): Unmount and run xfs_repair [ 3491.855029][ T4206] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3491.862991][ T4206] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3491.872381][ T4206] 00000010: 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3491.882653][ T4206] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3491.892001][ T4206] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3491.901339][ T4206] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3491.913875][ T4206] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3491.930708][ T4206] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3491.940099][ T4206] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3491.949680][ T8942] XFS (loop5): SB validate failed with error -117. [ 3491.988494][ T8945] md: md0 stopped. 22:05:04 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x81, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) 22:05:04 executing program 1: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYBLOB="0e002400b16ad2a7c4b3143ff80b030008000d00c329ff"], 0x80}}, 0x0) r0 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x8) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0xfffffffffffffffe, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000002400ffffff7f000000003c0005000000", @ANYRES32=r5, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0xc, 0x2, [@TCA_TCINDEX_MASK={0x6}]}}]}, 0x3c}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000080)={'syztnl0\x00', &(0x7f0000000000)={'sit0\x00', r5, 0x29, 0x80, 0xf7, 0x6, 0x11, @dev={0xfe, 0x80, [], 0x21}, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x8000, 0x10, 0xfffff801, 0xe359}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000100)={'ip6gre0\x00', r6, 0x29, 0xa7, 0x3, 0x5, 0x4, @private0={0xfc, 0x0, [], 0x1}, @mcast1, 0x7800, 0x7800, 0xf6, 0x6}}) 22:05:04 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000005865", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3492.166012][ T8985] md: md0 stopped. 22:05:04 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {}, {0xe}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0xc, 0x2, [@TCA_TCINDEX_MASK={0x6}]}}]}, 0x3c}}, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vcan0\x00'}) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f000000c540)={{{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}}}, &(0x7f000000c640)=0xe8) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, &(0x7f000000c8c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f000000c880)={&(0x7f00000005c0)=ANY=[@ANYBLOB="c4010000", @ANYRES16=0x0, @ANYBLOB="000327bd7000fbdbdf250280140002006e657464657673696d3000000000000008000100000000000000", @ANYRES32=0x0, @ANYBLOB="080003000200000008000100", @ANYRES32=0x0, @ANYBLOB="08000300000000008000018008e50200020000001400020076657468305f746f5f62726964676500140002006e6574706369300700000000000000001400020076657468305f6d616376746170000000140002006d6163766c616e3100000000000000001400020064756d6d04300000000000000000000008000300a29368100730fad4a6cd50f495e4370135bc2b63860d0e50afeb5aed65770655653a2ea4484c065cd3b7b3ef64e14b4564d62676867b3b83617a", @ANYRES32=0x0, @ANYBLOB="08000100475d40b413a31bf99cf1d21ccfd4281d392cf9e49a82b0bdf6eed12d3d1d3a9ca31bcd454788564c0a6c26cd8edf3f336090d2efa48a7114dd778c0ff7698ed7626e6196c43790cf5333e8ade210c5411161f2a6402f5005000000", @ANYRES32=0x0, @ANYBLOB="200001800800030003000000140002007663616e3000000000000000000000000c00018008000300020000008000018008000100", @ANYRES32=0x0, @ANYBLOB="14000200766c616e31000000000000000000000008000300020000001400020069703667726574617030000000000000140002007465616d30000000000000000000000014000200766972745f77696669300000000000000800030001000000140002006261746164763000000000000000000038000180140002006970366772657461703000000000000008000300020000000800030003000000080003000100000008000300020000001400018008000100", @ANYRES32=r4, @ANYBLOB="0800030003000000"], 0x1c4}}, 0x54) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r2, &(0x7f0000000140), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) close(r6) io_setup(0x2, &(0x7f0000000140)=0x0) io_submit(r7, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x9}]) io_submit(r7, 0x0, &(0x7f0000000080)) io_uring_setup(0x9fd, &(0x7f0000000000)={0x0, 0x0, 0x7, 0x0, 0x2b6}) pipe(&(0x7f0000000200)) io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) [ 3492.322789][ T8942] XFS (loop5): realtime geometry sanity check failed [ 3492.335787][ T8942] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff 22:05:04 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) accept$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000200)=0x6e) r2 = dup(r1) mkdir(&(0x7f0000000280)='./file0\x00', 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r3, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f00000000c0)={0x0, 0xf5b3, 0x10001, r3, 0x0, &(0x7f0000000080)={0x99096a, 0x2, [], @string=&(0x7f0000000040)=0xc0}}) ioctl$HIDIOCGUCODE(r4, 0xc018480d, &(0x7f0000000140)={0x2, 0x1, 0x0, 0xc3ef, 0x4, 0x8}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0)='nl80211\x00') r6 = socket$tipc(0x1e, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000100)={0x24, r5, 0x11, 0x0, 0x1, {}, [@NL80211_ATTR_IFINDEX={0x8, 0x3, r7}, @NL80211_ATTR_IFINDEX={0x8}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000340), 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x1c, r5, 0x4, 0x70bd26, 0x25dfdbff, {}, [@NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000084}, 0xc014) read$midi(r3, &(0x7f0000000580)=""/4096, 0x1000) ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f0000000300)=0x1000) write$USERIO_CMD_REGISTER(r4, &(0x7f0000000100)={0x0, 0xa9}, 0x2) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm_plock\x00', 0x881, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3492.379017][ T8942] XFS (loop5): Unmount and run xfs_repair [ 3492.398995][ T8942] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3492.460307][ T8942] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3492.528400][ T8942] 00000010: 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3492.586129][ T8942] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3492.649055][ T8942] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3492.694926][ T8942] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3492.706885][ T8942] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3492.716651][ T8942] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3492.726629][ T8942] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3492.735940][ T8942] XFS (loop5): SB validate failed with error -117. 22:05:07 executing program 5: syz_mount_image$xfs(&(0x7f0000000100)='xfs\x00', &(0x7f0000000140)='./file0\x00', 0x5000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000000000000001000001e020000000000000000000000000034fb8fb9e4bf48b6ad26c597eb4f5c1900000000000000040000000000000d880000000040000d890000000000000d8a000000010000100000000001000000000000035ab424020004000004000000000000000000ec00000c090a020c", 0x7d}], 0x0, 0x0) 22:05:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000068", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) 22:05:07 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0xc) 22:05:07 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$PPPIOCSMRU(r2, 0x40047452, &(0x7f0000000000)=0xfffffffb) r3 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$can_bcm(0x1d, 0x2, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x9, &(0x7f0000000240)=0x0) connect$can_bcm(r4, &(0x7f0000000140), 0x10) io_submit(r5, 0x2, &(0x7f0000000080)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r4, &(0x7f0000000200)="0500000093c21faf16da39de706f646800580f02000000003f420f000000000000580f02000000003f420f000000000000ffffffff000000", 0x20000238}]) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) r9 = pidfd_getfd(0xffffffffffffffff, r6, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r9, 0x40082404, &(0x7f0000000040)=0x6) io_submit(r5, 0x2000000000000072, &(0x7f0000000080)) 22:05:07 executing program 1: r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r0, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x200, 0x20002) writev(r1, &(0x7f0000000540)=[{&(0x7f00000002c0)='K', 0x1}], 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="8000000010001fff000000000400000000000000", @ANYRES32=r0, @ANYBLOB="ed11060000000000340012800e0001006970366772657461700000002000028014000700fe880000000000000000000000000001060002000200000008000a00", @ANYRES32, @ANYRES64=r0, @ANYRES64=r1], 0x80}}, 0x4801) r2 = socket(0x10, 0x8000000000000003, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x8) 22:05:07 executing program 3: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x11b582, 0x0) [ 3494.809457][ T9047] md: md0 stopped. 22:05:07 executing program 3: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x11b582, 0x0) [ 3494.829630][ T9051] __nla_validate_parse: 8 callbacks suppressed [ 3494.829642][ T9051] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3494.847659][ T9047] md: md0 stopped. [ 3494.891014][ T2112] XFS (loop5): realtime geometry sanity check failed [ 3494.903305][ T2112] XFS (loop5): Metadata corruption detected at xfs_sb_read_verify+0x388/0x480, xfs_sb block 0xffffffffffffffff [ 3494.920859][ T2112] XFS (loop5): Unmount and run xfs_repair [ 3494.927751][ T2112] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 3494.937205][ T2112] 00000000: 58 46 53 42 00 00 10 00 00 00 00 00 00 00 10 00 XFSB............ [ 3494.947307][ T2112] 00000010: 00 1e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 3494.957462][ T2112] 00000020: 34 fb 8f b9 e4 bf 48 b6 ad 26 c5 97 eb 4f 5c 19 4.....H..&...O\. [ 3494.967625][ T2112] 00000030: 00 00 00 00 00 00 00 04 00 00 00 00 00 00 0d 88 ................ [ 3494.979294][ T2112] 00000040: 00 00 00 00 40 00 0d 89 00 00 00 00 00 00 0d 8a ....@........... [ 3494.982566][ T9071] md: md0 stopped. [ 3494.989205][ T2112] 00000050: 00 00 00 01 00 00 10 00 00 00 00 01 00 00 00 00 ................ [ 3495.002072][ T2112] 00000060: 00 00 03 5a b4 24 02 00 04 00 00 04 00 00 00 00 ...Z.$.......... [ 3495.011835][ T2112] 00000070: 00 00 00 00 00 ec 00 00 0c 09 0a 02 0c 00 00 00 ................ [ 3495.022390][ T9048] XFS (loop5): SB validate failed with error -117. 22:05:07 executing program 3: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f0000000040)=0x8001) ioctl$BLKPG(r0, 0x932, 0x0) 22:05:07 executing program 0: r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x1e1740, 0x0) ioctl$BLKPG(r0, 0x932, 0x0) [ 3495.099720][ T9051] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. 22:05:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000000000006c", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3495.195752][ T9079] md: md0 stopped. [ 3495.201618][ T9077] ------------[ cut here ]------------ [ 3495.209169][ T9077] WARNING: CPU: 0 PID: 9077 at drivers/md/md.c:7536 md_ioctl+0x3cc8/0x54a0 [ 3495.233763][ T9077] Kernel panic - not syncing: panic_on_warn set ... [ 3495.239473][ T9081] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3495.240389][ T9077] CPU: 0 PID: 9077 Comm: syz-executor.3 Not tainted 5.8.0-rc4-syzkaller #0 [ 3495.240426][ T9077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3495.240431][ T9077] Call Trace: [ 3495.240457][ T9077] dump_stack+0x18f/0x20d [ 3495.240553][ T9077] panic+0x2e3/0x75c [ 3495.279868][ T9077] ? __warn_printk+0xf3/0xf3 [ 3495.284467][ T9077] ? printk+0xba/0xed [ 3495.288456][ T9077] ? log_store.cold+0x16/0x16 [ 3495.293130][ T9077] ? __warn.cold+0x5/0x45 [ 3495.297466][ T9077] ? md_ioctl+0x3cc8/0x54a0 [ 3495.301976][ T9077] __warn.cold+0x20/0x45 [ 3495.306223][ T9077] ? md_ioctl+0x3cc8/0x54a0 [ 3495.310728][ T9077] report_bug+0x1bd/0x210 [ 3495.315078][ T9077] handle_bug+0x38/0x90 [ 3495.319237][ T9077] exc_invalid_op+0x13/0x40 [ 3495.323749][ T9077] asm_exc_invalid_op+0x12/0x20 [ 3495.328605][ T9077] RIP: 0010:md_ioctl+0x3cc8/0x54a0 [ 3495.333714][ T9077] Code: 00 00 00 e9 cb eb ff ff 48 8d 84 24 a0 00 00 00 48 89 44 24 08 e9 b0 e2 ff ff 41 bf f3 ff ff ff e9 38 c4 ff ff e8 e8 65 f0 fb <0f> 0b e9 ef d1 ff ff 44 89 4c 24 18 e8 d7 65 f0 fb 31 ff 44 89 f6 [ 3495.353320][ T9077] RSP: 0018:ffffc9001dfa7ba0 EFLAGS: 00010216 [ 3495.359397][ T9077] RAX: 000000000000826a RBX: 0000000000000932 RCX: ffffc9000ef70000 [ 3495.367375][ T9077] RDX: 0000000000040000 RSI: ffffffff85835418 RDI: 0000000000000007 [ 3495.375358][ T9077] RBP: ffff88821400c000 R08: 0000000000000000 R09: ffff88821400c02f [ 3495.383366][ T9077] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 3495.391351][ T9077] R13: ffff888217ce7180 R14: 0000000000000932 R15: 0000000000000001 [ 3495.399374][ T9077] ? md_ioctl+0x3cc8/0x54a0 [ 3495.403073][ T9081] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3495.403896][ T9077] ? add_new_disk+0x18a0/0x18a0 [ 3495.403916][ T9077] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3495.403941][ T9077] ? tomoyo_path_number_perm+0x244/0x4d0 [ 3495.403960][ T9077] ? tomoyo_execute_permission+0x470/0x470 [ 3495.403990][ T9077] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 3495.440584][ T9077] ? blkdev_common_ioctl+0x117/0x1760 22:05:07 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00000000001d0000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2800000010002508000000000000000000000074", @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00\r'], 0x28}}, 0x0) [ 3495.445967][ T9077] ? blk_ioctl_discard+0x310/0x310 [ 3495.451267][ T9077] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 3495.457170][ T9077] ? do_vfs_ioctl+0x27d/0x1090 [ 3495.461944][ T9077] ? generic_block_fiemap+0x60/0x60 [ 3495.467166][ T9077] ? selinux_inode_getsecctx+0x90/0x90 [ 3495.472626][ T9077] ? __might_fault+0x190/0x1d0 [ 3495.477402][ T9077] ? add_new_disk+0x18a0/0x18a0 [ 3495.482259][ T9077] blkdev_ioctl+0x255/0x6c0 [ 3495.486768][ T9077] ? blkdev_common_ioctl+0x1760/0x1760 [ 3495.492262][ T9077] ? __fget_files+0x294/0x400 [ 3495.494790][ T9089] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'. [ 3495.496949][ T9077] block_ioctl+0xf9/0x140 [ 3495.496966][ T9077] ? blkdev_fallocate+0x3f0/0x3f0 [ 3495.496981][ T9077] ksys_ioctl+0x11a/0x180 [ 3495.497000][ T9077] __x64_sys_ioctl+0x6f/0xb0 [ 3495.497028][ T9077] ? lockdep_hardirqs_on+0x6a/0xe0 [ 3495.497045][ T9077] do_syscall_64+0x60/0xe0 [ 3495.497061][ T9077] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 3495.497080][ T9077] RIP: 0033:0x45cba9 [ 3495.543843][ T9077] Code: Bad RIP value. [ 3495.547905][ T9077] RSP: 002b:00007f71f2406c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3495.556315][ T9077] RAX: ffffffffffffffda RBX: 00000000004e2800 RCX: 000000000045cba9 [ 3495.564294][ T9077] RDX: 0000000000000000 RSI: 0000000000000932 RDI: 0000000000000003 [ 3495.572289][ T9077] RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 [ 3495.580264][ T9077] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff [ 3495.588236][ T9077] R13: 000000000000022c R14: 00000000004c48c6 R15: 00007f71f24076d4 [ 3495.597744][ T9077] Kernel Offset: disabled [ 3495.604714][ T9077] Rebooting in 86400 seconds..