ffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:13 executing program 4:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
gettid()
process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = socket$inet6(0xa, 0x3, 0x6)
r3 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/ip6_flowlabel\x00')
sendfile(r2, r3, 0x0, 0x4000000000dc)

11:37:13 executing program 0:
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udplite(0xa, 0x2, 0x88)
sendmmsg$inet(r0, &(0x7f0000001540)=[{{&(0x7f0000000000)={0x2, 0x4e22, @loopback}, 0x10, 0x0, 0x0, &(0x7f0000000300)=[@ip_retopts={{0x18, 0x0, 0x7, {[@rr={0x7, 0x7, 0x7, [@private]}]}}}], 0x18}}], 0x1, 0x0)

11:37:14 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r1 = socket(0x2, 0x2, 0x0)
r2 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r2, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r2, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r2}, 0x64)
r3 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r1, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(0xffffffffffffffff, 0x406, r3)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, r0, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:14 executing program 2:
perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x0)
ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000000))
getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)

11:37:14 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x100000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:14 executing program 4:
r0 = socket$inet6(0xa, 0x80002, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x88884, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @dev}, 0x1c)
sendto$inet6(r0, &(0x7f00000009c0)="c7cfcaaa22e10542fca5c0195350f15147657e0bfc59d383a47190db88690e6fedc3040ab5809ae02a54cd429cc3338c5afa0c9dce3f91950d1f567f358ac21154159130e88cbb6c43197813b2f23f3e442f80877490b393408142ebcfea6821f543e5ee9e27032e2b75d78f1b79f5a6bb6f0645e267770ef7e8f3a92148091217450ce8581e54223eeb6486205a209bf1fe854d211c03f8c3140fc3979d824082990d119473d20e94f253c9621fac339560ae46cb24b88bf2d01559bb658e343257b90f233b81bc5c398be3bbddb23a1e", 0xffd6, 0xc001, 0x0, 0xffffffffffffff0c)
setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4)

11:37:14 executing program 0:
syz_emit_ethernet(0x4e, &(0x7f0000000040)={@multicast, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "000010", 0x18, 0x0, 0x0, @private1, @mcast2, {[@dstopts={0x0, 0x1, [], [@padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}]}}}}}, 0x0)

11:37:14 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clone(0x2000000000200500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x20000080000000, 0x0)
r0 = gettid()
syz_open_procfs(0x0, &(0x7f0000000500)='map_files\x00')
tkill(r0, 0x34)

[  757.414015][T15947] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based  firewall rule not found. Use the iptables CT target to attach helpers instead.
11:37:14 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r1 = socket(0x2, 0x2, 0x0)
r2 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r2, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r2, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r2}, 0x64)
r3 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r1, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(0xffffffffffffffff, 0x406, r3)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, r0, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:15 executing program 2:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clone(0x2000000000200500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x20000080000000, 0x0)
r0 = gettid()
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, 0x0)
tkill(r0, 0x34)
sync()

11:37:15 executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000002cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/220, 0xdc}}], 0x1, 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'\x00', 0xc205})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x1)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={0xffffffffffffffff, 0x0, 0x21, 0x0, &(0x7f0000000000)="3f006671d7af52f647750500080089ea010000000800f109a708f78293c8744e1a", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)
r1 = socket$inet(0x2, 0xa, 0x0)
ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x8955, &(0x7f0000000000)=0x2)
r2 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/arp\x00')
preadv(r2, &(0x7f00000017c0), 0x315, 0x0, 0x0)

11:37:15 executing program 0:
syz_emit_ethernet(0x7a, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6035266800448406000000000000000004000000000000aafe8000000000000000000000000000aa"], 0x0)

11:37:15 executing program 5:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000507000000000000000000000400", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x50, 0x10, 0x581, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0xc, 0xd}}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x50}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x50, 0x10, 0x581, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x1c, 0xf}}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x50}}, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$packet(0x11, 0x2, 0x300)
getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="200000001100251911b1000000000000100000", @ANYRES32=r7], 0x20}}, 0x0)

11:37:15 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x400000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:16 executing program 2:
prctl$PR_GET_ENDIAN(0x13, 0x0)
prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='//selinux\x00\x00\x01\x10=\x8f\xa2\xc7\x8b\x96|?\x16\xbf\xa1$\xe2\xf4\xa6t#M\xe0l\x0e<\x89\x8df\xa0m\x00\a\xbb\x84\xc2V\xff\xb0j\x06\x00\xba\x1a\xe7@\xab\xe2v\x8a\x97\x88\xd3\xa5\xeePb\x10\xf5\'\xc1\x01\xfew\xdfgCM>\xba\xc6\xe5\xa6\xac\xfa\xed\xdf;')
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
r1 = openat(r0, &(0x7f00000001c0)='./file0\x00', 0xc0242, 0x0)
openat(0xffffffffffffffff, 0x0, 0x0, 0x0)
write$FUSE_INIT(r1, &(0x7f0000000140)={0x50}, 0x50)
prctl$PR_SET_FP_MODE(0x2d, 0x0)
fallocate(r1, 0x11, 0x0, 0xdbfd)

[  758.471668][T15967] syz-executor.4 uses obsolete (PF_INET,SOCK_PACKET)
[  758.809686][T15980] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
11:37:16 executing program 0:
syz_emit_ethernet(0xa2, &(0x7f0000000800)={@dev, @random="7c6eaaabda45", @void, {@ipv4={0x800, @gre={{0x14, 0x4, 0x0, 0x0, 0x94, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @loopback, {[@ra={0x94, 0x4}, @ra={0x94, 0x4}, @ssrr={0x89, 0x3}, @ssrr={0x89, 0xf, 0x0, [@loopback, @broadcast, @multicast1]}, @ssrr={0x89, 0xf, 0x0, [@multicast2, @rand_addr, @empty]}, @rr={0x7, 0xf, 0x0, [@loopback, @dev, @private]}, @ra={0x94, 0x4}]}}}}}}, 0x0)

[  759.037698][T15992] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'.
11:37:16 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r1 = socket(0x2, 0x2, 0x0)
r2 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r2, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r2, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r2}, 0x64)
r3 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r1, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(0xffffffffffffffff, 0x406, r3)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, r0, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:16 executing program 4:
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttyS3\x00', 0x0, 0x0)
ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, "71b0f27aa5385482"})

11:37:16 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001})
write$tun(r0, &(0x7f00000019c0)={@void, @val, @mpls={[], @ipv4=@icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x2, 0x0, @private}, @timestamp={0x11, 0xe0}}}}, 0x32)

11:37:16 executing program 2:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x6d, 0x6d, 0x4, [@volatile, @datasec={0x0, 0x5, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}], "1d"}, @volatile, @restrict]}, {0x0, [0x0, 0x0]}}, 0x0, 0x8c}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

11:37:17 executing program 0:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x86a01780, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x11d, 0x11d, 0x4, [@volatile, @datasec={0x0, 0x5, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}], "1d"}, @volatile, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @restrict, @enum={0x0, 0x7, 0x0, 0x6, 0x4, [{}, {}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x13c}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x33)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

11:37:17 executing program 4:
syz_emit_ethernet(0x300506, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaa04aa00200000000086dd60b4090000000000fe80000000a800fbffe0000002ff0200002200000ad0469600000f2001883090127800c204"], 0x0)

11:37:17 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x1000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:17 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x0, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:17 executing program 2:
r0 = mq_open(&(0x7f0000000000)='eth0\x00', 0x0, 0x0, 0x0)
read(r0, 0x0, 0x0)

11:37:17 executing program 5:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, 0x0, 0x0)

11:37:17 executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
r3 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4800000010000507000000000000000000000400", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newlink={0x44, 0x10, 0x581, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x44}}, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x44, 0x10, 0x581, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9, 0x1, 'vlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x44}}, 0x0)

11:37:18 executing program 0:
sigaltstack(&(0x7f0000ff9000/0x4000)=nil, 0x0)

11:37:18 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffff85}]})
rt_sigtimedwait(0x0, 0x0, 0x0, 0x0)

[  761.038000][T16041] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
11:37:18 executing program 5:

[  761.241489][T16045] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.4'.
11:37:18 executing program 0:

11:37:18 executing program 4:

11:37:18 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:19 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x0, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

[  761.723372][   T28] audit: type=1326 audit(1599046639.162:36): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16055 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0xffff0000
11:37:19 executing program 5:

11:37:19 executing program 0:

11:37:19 executing program 4:

11:37:19 executing program 5:

[  762.310045][   T28] audit: type=1326 audit(1599046639.692:37): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=16055 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0xffff0000
11:37:19 executing program 2:

11:37:20 executing program 0:

11:37:20 executing program 4:

11:37:20 executing program 5:

11:37:20 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2040000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:20 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x0, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:20 executing program 2:

11:37:21 executing program 0:

11:37:21 executing program 5:

11:37:21 executing program 4:

11:37:21 executing program 2:

11:37:21 executing program 5:

11:37:22 executing program 0:

11:37:22 executing program 4:

11:37:22 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:22 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x3000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:22 executing program 2:

11:37:22 executing program 5:

11:37:22 executing program 0:

11:37:22 executing program 4:

11:37:23 executing program 2:

11:37:23 executing program 4:

11:37:23 executing program 5:

11:37:23 executing program 0:

11:37:23 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:23 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x4000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:23 executing program 2:

11:37:24 executing program 5:

11:37:24 executing program 0:

11:37:24 executing program 4:

11:37:24 executing program 2:
chdir(&(0x7f0000000000)='./file1\x00')
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x3e, &(0x7f0000000040)={'filter\x00', 0x33c}, &(0x7f0000000180)=0x360)
write$cgroup_type(0xffffffffffffffff, 0x0, 0x0)

11:37:24 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$bsg(0xffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x61c003, 0x4000000)

11:37:24 executing program 4:
perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffffffffffff8000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000500)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1000, 0xffffffffffffffff, 0x1f, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r0, 0x4, 0x42000)
sendmsg$ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="8704011e", @ANYRES16=0x0], 0x98}, 0x1, 0x0, 0x0, 0x10}, 0x44)
ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x7)
socket$nl_route(0x10, 0x3, 0x0)
r1 = inotify_init1(0x0)
r2 = inotify_init()
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000200)=0x10)
inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x80000000)
inotify_rm_watch(r1, 0x0)
perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x8000080102380, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7e, 0x1, 0x3}, 0x40)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@multicast1, @in=@multicast2}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe4)
ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000140))
bpf$MAP_CREATE(0x100000000000000, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r3, 0x0, [0x305f, 0xa, 0x300, 0x1800, 0x6000000]}, 0x2c)
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
r4 = socket(0x10, 0x803, 0x0)
getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14)

11:37:24 executing program 0:
syz_mount_image$msdos(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[])
chdir(&(0x7f0000000000)='./file1\x00')
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$9p(0xffffffffffffffff, 0x0, 0x0)
sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
write$P9_RFLUSH(0xffffffffffffffff, 0x0, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x48, 0x0, &(0x7f0000000180))
openat$procfs(0xffffff9c, 0x0, 0x0, 0x0)
r0 = socket$inet6(0xa, 0x3, 0xff)
connect$inet6(r0, &(0x7f0000000340)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xc}}}, 0x1c)
getsockopt$inet6_buf(r0, 0x29, 0x3d, &(0x7f00000000c0)=""/181, &(0x7f0000000040)=0xb5)

11:37:25 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, 0xffffffffffffffff)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:25 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x5000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:25 executing program 2:
perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0xab, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x5, &(0x7f0000000640)=@raw={'raw\x00', 0x8, 0x3, 0x1e4, 0x0, 0x118, 0x3e020005, 0x0, 0x188, 0x234, 0x1d0, 0x1d0, 0x234, 0x1d0, 0x5, 0x0, {[{{@ip={@multicast1=0xe0005100, @local, 0x0, 0x0, 'syzkaller0\x00', 'netpci0\x00'}, 0x0, 0x70, 0x98, 0x0, {0x300000000000000}}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00'}}, {{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'pptp\x00'}}}], {{[], 0x0, 0x70, 0x94}, {0x24}}}}, 0x240)
openat$vga_arbiter(0xffffff9c, 0x0, 0x0, 0x0)

11:37:25 executing program 4:
perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffffffffffff8000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000500)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1000, 0xffffffffffffffff, 0x1f, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r0, 0x4, 0x42000)
sendmsg$ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="8704011e", @ANYRES16=0x0], 0x98}, 0x1, 0x0, 0x0, 0x10}, 0x44)
ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x7)
socket$nl_route(0x10, 0x3, 0x0)
r1 = inotify_init1(0x0)
r2 = inotify_init()
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000200)=0x10)
inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x80000000)
inotify_rm_watch(r1, 0x0)
perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x8000080102380, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7e, 0x1, 0x3}, 0x40)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@multicast1, @in=@multicast2}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe4)
ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000140))
bpf$MAP_CREATE(0x100000000000000, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r3, 0x0, [0x305f, 0xa, 0x300, 0x1800, 0x6000000]}, 0x2c)
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
r4 = socket(0x10, 0x803, 0x0)
getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14)

11:37:25 executing program 5:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x36, 0x0, &(0x7f0000000180))
sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0)

11:37:25 executing program 0:
r0 = socket(0x10, 0x3, 0x0)
ioctl$sock_ipv6_tunnel_SIOCADDPRL(r0, 0x89f5, &(0x7f0000000140)={'syztnl0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @mcast1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}})

11:37:25 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, 0x0)
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:26 executing program 4:
perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffffffffffff8000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000500)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1000, 0xffffffffffffffff, 0x1f, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r0, 0x4, 0x42000)
sendmsg$ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="8704011e", @ANYRES16=0x0], 0x98}, 0x1, 0x0, 0x0, 0x10}, 0x44)
ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x7)
socket$nl_route(0x10, 0x3, 0x0)
r1 = inotify_init1(0x0)
r2 = inotify_init()
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000200)=0x10)
inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x80000000)
inotify_rm_watch(r1, 0x0)
perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x8000080102380, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7e, 0x1, 0x3}, 0x40)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@multicast1, @in=@multicast2}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe4)
ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000140))
bpf$MAP_CREATE(0x100000000000000, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r3, 0x0, [0x305f, 0xa, 0x300, 0x1800, 0x6000000]}, 0x2c)
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
r4 = socket(0x10, 0x803, 0x0)
getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14)

11:37:26 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58)
r1 = accept4(r0, 0x0, 0x0, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x0)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
sendto$unix(r1, &(0x7f0000000180), 0xfeed, 0x0, 0x0, 0x0)

11:37:26 executing program 5:
perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000240)='t\bnu\x8c\xc4', 0x0)
pwritev(r0, &(0x7f0000000340)=[{&(0x7f0000000380)="d5", 0x1}], 0x1, 0x881806, 0x0)
read(r0, &(0x7f0000000000)=""/30, 0xfffffe4c)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
fcntl$dupfd(r1, 0x0, r1)

11:37:27 executing program 4:
perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xffffffffffff8000}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000500)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1000, 0xffffffffffffffff, 0x1f, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(r0, 0x4, 0x42000)
sendmsg$ETHTOOL_MSG_EEE_SET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="8704011e", @ANYRES16=0x0], 0x98}, 0x1, 0x0, 0x0, 0x10}, 0x44)
ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x7)
socket$nl_route(0x10, 0x3, 0x0)
r1 = inotify_init1(0x0)
r2 = inotify_init()
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, &(0x7f00000001c0)={&(0x7f0000ffc000/0x2000)=nil, 0x2000}, &(0x7f0000000200)=0x10)
inotify_add_watch(r2, &(0x7f0000000000)='.\x00', 0x80000000)
inotify_rm_watch(r1, 0x0)
perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x8000080102380, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x7e, 0x1, 0x3}, 0x40)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000900)={{{@in=@multicast1, @in=@multicast2}}, {{@in=@dev}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe4)
ioctl$SG_EMULATED_HOST(0xffffffffffffffff, 0x2203, &(0x7f0000000140))
bpf$MAP_CREATE(0x100000000000000, &(0x7f0000214fd4)={0xc, 0x4, 0x4, 0x234, 0x0, r3, 0x0, [0x305f, 0xa, 0x300, 0x1800, 0x6000000]}, 0x2c)
ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d)
r4 = socket(0x10, 0x803, 0x0)
getsockname$packet(r4, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14)

11:37:27 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x6000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:27 executing program 0:
setresuid(0xee01, 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000001400)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="1800000017001f7000ca98040000008004000000040010"], 0x18}}, 0x0)
mkdir(&(0x7f0000000000)='./file0\x00', 0x86)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000200)='nl80211\x00')
getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private1, 0x9, 0x0, 0x2, 0x4, 0x0, 0x80}, 0x0)
pivot_root(&(0x7f0000000340)='./file0\x00', &(0x7f0000000080)='./file0\x00')
sigaltstack(&(0x7f0000ff9000/0x4000)=nil, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040000}, 0x40c1)
writev(r1, &(0x7f0000000500)=[{&(0x7f0000000280)='{', 0x1}], 0x1)
close(r1)
add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe)

11:37:27 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, 0x0)
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:28 executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000b00)={0x14, 0x17, 0x101, 0x0, 0x0, {0x1}}, 0x14}}, 0x0)
dup3(r0, r1, 0x0)

11:37:28 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = gettid()
socketpair(0x1e, 0x1, 0x0, &(0x7f0000000140)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$alg(r1, &(0x7f0000003240), 0x252da778b17d5c0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000013ff4)=@assoc_value, 0x0)
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x18, &(0x7f0000000100)=ANY=[@ANYRESDEC, @ANYRES32, @ANYRES32], 0x48)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
dup2(r5, 0xffffffffffffffff)
ioctl$int_in(r3, 0x5452, &(0x7f0000b28000)=0x6)
ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f00000000c0))
fcntl$setsig(r3, 0xa, 0x12)
poll(&(0x7f0000b2c000)=[{r4}], 0x2c, 0xffffffffffbffff8)
dup2(r3, r4)
fcntl$setown(r3, 0x8, r0)
tkill(r0, 0x16)

11:37:28 executing program 4:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x541b, 0x0)

11:37:29 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x6040000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:29 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, 0x0)
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:29 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0x21, 0x2, 0x2)
sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x80, &(0x7f0000001640)=[{&(0x7f0000000ac0)="ee", 0xff00}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040000002b24ec10064b6fb14bccedfb718aef932f3889d1fdda5b9134015a860f5878c37ffe36e1165d14d435be5b317c6c8189767d2f97879f07a715bb7c169f46933d9338f4ab0483696f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x548)
sched_setscheduler(0x0, 0x0, &(0x7f0000000380))

11:37:29 executing program 5:
perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ftruncate(0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8000fffffffe)
setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f00000000c0)=0xffffffffffffffff, 0x4)
prctl$PR_SET_DUMPABLE(0x4, 0x0)
syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000029000/0x18000)=nil, &(0x7f0000000200)=[@textreal={0x8, &(0x7f0000000000)="0f350f01fc260f54a2af970f01da66b92e0b00000f320fbd21f081a2b0001abe0fc799000066b99a09000066b80400000066ba000000003e3466f20f30", 0x3d}], 0x1, 0x5b, 0x0, 0x0)
open(&(0x7f0000000080)='.\x00', 0x0, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, 0x0)
kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff)
keyctl$get_persistent(0x16, 0x0, 0xfffffffffffffff9)
openat$nvram(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvram\x00', 0x0, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:30 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
rt_sigpending(0x0, 0x0)

11:37:30 executing program 4:
perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
msgsnd(0x0, &(0x7f0000001640)=ANY=[@ANYRESOCT], 0x1, 0x0)

11:37:30 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(0xffffffffffffffff, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:31 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x7000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:31 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
rt_sigpending(0x0, 0x0)

11:37:31 executing program 4:
clone(0x204100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$RDMA_NLDEV_CMD_SET(0xffffffffffffffff, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff)
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="850000006d00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c61612ba392176dd2963228e1d69ba7ea94c500dc4ef2fad96ed406f21caf593836d9ea2cfb0e60436e054258c4686b066707de94a4f4d5fc79c987d669f2b1faca0f9d9924be41a9169bdfaf16d1c0b153911b8dd7f165789c691de6eee84309e7a23c19a39484809539fca4e0b6ec015a7d55545a34effa077faa55c59e88254f54077f799bf1683537a8ea0244d35b213bda80cc172afd80e361bedd8b8cc57255a5e3d772b7958f91f5d822175ed60ab386d94af98af1da2b59525f8fe3b28d7e53c78fbfe5ab0251f347160ec8343e1494d3a63e57a154769453f6c0bb13b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f132a902e5111f2cc5e46ac1c60a9b10c074bfbcd4b09012175484135f0e519f0b1c4aaa026d570ecb5e8cddbed65ff76ff61c5552617fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c7f20072a5d00dc797e123bdc511d4c419a38fde2dd8595356c9b2492aaf1264d87c2e292c882834867bcd2b6e559d17879ff0c8ad943e392957b4f979ea17117a13201bafe4f0f6ea5a6c957ada0c54855107c49ab20d8a76678a996ec13eaa66580ae7b813071cbb17d9f37282462f03de147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca253cbc8edc8be05cc854583d4071bfc061c6a14507434eb54b6f43caea5c4bf690441974b155f5adc6825a3a3d5b754df23175e2ce8b03bf3e30000000000000000000000009addae00d6f4116c173ad6b379c4fa48171f9701e0c636c2eb9cc81d9a0bb936382f2aaec513266424643e9c329a6620484c5dd84dd943ea014c11b7d6856c7f73bf8cc4fde3cd2ec32511cf4acefc71a2696f3a9cf9636825b2eab5a85dbc6482d81f88a6c8ce6f662c"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0)
openat$nvram(0xffffffffffffff9c, &(0x7f0000000800)='/dev/nvram\x00', 0x0, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)

11:37:32 executing program 0:
socket$inet_smc(0x2b, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000), 0x4)
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snd/seq\x00', 0x2)
pwritev2(0xffffffffffffffff, 0x0, 0x0, 0x4, 0x0, 0xe)
fchdir(0xffffffffffffffff)
socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040))
r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000080)={0x0, <r2=>0x0})
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000000)={0x1ff}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0)
r3 = socket(0x0, 0x803, 0x0)
getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, 0x0, 0x0)
syz_open_dev$mouse(&(0x7f00000014c0)='/dev/input/mouse#\x00', 0x7ff, 0x0)

11:37:32 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(0xffffffffffffffff, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:32 executing program 4:
clone(0x204100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="850000006d00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c61612ba392176dd2963228e1d69ba7ea94c500dc4ef2fad96ed406f21caf593836d9ea2cfb0e60436e054258c4686b066707de94a4f4d5fc79c987d669f2b1faca0f9d9924be41a9169bdfaf16d1c0b153911b8dd7f165789c691de6eee84309e7a23c19a39484809539fca4e0b6ec015a7d55545a34effa077faa55c59e88254f54077f799bf1683537a8ea0244d35b213bda80cc172afd80e361bedd8b8cc57255a5e3d772b7958f91f5d822175ed60ab386d94af98af1da2b59525f8fe3b28d7e53c78fbfe5ab0251f347160ec8343e1494d3a63e57a154769453f6c0bb13b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f949c479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f132a902e5111f2cc5e46ac1c60a9b10c074bfbcd4b09012175484135f0e519f0b1c4aaa026d570ecb5e8cddbed65ff76ff61c5552617fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c7f20072a5d00dc797e123bdc511d4c419a38fde2dd8595356c9b2492aaf1264d87c2e292c882834867bcd2b6e559d17879ff0c8ad943e392957b4f979ea17117a13201bafe4f0f6ea5a6c957ada0c54855107c49ab20d8a76678a996ec13eaa66580ae7b813071cbb17d9f37282462f03de147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb5567e54d3504723177d356c4604b7a492ecec37e83efceefd7ca253cbc8edc8be05cc854583d4071bfc061c6a14507434eb54b6f43caea5c4bf690441974b155f5adc6825a3a3d5b754df23175e2ce8b03bf3e30000000000000000000000009addae00d6f4116c173ad6b379c4fa48171f9701e0c636c2eb9cc81d9a0bb936382f2aaec513266424643e9c329a6620484c5dd84dd943ea014c11b7d6856c7f73bf8cc4fde3cd2ec32511cf4acefc71a2696f3a9cf9636825b2eab5a85dbc6482d81f88a6c8ce6f662c"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48)
ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, r0, 0x0, 0x0, 0x0}, 0x30)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0)

11:37:32 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
rt_sigpending(0x0, 0x0)

11:37:32 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

[  775.717685][T16247] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:37:34 executing program 5:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x2bf, 0x0, 0x32}, 0x9c)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000000)=""/48, 0x30}, {&(0x7f0000000080)=""/253, 0xfd}], 0x2)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000005, 0x13, 0xffffffffffffffff, 0x0)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x118a8, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$phonet(0x23, 0x2, 0x1)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x220080, 0x0)
write$P9_RGETATTR(r1, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x2001, {0x20, 0x1, 0x7}, 0x20, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x400, 0x5, 0x7, 0x7, 0x3, 0x890, 0x6, 0x0, 0xd7fe, 0xfffffffffffffffa, 0x3, 0x1b, 0xfffffffffffff5b4, 0x3}}, 0xa0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000200)="fe", 0xc38}], 0x1)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000380)={0x3, 'erspan0\x00', {0xfffffeff}, 0xfff8})

11:37:34 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x8000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:34 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
rt_sigpending(0x0, 0x0)

11:37:34 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(0xffffffffffffffff, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:34 executing program 0:
r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x0, 0x105182)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r1=>0xffffffffffffffff})
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = memfd_create(0x0, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r3)
sendfile(r0, r0, 0x0, 0x24000000)

11:37:34 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r1 = socket(0x2, 0x2, 0x0)
r2 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r2, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r2, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r2}, 0x64)
r3 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r1, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r3)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, 0xffffffffffffffff, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:34 executing program 2:

11:37:34 executing program 0:

11:37:35 executing program 5:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x2bf, 0x0, 0x32}, 0x9c)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000000)=""/48, 0x30}, {&(0x7f0000000080)=""/253, 0xfd}], 0x2)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000005, 0x13, 0xffffffffffffffff, 0x0)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x118a8, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$phonet(0x23, 0x2, 0x1)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x220080, 0x0)
write$P9_RGETATTR(r1, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x2001, {0x20, 0x1, 0x7}, 0x20, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x400, 0x5, 0x7, 0x7, 0x3, 0x890, 0x6, 0x0, 0xd7fe, 0xfffffffffffffffa, 0x3, 0x1b, 0xfffffffffffff5b4, 0x3}}, 0xa0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000200)="fe", 0xc38}], 0x1)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000380)={0x3, 'erspan0\x00', {0xfffffeff}, 0xfff8})

11:37:35 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x8410100, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:35 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x2bf, 0x0, 0x32}, 0x9c)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000000)=""/48, 0x30}, {&(0x7f0000000080)=""/253, 0xfd}], 0x2)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000005, 0x13, 0xffffffffffffffff, 0x0)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x118a8, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$phonet(0x23, 0x2, 0x1)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x220080, 0x0)
write$P9_RGETATTR(r1, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x2001, {0x20, 0x1, 0x7}, 0x20, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x400, 0x5, 0x7, 0x7, 0x3, 0x890, 0x6, 0x0, 0xd7fe, 0xfffffffffffffffa, 0x3, 0x1b, 0xfffffffffffff5b4, 0x3}}, 0xa0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000200)="fe", 0xc38}], 0x1)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000380)={0x3, 'erspan0\x00', {0xfffffeff}, 0xfff8})

11:37:36 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:36 executing program 2:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x2bf, 0x0, 0x32}, 0x9c)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000000)=""/48, 0x30}, {&(0x7f0000000080)=""/253, 0xfd}], 0x2)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000005, 0x13, 0xffffffffffffffff, 0x0)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x118a8, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$phonet(0x23, 0x2, 0x1)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x220080, 0x0)
write$P9_RGETATTR(r1, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x2001, {0x20, 0x1, 0x7}, 0x20, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x400, 0x5, 0x7, 0x7, 0x3, 0x890, 0x6, 0x0, 0xd7fe, 0xfffffffffffffffa, 0x3, 0x1b, 0xfffffffffffff5b4, 0x3}}, 0xa0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000200)="fe", 0xc38}], 0x1)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000380)={0x3, 'erspan0\x00', {0xfffffeff}, 0xfff8})

11:37:36 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x2bf, 0x0, 0x32}, 0x9c)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000000)=""/48, 0x30}, {&(0x7f0000000080)=""/253, 0xfd}], 0x2)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000005, 0x13, 0xffffffffffffffff, 0x0)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x118a8, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$phonet(0x23, 0x2, 0x1)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x220080, 0x0)
write$P9_RGETATTR(r1, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x2001, {0x20, 0x1, 0x7}, 0x20, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x400, 0x5, 0x7, 0x7, 0x3, 0x890, 0x6, 0x0, 0xd7fe, 0xfffffffffffffffa, 0x3, 0x1b, 0xfffffffffffff5b4, 0x3}}, 0xa0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000200)="fe", 0xc38}], 0x1)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000380)={0x3, 'erspan0\x00', {0xfffffeff}, 0xfff8})

11:37:36 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r1 = socket(0x2, 0x2, 0x0)
r2 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r2, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r2, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r2}, 0x64)
r3 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r1, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r3)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, 0xffffffffffffffff, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:36 executing program 5:

11:37:36 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x9000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:37 executing program 5:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:37 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r1 = socket(0x2, 0x2, 0x0)
r2 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r2, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r2, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r2}, 0x64)
r3 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r4=>0x0)
io_submit(r4, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r1, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r3)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r5, 0xffffffffffffffff, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:38 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, 0x0, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:38 executing program 2:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:38 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xa000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:38 executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x2bf, 0x0, 0x32}, 0x9c)
readv(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000000)=""/48, 0x30}, {&(0x7f0000000080)=""/253, 0xfd}], 0x2)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000005, 0x13, 0xffffffffffffffff, 0x0)
bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @empty}, 0x1c)
sendto$inet6(r0, &(0x7f0000847fff)='X', 0x118a8, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$phonet(0x23, 0x2, 0x1)
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-monitor\x00', 0x220080, 0x0)
write$P9_RGETATTR(r1, &(0x7f00000002c0)={0xa0, 0x19, 0x1, {0x2001, {0x20, 0x1, 0x7}, 0x20, 0xffffffffffffffff, 0xffffffffffffffff, 0x4, 0x400, 0x5, 0x7, 0x7, 0x3, 0x890, 0x6, 0x0, 0xd7fe, 0xfffffffffffffffa, 0x3, 0x1b, 0xfffffffffffff5b4, 0x3}}, 0xa0)
writev(r0, &(0x7f0000000280)=[{&(0x7f0000000200)="fe", 0xc38}], 0x1)
ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000380)={0x3, 'erspan0\x00', {0xfffffeff}, 0xfff8})

[  782.480944][T16319] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
[  782.591573][T16337] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:37:40 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:40 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, 0x0, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:40 executing program 0:

11:37:40 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xb000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:40 executing program 0:

11:37:40 executing program 5:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:40 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, 0x0, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:41 executing program 0:

11:37:41 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xc000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  784.430108][T16361] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
[  784.485644][T16365] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:37:42 executing program 2:

11:37:42 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040), 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:42 executing program 0:

11:37:42 executing program 5:

11:37:42 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:42 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xd000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:43 executing program 2:

11:37:43 executing program 5:

11:37:43 executing program 0:

11:37:43 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040), 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:43 executing program 2:

11:37:43 executing program 0:

11:37:43 executing program 5:

11:37:44 executing program 0:

11:37:44 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:44 executing program 2:

[  787.542925][T16390] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:37:45 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:45 executing program 5:

11:37:45 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040), 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:45 executing program 2:

11:37:45 executing program 0:

11:37:45 executing program 5:

11:37:46 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x10000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:46 executing program 0:

11:37:46 executing program 2:

11:37:46 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0x0)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:46 executing program 5:

11:37:46 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000016c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
close(r0)

[  789.775678][T16429] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:37:47 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:47 executing program 2:
r0 = memfd_create(&(0x7f0000000100)='#\x00', 0x0)
write(r0, &(0x7f0000000040)="0600", 0x2)
write$FUSE_NOTIFY_STORE(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="40000000000025000400000005007c00000000000200280000000000d4e34ba67f6ebd451a22e4c4c83108206624ca7a4f9d38e1696f388922880f42e67dabb06565a16eb68ca2227b8f375a5282ff43ba0c2b77000000007da79288e04d05da00f45ebf560b26bbc8ff1a1aecab81fe6d383a064ea312ba66db4ce4948932585fc97ed370ddb2a3acadc69287b2e940ebea689162949f0e102da9edd02e3913d84945b63c430000000000003de33a904c0000000000000000005ddc15e483c01e3c563b6deb0aff50dc1a94bc77e3a92cd8839726d59c597a3ada769aba4c3a536905000000ad2b00008c6338e664951ee134cfb9c74adee399fb539f436d31c329397643a59440416540a52fe6e6780580cc8afedb2fde3f2ee1df7331dee6c4222ef20a956370e95637"], 0x1c)
sendfile(r0, r0, &(0x7f0000001000), 0xffff)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x80000000004, 0x11, r0, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f000001a000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f000002eff0)={0x1f0, &(0x7f0000000000)=[{}]}, 0x10)

11:37:47 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0x0)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:47 executing program 5:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x20000de, 0x2, 0x26832, 0xffffffffffffffff, 0x8000000)
syz_io_uring_submit(0x0, 0x0, 0x0, 0x0)
syz_io_uring_setup(0x4dbf, &(0x7f0000000140)={0x0, 0x0, 0x10, 0x2, 0x1c8}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x7000)=nil, &(0x7f00000001c0), &(0x7f0000000200))
openat$bsg(0xffffffffffffff9c, 0x0, 0x604000, 0x0)
syz_io_uring_setup(0x3cd1, &(0x7f0000000000), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000100))

11:37:47 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000016c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
close(r0)

11:37:47 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x11000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:47 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0x0)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511200000"], 0x68)

11:37:47 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000016c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
close(r0)

11:37:48 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$usbfs(&(0x7f0000000180)='/dev/bus/usb/00#/00#\x00', 0x77, 0x1)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFNL_MSG_ACCT_GET(r1, 0x0, 0x0)
fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000000)='#\t\\+&.\'\x00', 0x0, 0xffffffffffffff9c)
accept4$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, &(0x7f00000003c0)=0xffffff50, 0x80800)
ioctl$TIOCGICOUNT(0xffffffffffffffff, 0x545d, 0x0)
ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect)
process_vm_readv(0x0, &(0x7f0000000380)=[{&(0x7f0000000340)=""/61, 0x3d}], 0x1, &(0x7f0000002540)=[{&(0x7f00000003c0)=""/63, 0x7ffff002}], 0x2, 0x0)
openat$snapshot(0xffffffffffffff9c, 0x0, 0x4042, 0x0)
openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x0, 0x0)

11:37:48 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x68)

11:37:48 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000016c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = dup2(r2, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200)
close(r0)

11:37:48 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x12000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  793.008508][T16462] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:37:50 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000016c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
dup2(r2, r1)
close(r0)

11:37:50 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000280012000900010076657468"], 0x48}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000014c0)=ANY=[@ANYBLOB="38000000240007050000004007a2a30005000000", @ANYRES32=r2, @ANYBLOB="00000000ffffffff00000000090001006866736300000000080002"], 0x38}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0x8}}, [@filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x30, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_IPT_MATCH_NAME={0xb, 0x2, 'policy\x00'}, @TCA_EM_IPT_HOOK={0x8}]}}]}]}]}}]}, 0x64}}, 0x0)
r3 = socket(0x1000000010, 0x80002, 0x0)
sendmmsg$alg(r3, &(0x7f0000000200), 0x4924924924926d3, 0x0)

11:37:50 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:50 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x16010000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:50 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x68)

11:37:50 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$FBIOPUTCMAP(0xffffffffffffffff, 0x4611, 0x0)
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fb0\x00', 0x0, 0x0)
ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x101})

[  793.801868][T16498] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
[  794.319216][T16498] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'.
11:37:52 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000016c0))
close(r0)

11:37:52 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x17010000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:52 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x75, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_mount_image$msdos(&(0x7f0000000140)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0xffc00000, 0x1, &(0x7f0000000000)=[{&(0x7f0000000080)="eb3c906d6b66732e666174000404090a0200027400f801", 0x17}], 0x0, &(0x7f0000000200))

11:37:52 executing program 2:
r0 = socket$inet6(0xa, 0x802, 0x73)
setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f0000000040)=0x101, 0x33c)
sendmmsg$inet6(r0, &(0x7f00000035c0)=[{{&(0x7f0000000000)={0xa, 0x0, 0x10000, @local}, 0x1c, 0x0}}], 0x1, 0x0)

11:37:52 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, 0x0, 0x68)

11:37:52 executing program 2:
perf_event_open(&(0x7f00000012c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0x12, 0x7, 0x4, 0x3ff, 0x0, 0xffffffffffffffff, 0x0, [], 0x0, 0xffffffffffffffff, 0x0, 0x400000}, 0x40)

11:37:52 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(r0)

11:37:52 executing program 5:
r0 = socket$l2tp(0x2, 0x2, 0x73)
bind$l2tp(r0, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10)
r1 = socket$l2tp(0x2, 0x2, 0x73)
bind$l2tp(r1, &(0x7f0000000280)={0x2, 0x0, @loopback}, 0x10)
r2 = socket$l2tp(0x2, 0x2, 0x73)
bind$l2tp(r2, &(0x7f0000000000)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10)

[  796.317356][T16509] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:37:53 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:53 executing program 2:
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000440)={'syz', 0x3}, &(0x7f0000000480)="585ccbe4ed83b836c1a6474914dc55e72206297b6895b66147b3c7218a9169a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3bae96efb74b50ec93c152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018cea71fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e298a16324fe27da2a9d5ba9ff3c009d308bd73f47725398b", 0xc1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000180)="a4", 0x1, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000000)={r1, r0, r0}, &(0x7f0000000280)=""/250, 0xfa, &(0x7f0000000580)={&(0x7f0000000080)={'sha256-generic\x00'}})

11:37:53 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x68)

11:37:53 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x18010000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:53 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone3(&(0x7f0000002300)={0x1170c4400, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58)

11:37:53 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
close(r0)

[  797.030645][   T28] audit: type=1400 audit(1599046674.462:38): avc:  denied  { sys_admin } for  pid=16544 comm="syz-executor.5" capability=21  scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=cap_userns permissive=1
11:37:54 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
close(r0)

11:37:54 executing program 2:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
connect$inet(0xffffffffffffffff, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f00000000c0), 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x30, 0x0, &(0x7f0000000040))

11:37:54 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x68)

11:37:55 executing program 5:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
perf_event_open(&(0x7f0000000240)={0x2, 0x70, 0x4f, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_int(r0, &(0x7f0000000200), 0x400086)

11:37:55 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:55 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
close(r0)

11:37:56 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:56 executing program 2:
perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x8}, 0xc)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000100)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ff3000/0xd000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff8000/0x1000)=nil, &(0x7f00000001c0)="426376d9ba1d11fb320ffe6b77e9d9f04cd685c511f9a2b33629fce3db81d3278359724662201ba12f7151a32a8f5801ec388aceee991909f3a657b3334d060ef6e34652a08e9708dce46509a2f5ab8512c9b12bdd9698e6a4d24c77c2a4afadc7c444d0597fa9f5c06b12189fcff6865ca567ac2222a628b24360b5c9", 0x7d}, 0x68)
r1 = socket$bt_bnep(0x1f, 0x3, 0x4)
r2 = syz_open_dev$sndctrl(&(0x7f00000000c0)='/dev/snd/controlC#\x00', 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0)
r4 = ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4)
ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r4)
r5 = fcntl$dupfd(r2, 0x0, r1)
ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82)
fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f00000003c0)='/dev/loop-control\x00', 0x0, r5)
openat$cgroup_ro(r0, &(0x7f0000000280)='freezer.self_freezing\x00', 0x0, 0x0)
ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f0000000000)={0x21})
ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x80489439, &(0x7f0000000340))
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045540, &(0x7f0000000180)=0x9fc)

11:37:56 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x68)

11:37:56 executing program 5:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100000001e6c0000000000000000000a20000000000a01000000000000000000000000000900010073797a300000000038000000120a0105000000000000000000000000040004800900020000397d00000000000900010073797a30000000000800034000000001140000001100df"], 0x80}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f0000002c80)={0x0, 0x0, &(0x7f0000002c40)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x397159c7cfc62e5d}], {0x14}}, 0x3c}}, 0x0)

11:37:56 executing program 0:
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(0xffffffffffffffff)

11:37:56 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x20100000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:57 executing program 0:
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(0xffffffffffffffff)

11:37:57 executing program 5:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x6, 0x0)
connect$inet6(r0, &(0x7f0000419000)={0xa, 0x0, 0x0, @loopback}, 0x1c)

11:37:57 executing program 2:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='status\x00')
r1 = getpid()
rt_tgsigqueueinfo(r1, r1, 0x13, &(0x7f0000000180))
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ptrace(0x10, r1)
sendfile(r2, r0, 0x0, 0x10001ff)

[  800.564713][   T28] audit: type=1400 audit(1599046678.002:39): avc:  denied  { name_connect } for  pid=16610 comm="syz-executor.5" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=dccp_socket permissive=1
11:37:58 executing program 0:
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(0xffffffffffffffff)

11:37:58 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x22000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:37:58 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x68)

[  801.570947][T16629] ptrace attach of "/root/syz-executor.2"[16613] was attempted by "/root/syz-executor.2"[16629]
11:37:59 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:37:59 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(r0)

11:37:59 executing program 5:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_emit_ethernet(0x4a, &(0x7f0000000100)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="00c60000"], 0x0)
writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff06000000010000004500000025000000190004000400000007fd17e5ffff0606040000000000000000", 0x39}], 0x1)
ioctl$sock_SIOCGSKNS(0xffffffffffffffff, 0x894c, 0x0)
sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40800000}, 0xc, &(0x7f0000000280)={0x0, 0x2c}}, 0x0)

11:37:59 executing program 2:
r0 = socket$inet(0x2, 0x2000080001, 0x84)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @empty}, 0x10)
sendmsg(r0, &(0x7f000001afc8)={&(0x7f0000006000)=@in={0x2, 0x4e20, @loopback}, 0x80, &(0x7f0000007f80)=[{&(0x7f00000001c0)='*', 0x1a000}], 0x1}, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x40400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
recvmmsg(r0, &(0x7f0000000100)=[{{0x0, 0x32a, &(0x7f0000000440)=[{&(0x7f00000015c0)=""/4096, 0xfffc}], 0x1}}], 0xffffff1f, 0x0, 0x0)

11:37:59 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x68)

11:37:59 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x25000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  802.603000][T16644] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
[  802.648171][T16644] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready
[  802.975248][T16650] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
11:38:00 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(r0)

11:38:00 executing program 5:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_emit_ethernet(0x4a, &(0x7f0000000100)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="00c60000"], 0x0)
writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)="390000001300034700bb65e1c3e4ffff06000000010000004500000025000000190004000400000007fd17e5ffff0606040000000000000000", 0x39}], 0x1)
ioctl$sock_SIOCGSKNS(0xffffffffffffffff, 0x894c, 0x0)
sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40800000}, 0xc, &(0x7f0000000280)={0x0, 0x2c}}, 0x0)

11:38:01 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/mixer\x00', 0x0, 0x0)
ioctl$SNDCTL_DSP_STEREO(r0, 0xc0045003, &(0x7f00000004c0))

11:38:01 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x2f000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:01 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x68)

11:38:01 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(r0)

[  804.824199][T16677] netlink: 'syz-executor.5': attribute type 4 has an invalid length.
11:38:02 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:02 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(r0)

11:38:02 executing program 2:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x10, 0x80002, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000200)={'sit0\x00', 0x0})

11:38:02 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739"], 0x68)

11:38:02 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x3f000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:02 executing program 5:
bpf$PROG_LOAD(0x5, 0x0, 0x0)
perf_event_open(&(0x7f0000000640)={0x2, 0x70, 0x78, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000180)={0x0, 0x8782559fc2aff2e2, &(0x7f0000000080)=[{&(0x7f0000000040)="2e28030026000511d25a80648c63940d0424fc60100016400a0002000200000037153e370a00118004000000d1bd", 0x33fe0}], 0x1}, 0x0)

11:38:02 executing program 2:
perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80800)
pwrite64(0xffffffffffffffff, &(0x7f0000000100)="10f7f100c7892375c83b55466aa65a2f5dd946007a5231a183a34370d8628ed4403fc77b2ef65a451646cbc7fb74cffed58ea699c2157d94ba19446b9e557a5eddd68ae60b80ef7495097714f6007eb13340744841e9b0161870871b67a06ac9227bcea67e838b45d108d21d33659dd0e134232b66851bac4af734c44f24ed7e25ab95a135268a54", 0x88, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sha384-ssse3\x00'}, 0x58)
r1 = accept4(r0, 0x0, 0x0, 0x0)
sendmmsg$unix(r1, &(0x7f0000001300)=[{&(0x7f0000000980)=@file={0x0, './file0/file0\x00'}, 0x6e, &(0x7f0000000dc0), 0x87, &(0x7f0000000200), 0x303}], 0x8d9, 0x0)
write$P9_RLERRORu(0xffffffffffffffff, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

11:38:02 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(r0)

11:38:03 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739"], 0x68)

11:38:03 executing program 5:
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000006c0)=ANY=[@ANYBLOB="b702000028000000bfa30000000000000703000000fe3f007a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000001404000001007d60b7030000000000006a0a00fe00000000850000001f000000b70000000000000095000000000000006623848adf1dd9a764ab51ae64e0ff0ca327ab62931d7245861531fddf01220b0071ff31f1622271d5518193e09483c5a020ff34f8c76334d8ce8205b01ddaa54d8756ad0f50f2568836077b8471b6b69819782748b376358c33c9753bfd989b1ca58949a54d5827df14feecea46a5c53e9c37251709f1061b973ef07bf7f53ce129a9ecd3b4dd15100f2b452f98526a0d8cacfb6379b4c5008652a7b4c0974486a8d203bddc62bb2d555a363adbc33b49e13fbd1757b2701acad0e2684120b99b8cff3f48c90000000000000003b290feb3045aef0d6c169e331b622f20c41d8418bc4159c14025422835e81c6c73af77dbaeb07913476244ffd5b5a9e7a73f148ae8206afe120c143749b5992e89f460332eb7c9e89aafc50e7806000000b17f342aab5104d18e4eb69122b42f2173184c1d0fb3287c99b645f6e80e14e5d7c95a1babcc61b61bfaf421b18b9934f0f434c49684c31fddf24ed97d13fad01f3f060000005e34fcc500"/491], &(0x7f0000000340)='syzkaller\x00'}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0xe, 0x0, &(0x7f0000000400)="3d6ee2e04b91ab10143d9bbe86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)

11:38:03 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(r0)

11:38:04 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x40000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  807.360181][T16687] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:38:05 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

11:38:05 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739"], 0x68)

11:38:05 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:05 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0)
close(r0)

11:38:05 executing program 5:
r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = gettid()
r2 = gettid()
kcmp(r1, r2, 0x0, r0, 0xffffffffffffffff)

11:38:05 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0)
close(r0)

11:38:05 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x40000800, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:05 executing program 5:
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x141001)
syz_open_dev$binderN(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vim2m\x00', 0x2, 0x0)
r1 = dup(r0)
write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, 0x0)
pselect6(0x40, &(0x7f00000003c0), 0x0, &(0x7f0000000000)={0x1ff}, &(0x7f0000000200), 0x0)

11:38:06 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:06 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005"], 0x68)

11:38:06 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, 0x0, 0x0)
close(r0)

11:38:06 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:07 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

11:38:07 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005"], 0x68)

11:38:07 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x48000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:07 executing program 5:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0)

11:38:07 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), 0x8)
close(r0)

11:38:07 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:08 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), 0x8)
close(r0)

11:38:08 executing program 5:
perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$set_timeout(0x15, r0, 0x0)

11:38:08 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005"], 0x68)

11:38:08 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
writev(0xffffffffffffffff, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:09 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), 0x8)
close(r0)

11:38:09 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x4c000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:10 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

11:38:10 executing program 5:

11:38:10 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
writev(0xffffffffffffffff, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:10 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(0xffffffffffffffff)

11:38:10 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66"], 0x68)

11:38:10 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x50b3bdff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:10 executing program 5:

11:38:10 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(0xffffffffffffffff)

11:38:11 executing program 2:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
writev(0xffffffffffffffff, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:11 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66"], 0x68)

11:38:11 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)
setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000)={0x5}, 0x8)
close(0xffffffffffffffff)

11:38:11 executing program 5:

11:38:12 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:12 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:12 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x5c000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:12 executing program 0:

11:38:12 executing program 5:

11:38:12 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:12 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66"], 0x68)

11:38:12 executing program 0:

11:38:12 executing program 5:

11:38:13 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:13 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x60000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:13 executing program 0:

11:38:16 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:16 executing program 5:

11:38:16 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511"], 0x68)

11:38:16 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:16 executing program 0:

11:38:16 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x68000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:16 executing program 5:

11:38:17 executing program 2:
socket$netlink(0x10, 0x3, 0x4)
writev(0xffffffffffffffff, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:17 executing program 0:

11:38:17 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511"], 0x68)

11:38:17 executing program 0:

11:38:17 executing program 5:

11:38:18 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:18 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x6c000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:18 executing program 2:
socket$netlink(0x10, 0x3, 0x4)
writev(0xffffffffffffffff, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:18 executing program 0:

11:38:18 executing program 5:

11:38:18 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c6511"], 0x68)

11:38:18 executing program 5:

11:38:19 executing program 0:

11:38:19 executing program 2:
socket$netlink(0x10, 0x3, 0x4)
writev(0xffffffffffffffff, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff000000000000000007", 0x58}], 0x1)

11:38:19 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, 0x0, 0x0)

11:38:19 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x74000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:20 executing program 5:

11:38:22 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

11:38:22 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c65112000"], 0x68)

11:38:22 executing program 0:

11:38:22 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, 0x0, 0x0)

11:38:22 executing program 5:

11:38:22 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x7a000000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:23 executing program 0:

11:38:23 executing program 5:

11:38:23 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, 0x0, 0x0)

11:38:24 executing program 5:

11:38:24 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x8cffffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:24 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740), 0x0)

11:38:25 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

11:38:25 executing program 0:

11:38:25 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c65112000"], 0x68)

11:38:25 executing program 5:

11:38:25 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740), 0x0)

11:38:25 executing program 5:

11:38:25 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740), 0x0)

11:38:25 executing program 0:

11:38:26 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x97ffffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:26 executing program 3:
r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000440)='pagemap\x00')
r2 = socket(0x2, 0x2, 0x0)
r3 = openat$bsg(0xffffff9c, &(0x7f0000000080)='/dev/bsg\x00', 0x0, 0x0)
write$P9_RREADDIR(r3, &(0x7f0000000600)=ANY=[], 0x68)
shutdown(r3, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000602000/0x2000)=nil, &(0x7f0000603000/0x3000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000605000/0x1000)=nil, &(0x7f0000601000/0x1000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000604000/0x3000)=nil, &(0x7f0000601000/0x12000)=nil, &(0x7f0000602000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f000060f000/0x1000)=nil, &(0x7f0000000180)="1d1b3910b3a344e97a48cb647f7cc2385d5e467243f41c1e88f86beb5cbe54679273205b5c7b8eab42978a42cdd74ea2b04c88774810adfbac9cf0cbb6c830af7eba92c5011e3c766282412974431d0ea18fc84b8a8e382683804c99e22367c90e03bbfa0500e81142d8cf31da03ccbd36e1f24c4e1142a469c57801924933ff8fa7d0f47ce9af4e5ac62f31437467b5b8c2142f9538551a", 0x98, r3}, 0x64)
r4 = syz_open_dev$ptys(0xc, 0x3, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
fcntl$setstatus(0xffffffffffffffff, 0x4, 0x44000)
io_setup(0x5, &(0x7f0000000180)=<r5=>0x0)
io_submit(r5, 0x2, &(0x7f0000000540)=[&(0x7f00000000c0)={0x960101df, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x200a00}])
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000240)={'team_slave_1\x00'})
ioctl$sock_SIOCDELRT(r2, 0x890b, &(0x7f0000000340)={0x0, @in={0x2, 0x0, @private}, @in={0x2, 0x0, @dev}, @sco, 0x5e})
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0)
fcntl$dupfd(r0, 0x406, r4)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f0000000000))
sendfile(r6, r1, &(0x7f0000000040)=0x100060, 0xa808)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="6800000029000000000000000007002e2f66696c65cd45fd67994739e0e6100000000000000000000005005407002e2f66696c65112000"], 0x68)

11:38:26 executing program 5:

11:38:26 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{0x0}], 0x1)

11:38:27 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r1, 0xae80, 0x0)

11:38:27 executing program 0:

11:38:27 executing program 5:

11:38:27 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{0x0}], 0x1)

11:38:27 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xc0ed0000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:27 executing program 3:

11:38:28 executing program 0:

11:38:28 executing program 5:

11:38:28 executing program 3:

11:38:28 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{0x0}], 0x1)

11:38:29 executing program 5:

11:38:29 executing program 3:

11:38:29 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:29 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)}], 0x1)

11:38:29 executing program 0:

11:38:29 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe0f5e1e2, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:29 executing program 3:

11:38:29 executing program 5:

11:38:29 executing program 0:

11:38:29 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)}], 0x1)

11:38:30 executing program 3:

11:38:30 executing program 5:

11:38:30 executing program 0:

11:38:30 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)}], 0x1)

11:38:31 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:31 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe2e1f5e0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:31 executing program 3:

11:38:31 executing program 5:

11:38:31 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324ca", 0x2c}], 0x1)

11:38:31 executing program 0:

11:38:31 executing program 5:

11:38:31 executing program 3:

11:38:31 executing program 0:

11:38:31 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324ca", 0x2c}], 0x1)

11:38:32 executing program 5:

11:38:32 executing program 3:

11:38:32 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
stat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000800))
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:32 executing program 0:

11:38:32 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324ca", 0x2c}], 0x1)

11:38:32 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe6080000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:32 executing program 5:

11:38:32 executing program 3:

11:38:33 executing program 3:

11:38:33 executing program 0:

11:38:33 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c60000", 0x42}], 0x1)

11:38:33 executing program 5:

11:38:34 executing program 3:

11:38:34 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c60000", 0x42}], 0x1)

11:38:34 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:34 executing program 0:

11:38:34 executing program 5:

11:38:34 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe7020000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:34 executing program 3:

11:38:34 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c60000", 0x42}], 0x1)

11:38:35 executing program 0:

11:38:35 executing program 5:

11:38:35 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f", 0x4d}], 0x1)

11:38:35 executing program 3:

11:38:35 executing program 5:

11:38:35 executing program 3:

[  838.367480][T17057] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:38:36 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:36 executing program 0:

11:38:36 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f", 0x4d}], 0x1)

11:38:36 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe7080000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:36 executing program 3:

11:38:36 executing program 5:

11:38:36 executing program 3:

11:38:36 executing program 0:

11:38:36 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f", 0x4d}], 0x1)

11:38:36 executing program 5:

11:38:37 executing program 3:

11:38:37 executing program 0:

[  840.660627][T17079] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:38:38 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:38 executing program 5:

11:38:38 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff00000000", 0x53}], 0x1)

11:38:38 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe8020000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:38 executing program 3:

11:38:38 executing program 0:

11:38:38 executing program 3:

11:38:38 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff00000000", 0x53}], 0x1)

11:38:38 executing program 5:

11:38:39 executing program 0:

11:38:39 executing program 3:

11:38:39 executing program 5:

[  843.369533][T17103] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:38:41 executing program 4:
getpid()
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:41 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xe9020000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:41 executing program 5:

11:38:41 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff00000000", 0x53}], 0x1)

11:38:41 executing program 0:

11:38:41 executing program 3:

11:38:41 executing program 3:

11:38:41 executing program 0:

11:38:41 executing program 5:

11:38:42 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff00000000000000", 0x56}], 0x1)

11:38:42 executing program 4:
getpid()
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:42 executing program 5:

11:38:42 executing program 0:

11:38:42 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xf6ffffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:42 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff00000000000000", 0x56}], 0x1)

11:38:42 executing program 3:

11:38:43 executing program 5:

11:38:43 executing program 4:
getpid()
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:43 executing program 0:

11:38:43 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff00000000000000", 0x56}], 0x1)

11:38:43 executing program 3:

11:38:43 executing program 5:

11:38:44 executing program 0:

11:38:44 executing program 4:
sched_setscheduler(0x0, 0x5, &(0x7f0000000380))
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:44 executing program 3:

11:38:44 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xf8be0200, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:44 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff0000000000000000", 0x57}], 0x1)

11:38:44 executing program 5:

11:38:44 executing program 3:

11:38:44 executing program 0:

11:38:44 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff0000000000000000", 0x57}], 0x1)

11:38:44 executing program 5:

11:38:45 executing program 3:

11:38:45 executing program 0:

11:38:45 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x4)
writev(r0, &(0x7f0000001740)=[{&(0x7f0000000480)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e4220f0000040100801324cabecc4b38945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff0000000000000000", 0x57}], 0x1)

11:38:46 executing program 4:
sched_setscheduler(0x0, 0x5, &(0x7f0000000380))
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:46 executing program 5:

11:38:46 executing program 3:

11:38:46 executing program 0:

11:38:46 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xf9fdffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:46 executing program 2:

11:38:46 executing program 5:

11:38:46 executing program 0:

11:38:46 executing program 2:

11:38:46 executing program 3:

11:38:46 executing program 5:

11:38:47 executing program 2:

11:38:47 executing program 4:
sched_setscheduler(0x0, 0x5, &(0x7f0000000380))
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:47 executing program 3:

11:38:47 executing program 0:

11:38:47 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfbffffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:47 executing program 5:

11:38:47 executing program 2:

11:38:47 executing program 3:

11:38:47 executing program 0:

11:38:47 executing program 5:

11:38:47 executing program 2:

11:38:48 executing program 0:

11:38:48 executing program 5:

11:38:48 executing program 4:
getpid()
sched_setscheduler(0x0, 0x5, &(0x7f0000000380))
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:48 executing program 3:

11:38:48 executing program 2:

11:38:48 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfdfdffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:48 executing program 0:

11:38:48 executing program 5:

11:38:49 executing program 0:

11:38:49 executing program 5:

11:38:49 executing program 2:

11:38:49 executing program 3:

11:38:50 executing program 5:

11:38:50 executing program 2:

11:38:50 executing program 4:
getpid()
sched_setscheduler(0x0, 0x5, &(0x7f0000000380))
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:50 executing program 0:

11:38:50 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfdffffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:50 executing program 3:

11:38:50 executing program 5:

11:38:50 executing program 2:

11:38:50 executing program 0:

11:38:50 executing program 3:

11:38:50 executing program 5:

11:38:51 executing program 2:

11:38:51 executing program 0:

11:38:51 executing program 3:

11:38:52 executing program 4:
getpid()
sched_setscheduler(0x0, 0x5, &(0x7f0000000380))
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:38:52 executing program 5:

11:38:52 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xff0f0000, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:52 executing program 2:

11:38:52 executing program 3:

11:38:52 executing program 0:

11:38:52 executing program 3:

11:38:52 executing program 0:

11:38:52 executing program 2:

11:38:52 executing program 5:

11:38:53 executing program 0:

11:38:53 executing program 3:

11:38:53 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, &(0x7f0000000380))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:53 executing program 5:

11:38:53 executing program 2:

11:38:53 executing program 0:

11:38:53 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xffbdb350, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:53 executing program 3:

11:38:53 executing program 0:

11:38:53 executing program 5:

11:38:54 executing program 2:

11:38:54 executing program 3:

[  856.697923][T17289] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:38:54 executing program 0:

11:38:54 executing program 5:

11:38:55 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:55 executing program 3:

11:38:55 executing program 2:

11:38:55 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfffffdf9, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:55 executing program 0:

11:38:55 executing program 5:

11:38:55 executing program 2:

11:38:55 executing program 3:

11:38:55 executing program 5:

11:38:55 executing program 0:

11:38:55 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:56 executing program 2:

11:38:56 executing program 3:

11:38:56 executing program 5:

11:38:56 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfffffdfd, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:56 executing program 0:

[  859.051707][T17323] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:38:56 executing program 2:

11:38:56 executing program 3:

11:38:57 executing program 5:

11:38:57 executing program 2:

11:38:57 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x1}]}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0xc53}]}, 0x40}}, 0x0)

11:38:57 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:57 executing program 3:

11:38:57 executing program 5:

11:38:58 executing program 2:

11:38:58 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xffffff7f, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:58 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:58 executing program 0:

11:38:58 executing program 3:

11:38:58 executing program 5:

11:38:58 executing program 2:

11:38:58 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:38:58 executing program 0:

11:38:58 executing program 3:

11:38:59 executing program 5:

11:38:59 executing program 0:

11:38:59 executing program 2:

11:38:59 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xffffff8c, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:38:59 executing program 5:

11:38:59 executing program 3:

11:38:59 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:00 executing program 2:

11:39:00 executing program 0:

11:39:00 executing program 3:

11:39:00 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:00 executing program 5:

11:39:00 executing program 2:

11:39:01 executing program 0:

11:39:01 executing program 3:

11:39:01 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xffffff97, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:01 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:01 executing program 5:

11:39:01 executing program 2:

11:39:01 executing program 0:

11:39:01 executing program 3:

11:39:02 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:39:02 executing program 5:

11:39:02 executing program 2:

11:39:02 executing program 3:

11:39:02 executing program 0:

11:39:02 executing program 5:

11:39:02 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfffffff6, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:03 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:39:03 executing program 3:

11:39:03 executing program 2:

11:39:03 executing program 0:

11:39:03 executing program 5:

11:39:03 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:39:03 executing program 3:

11:39:04 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfffffffb, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:05 executing program 0:

11:39:05 executing program 5:

11:39:05 executing program 3:

11:39:05 executing program 2:

11:39:05 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:06 executing program 0:

11:39:06 executing program 5:

11:39:06 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xfffffffd, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:06 executing program 2:

11:39:06 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:06 executing program 3:

11:39:06 executing program 5:

11:39:06 executing program 0:

11:39:07 executing program 2:

11:39:07 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:07 executing program 3:

11:39:07 executing program 5:

11:39:07 executing program 0:

11:39:07 executing program 2:

11:39:07 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0xffffffff, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:07 executing program 3:

11:39:07 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:08 executing program 5:

11:39:08 executing program 0:

11:39:08 executing program 2:

11:39:08 executing program 3:

11:39:08 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:08 executing program 5:

11:39:09 executing program 0:

11:39:09 executing program 2:

11:39:09 executing program 3:

11:39:09 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:09 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:09 executing program 5:

11:39:09 executing program 0:

11:39:09 executing program 2:

11:39:09 executing program 3:

11:39:10 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:10 executing program 5:

[  872.701264][T17504] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:10 executing program 0:

11:39:10 executing program 5:

[  872.926695][T17504] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:10 executing program 2:

11:39:10 executing program 3:

11:39:10 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:10 executing program 5:

11:39:10 executing program 0:

11:39:10 executing program 3:

[  873.546355][T17521] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:11 executing program 2:

[  873.701651][T17521] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:11 executing program 5:

11:39:11 executing program 0:

11:39:11 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x3, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:11 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:11 executing program 2:

11:39:11 executing program 3:

11:39:12 executing program 5:

[  874.588191][T17536] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:12 executing program 0:

[  874.768414][T17536] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:12 executing program 5:

11:39:12 executing program 3:

11:39:12 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x4, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:12 executing program 2:

11:39:12 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:12 executing program 0:

11:39:12 executing program 3:

11:39:12 executing program 5:

[  875.493644][T17557] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:13 executing program 2:

[  875.732322][T17557] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:13 executing program 0:

11:39:13 executing program 0:

11:39:13 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x5, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:13 executing program 5:

11:39:13 executing program 3:

11:39:13 executing program 2:

11:39:13 executing program 0:

11:39:14 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

[  876.548785][T17577] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:14 executing program 3:

11:39:14 executing program 0:

[  876.698103][T17577] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:14 executing program 5:

11:39:14 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:14 executing program 2:

11:39:14 executing program 0:

11:39:14 executing program 3:

11:39:14 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:14 executing program 2:

[  877.419897][T17596] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:14 executing program 5:

11:39:15 executing program 0:

[  877.599615][T17596] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:15 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x7, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:15 executing program 0:

11:39:15 executing program 3:
r0 = open(&(0x7f0000000000)='./file0\x00', 0x80000000000206, 0x0)
preadv(r0, &(0x7f0000000340)=[{&(0x7f0000000100)=""/147, 0x93}], 0x1, 0x0, 0x0)
fstat(r0, &(0x7f0000000500))

11:39:15 executing program 2:
open$dir(&(0x7f0000001240)='./file0\x00', 0x40000400000002c2, 0x0)
openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0)
r0 = socket(0x2, 0x10000001, 0x0)
r1 = socket(0x1c, 0x10000001, 0x84)
setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x1203, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYRES64=r0], 0x3ef)
sendmsg$inet_sctp(r1, &(0x7f0000000440)={&(0x7f0000000800)=@in6={0x1c, 0x1c, 0x1}, 0x1c, &(0x7f0000001800)=[{&(0x7f0000000040)='3', 0x1}], 0x1}, 0x0)

11:39:15 executing program 5:
r0 = socket$inet6_sctp(0x1c, 0x5, 0x84)
r1 = socket$inet6_sctp(0x1c, 0x5, 0x84)
r2 = dup2(r1, r1)
setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x31, 0x0, 0x0)
dup2(r0, r2)

11:39:15 executing program 0:
getrlimit(0x0, &(0x7f0000000080))
r0 = socket$inet6_sctp(0x1c, 0x1, 0x84)
r1 = fcntl$dupfd(r0, 0x0, r0)
setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x24, &(0x7f0000000000), 0xfe6a)
sendto(r1, 0x0, 0x0, 0x0, &(0x7f0000000140)=@in6={0x1c, 0x1c, 0x3}, 0x1c)

[  878.270527][T17613] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  878.409418][T17613] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:16 executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r0, &(0x7f0000000300)={0x10, 0x2}, 0x10)
connect$inet(r0, &(0x7f0000000000)={0x10, 0x2}, 0x10)
setsockopt$inet_sctp_SCTP_RESET_ASSOC(r0, 0x84, 0x902, &(0x7f0000000700), 0x4)

11:39:16 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x8, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:16 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, 0x0)
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:16 executing program 2:
open(&(0x7f00000000c0)='./file0\x00', 0x80000000000209, 0x0)
r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0)
close(r0)
r1 = socket$inet6_sctp(0x1c, 0x5, 0x84)
connect$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c)
r2 = dup2(r1, r1)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x105, &(0x7f00000016c0)=ANY=[@ANYBLOB="02fffffe", @ANYRES32=<r3=>0x0], &(0x7f0000001700)=0x8)
setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000019280)=ANY=[@ANYBLOB="001c4e230000000000000000000000000000ffff7f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600"/128, @ANYRES32=r3], 0x9a)

11:39:16 executing program 0:
r0 = socket$inet6_icmp_raw(0x1c, 0x3, 0x3a)
sendmsg(r0, &(0x7f0000002680)={&(0x7f0000000140)=@in6={0x1c, 0x1c, 0x3}, 0x1c, &(0x7f00000024c0)=[{&(0x7f0000001240)="f9dc1a217e5693e4", 0x8}], 0x1}, 0x0)

11:39:16 executing program 5:
r0 = socket$inet6_sctp(0x1c, 0x5, 0x84)
r1 = fcntl$dupfd(r0, 0x0, r0)
setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x24, &(0x7f0000000000)=0x1c00, 0xfe6a)

11:39:16 executing program 3:
r0 = socket$inet_sctp(0x2, 0x5, 0x84)
r1 = socket$inet_sctp(0x2, 0x5, 0x84)
r2 = dup2(r1, r0)
recvfrom$inet6(r2, 0x0, 0x0, 0x80, 0x0, 0x0)

[  879.402671][T17652] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  879.654546][T17652] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:17 executing program 2:
getrlimit(0x0, &(0x7f0000000080))
r0 = socket$inet6_sctp(0x1c, 0x1, 0x84)
r1 = fcntl$dupfd(r0, 0x0, r0)
setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x24, &(0x7f0000000000), 0xfe6a)
sendto(r1, 0x0, 0x0, 0x0, &(0x7f0000000140)=@in6={0x1c, 0x1c}, 0x1c)

11:39:17 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:17 executing program 0:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r0, &(0x7f0000000080)={0x10, 0x2}, 0x10)

11:39:17 executing program 5:
mkdir(&(0x7f0000000040)='./file1\x00', 0x0)
mkdir(&(0x7f0000000000)='./bus\x00', 0x0)
rename(&(0x7f0000000180)='./bus\x00', &(0x7f00000001c0)='./file0\x00')
rename(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0)='./file0\x00')

11:39:17 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x9, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:17 executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xe, &(0x7f0000000100), 0x8)
bind$inet(r0, &(0x7f0000000300)={0x10, 0x2}, 0x10)
connect$inet(r0, &(0x7f0000000000)={0x10, 0x2}, 0x10)
sendmsg$inet_sctp(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="69d6b66a4f948449255dcf", 0xb}, {&(0x7f0000000140)="8adf79c1c8646b612f12", 0xa}], 0x2}, 0x0)

[  880.352095][T17682] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:18 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:18 executing program 0:
setitimer(0x2, &(0x7f0000000180)={{0x0, 0x871}, {0x3}}, 0x0)

[  880.619218][T17698] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:18 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x10000, 0x0)
r1 = fcntl$getown(r0, 0x3)
setpgid(0x0, r1)

11:39:18 executing program 2:
r0 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil)
shmat(r0, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffffff)
madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c)

[  880.783475][T17698] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:18 executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_msfilter(r0, 0x84, 0x29, &(0x7f0000000040)=ANY=[], 0x24)

[  880.958783][T17704] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:18 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xa, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:18 executing program 0:
r0 = socket(0x2, 0x5, 0x0)
connect$unix(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="8202"], 0x10)
getsockname(r0, 0x0, &(0x7f0000000180)=0x6e)

11:39:18 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:18 executing program 2:
r0 = socket$inet6_sctp(0x1c, 0x5, 0x84)
r1 = dup2(r0, r0)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x27, &(0x7f0000000040), &(0x7f0000000080)=0x21)

11:39:18 executing program 5:
r0 = socket$inet6_sctp(0x1c, 0x1, 0x84)
setsockopt$inet6_int(r0, 0x29, 0x1b, &(0x7f0000000040), 0x4)
bind(r0, &(0x7f0000001600)=@in={0x10, 0x2}, 0x10)

11:39:18 executing program 3:
r0 = socket$inet6_sctp(0x1c, 0x5, 0x84)
sendmsg(r0, &(0x7f0000000440)={&(0x7f0000000080)=@in6={0x1c, 0x1c, 0x2}, 0x1c, &(0x7f0000000240)=[{&(0x7f00000000c0)="ca", 0x1}], 0x1, &(0x7f0000000280)=[{0xc}, {0xc}], 0x18}, 0x0)

[  881.592389][T17723] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  881.725106][T17723] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:19 executing program 0:
syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @remote, @val, {@ipv6}}, 0x0)

[  881.854227][T17731] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:19 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xb, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:19 executing program 2:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r0, &(0x7f0000000040)={0x10, 0x2}, 0x10)
connect$inet(r0, &(0x7f0000000000)={0x10, 0x2}, 0x10)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0xa, &(0x7f0000000200)=ANY=[@ANYBLOB="10024e21000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff40c30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000002000000000000000e149799984029097465d2ec2ba3b30997ccad7afc6c0926212f9c06"], 0xa0)

11:39:19 executing program 3:
socket$inet6_sctp(0x1c, 0x5, 0x84)
socket$inet6_sctp(0x1c, 0x5, 0x84)
r0 = socket(0x1c, 0x10000001, 0x84)
sendto(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)=@in={0x10, 0x2}, 0x10)
setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x1203, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES16=r0], 0x3ef)

11:39:19 executing program 5:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket(0x11, 0x800000003, 0x0)
bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14)
setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r2, 0x1, 0x5, @random="f31f2cb56d6c"}, 0x10)
setsockopt$packet_add_memb(r0, 0x107, 0x2, &(0x7f00000001c0)={r2, 0x1, 0x6, @local}, 0x10)

11:39:19 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:20 executing program 0:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000180)="6653070000053c27bc3376003639405cb4aed12f0000001500ae47a825d86800278dcff47d010000805acf4f8f3646023443240a06dc9d8e99adaf81dcfc6afd983f79e651", 0x45}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x34)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

[  882.690386][T17756] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  882.800207][T17764] device lo entered promiscuous mode
[  882.829563][T17756] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  882.873767][T17760] device lo left promiscuous mode
[  882.888750][T17764] device lo entered promiscuous mode
[  882.900001][T17760] device lo left promiscuous mode
11:39:20 executing program 2:
syz_mount_image$msdos(&(0x7f00000000c0)='msdos\x00', &(0x7f0000000000)='./file0\x00', 0xffc00007, 0x1, &(0x7f0000000180)=[{&(0x7f0000000040)="040800090000ff01e66174000404090a02", 0x11}], 0x0, &(0x7f0000000100))

11:39:20 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xc, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  883.103212][T17776] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:20 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
r2 = fcntl$dupfd(r0, 0x0, r1)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1)
syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x3a, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0)

11:39:20 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:20 executing program 3:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="675f07000005eb301420384897f1ac1dea61a7a765760036f300000000007d7cff30f363089c284092590076000000008000000000ad56cc1e766e4e31408419dc98a421821a51fd3009b7832b6b9274ebac29138a1a432e3c0137c20bf41791a274e02da91c69a3ad0d2a19259d42515eddbbd6f06935256d9072e5", 0x7c}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}}}, 0x78)
tkill(r0, 0x3c)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

11:39:20 executing program 0:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vga_arbiter\x00', 0x141, 0x0)
write$vga_arbiter(r0, &(0x7f0000000580)=ANY=[@ANYBLOB='target '], 0x15)

[  883.497267][T17788] FAT-fs (loop2): invalid media value (0x00)
[  883.503526][T17788] FAT-fs (loop2): Can't find a valid FAT filesystem
[  883.589525][T17793] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  883.614214][T17788] FAT-fs (loop2): invalid media value (0x00)
[  883.620378][T17788] FAT-fs (loop2): Can't find a valid FAT filesystem
[  883.685608][T17793] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:21 executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000001040)='fuse\x00', 0x0, &(0x7f0000002140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000040)={0x18, 0x2}, 0x18)

11:39:21 executing program 5:
r0 = memfd_create(&(0x7f0000000080)='\x00', 0x0)
fcntl$addseals(r0, 0x409, 0x80000000a)

[  884.054396][T17808] ptrace attach of "/root/syz-executor.3"[17807] was attempted by "/root/syz-executor.3"[17808]
11:39:21 executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
setuid(r1)
syz_open_procfs(0x0, &(0x7f0000000000)='setgroups\x00')

11:39:21 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xd, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:21 executing program 0:
perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedf, 0x79354, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x7ff, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
io_setup(0xb, &(0x7f0000000040)=<r1=>0x0)
io_submit(r1, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x200a00}])

11:39:21 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

[  884.620706][T17827] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:22 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
r2 = fcntl$dupfd(r0, 0x0, r1)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1)
syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x21, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0)

[  884.758266][T17833] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:22 executing program 5:
socketpair(0x1e, 0x1, 0x0, &(0x7f0000004a40)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmmsg(r0, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/84, 0x54}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r0, &(0x7f0000004000)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001540)=""/135, 0x87}], 0x1}}], 0x1, 0x0, 0x0)
sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[], 0x2c}}, 0x0)

[  884.855240][T17827] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:22 executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet(0x2, 0x3, 0x5)
setsockopt$inet_msfilter(r1, 0x0, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="dc"], 0x1)
getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={<r2=>0x0, @local, @local}, &(0x7f0000000080)=0xc)
sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e40)=@newtfilter={0x3c, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {}, {0xffe0}}, [@filter_kind_options=@f_route={{0xa, 0x1, 'route\x00'}, {0xc, 0x2, [@TCA_ROUTE4_FROM={0x8}]}}]}, 0x3c}}, 0x0)

11:39:22 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180))
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:22 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  885.407150][T17845] dccp_invalid_packet: P.Data Offset(68) too large
[  885.483926][T17850] dccp_invalid_packet: P.Data Offset(68) too large
11:39:23 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
r2 = fcntl$dupfd(r0, 0x0, r1)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1)
syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x3a, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0)

[  885.648897][T17857] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  885.733312][T17859] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:23 executing program 2:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="675f07000005eb301420384897f1ac1dea61a7a765760036f300000000007d7cff30f363089c284092590076000000008000000000ad56cc1e766e4e31408419dc98a421821a51fd3009b7832b6b9274ebac29138a1a432e3c0137c20bf41791a274e02da91c69a3ad0d2a19259d42515eddbbd6f0693525", 0x78}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
write$FUSE_ATTR(0xffffffffffffffff, &(0x7f0000000080)={0x78, 0x0, 0x0, {0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xee01}}}, 0x78)
tkill(r0, 0x3c)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

[  885.828211][T17857] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:23 executing program 0:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x70, 0x70, 0x2, [@enum={0x0, 0x6, 0x0, 0x6, 0x4, [{}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x5, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0x8a}, 0x20)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b90cb6974f527cc14538d1efb1ffe03284f6d33265be9c604c893f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x1a)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

11:39:23 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180))
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:39:23 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x10, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:23 executing program 3:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="675f07000005eb301420384897f1ac1dea61a7a765760036f300000000007d7cff30f363089c284092590076000000008000000000ad56cc1e766e4e31408419dc98a421821a51fd3009b7832b6b9274ebac29138a1a432e3c0137c20bf41791a274e02da91c69a3ad0d2a19259d4251", 0x70}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3c)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

[  886.359889][T17875] ptrace attach of "/root/syz-executor.0"[17874] was attempted by "/root/syz-executor.0"[17875]
11:39:23 executing program 0:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0xffffffffffffffff, 0x0, 0x40000000, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000100)="675f07000005eb301420384897f1ac1dea61a7a765760036f300000000007d7cff30f363089c284092590076000000008000000000ad56cc1e766e4e31408419dc98a421821a51fd3009b7832b6b9274ebac29138a1a432e3c0137c20bf41791a274e02da91c69a3ad0d2a19259d42515eddbbd6f0693525", 0x78}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x3c)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

11:39:23 executing program 5:
socketpair(0x1e, 0x1, 0x0, &(0x7f0000004a40)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmmsg(r0, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/84, 0x54}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r0, &(0x7f0000004000)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001540)=""/135, 0x87}], 0x1}}], 0x1, 0x0, 0x0)
sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[], 0x2c}}, 0x0)

11:39:24 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r1 = syz_open_pts(r0, 0x0)
ioctl$BTRFS_IOC_INO_LOOKUP(r1, 0x5450, 0x0)

[  886.493665][T17881] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  886.513607][T17879] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:24 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180))
ioctl$KVM_RUN(r3, 0xae80, 0x0)

[  886.593534][T17881] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:24 executing program 3:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r1 = syz_open_pts(r0, 0x0)
ioctl$TIOCGPGRP(r1, 0x5450, 0x0)

[  886.642532][T17889] ptrace attach of "/root/syz-executor.3"[17888] was attempted by "/root/syz-executor.3"[17889]
11:39:24 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x11, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  886.975421][T17902] ptrace attach of "/root/syz-executor.0"[17899] was attempted by "/root/syz-executor.0"[17902]
11:39:24 executing program 0:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$FS_IOC_FSGETXATTR(r0, 0x5450, 0x0)

11:39:24 executing program 2:
r0 = socket$unix(0x1, 0x1, 0x0)
pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
r2 = openat$null(0xffffffffffffff9c, &(0x7f0000001380)='/dev/null\x00', 0x0, 0x0)
splice(r2, 0x0, r1, 0x0, 0x1, 0x0)
r3 = fcntl$dupfd(r1, 0x0, r0)
ioctl$KDFONTOP_COPY(r3, 0x541b, 0x0)

11:39:24 executing program 3:
r0 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x0, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x5450, 0x0)

11:39:24 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

[  887.500837][T17913] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  887.663610][T17913] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:25 executing program 2:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00003e0000)='/dev/ptmx\x00', 0x0, 0x0)
r1 = syz_open_pts(r0, 0x0)
fcntl$notify(r1, 0x0, 0x0)

11:39:25 executing program 5:
socketpair(0x1e, 0x1, 0x0, &(0x7f0000004a40)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmmsg(r0, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/84, 0x54}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r0, &(0x7f0000004000)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001540)=""/135, 0x87}], 0x1}}], 0x1, 0x0, 0x0)
sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[], 0x2c}}, 0x0)

11:39:25 executing program 0:

11:39:25 executing program 3:

11:39:25 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x12, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  888.000692][T17925] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:25 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

[  888.412885][T17942] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:25 executing program 2:

11:39:25 executing program 0:

11:39:25 executing program 3:

[  888.534695][T17942] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  888.687538][T17947] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:26 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x22, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:26 executing program 3:

11:39:26 executing program 2:

11:39:26 executing program 4:
r0 = getpid()
sched_setscheduler(r0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

11:39:26 executing program 5:
socketpair(0x1e, 0x1, 0x0, &(0x7f0000004a40)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmmsg(r0, &(0x7f0000001f40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/84, 0x54}], 0x1}}], 0x1, 0x0, 0x0)
recvmmsg(r0, &(0x7f0000004000)=[{{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001540)=""/135, 0x87}], 0x1}}], 0x1, 0x0, 0x0)
sendmsg$IPCTNL_MSG_EXP_DELETE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[], 0x2c}}, 0x0)

11:39:26 executing program 0:

11:39:26 executing program 2:

11:39:26 executing program 3:

11:39:27 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x25, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  889.522325][T17966] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer.
11:39:27 executing program 4:

11:39:27 executing program 2:

11:39:28 executing program 4:

11:39:28 executing program 3:

11:39:28 executing program 0:

11:39:28 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2f, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:28 executing program 2:

11:39:28 executing program 5:

11:39:28 executing program 3:

11:39:28 executing program 4:

11:39:28 executing program 0:

11:39:28 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x48, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:29 executing program 2:

11:39:29 executing program 4:

11:39:29 executing program 3:

11:39:29 executing program 0:

[  891.780319][T18006] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:29 executing program 5:

[  891.906971][T18006] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:29 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x4c, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:29 executing program 0:

11:39:29 executing program 3:

11:39:29 executing program 4:

11:39:29 executing program 2:

11:39:29 executing program 5:

[  892.712240][T18023] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:30 executing program 5:

11:39:30 executing program 0:

[  892.882607][T18023] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:30 executing program 4:

11:39:30 executing program 3:

11:39:30 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x5c, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:30 executing program 2:

11:39:30 executing program 5:

[  893.471678][T18036] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:31 executing program 0:

11:39:31 executing program 2:

[  893.635081][T18036] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:31 executing program 4:

11:39:31 executing program 0:

11:39:31 executing program 3:

11:39:31 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x60, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:31 executing program 3:

11:39:31 executing program 5:

11:39:31 executing program 2:

11:39:31 executing program 0:

11:39:31 executing program 4:

11:39:32 executing program 3:

11:39:32 executing program 5:

11:39:32 executing program 2:

11:39:32 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x68, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:32 executing program 4:

11:39:32 executing program 0:

11:39:32 executing program 5:

11:39:32 executing program 3:

11:39:32 executing program 4:

11:39:32 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6c, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:33 executing program 2:

11:39:33 executing program 5:

11:39:33 executing program 0:

11:39:33 executing program 4:

11:39:33 executing program 3:

11:39:33 executing program 5:

11:39:33 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$EXT4_IOC_MIGRATE(r0, 0x5450)

11:39:33 executing program 0:
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x0, 0x0)
ioctl$FITHAW(r0, 0x5450)

11:39:33 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x74, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:33 executing program 4:
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
dup3(r1, r0, 0x0)
setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, 0x0, 0x0)

11:39:33 executing program 3:
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000300)='/dev/full\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
dup3(r1, r0, 0x0)
recvmmsg(r0, 0x0, 0x0, 0x0, 0x0)

11:39:34 executing program 0:
r0 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x0, 0x0)
ioctl$RNDGETENTCNT(r0, 0x5452, &(0x7f0000000040))

11:39:34 executing program 5:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x5421, 0x400001)

11:39:34 executing program 2:
perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0xe, 0x4, 0x2e0, 0x190, 0xf8, 0xf8, 0xf8, 0x0, 0x248, 0x248, 0x248, 0x248, 0x248, 0x4, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@devgroup={{0x38, 'devgroup\x00'}}, @common=@unspec=@connlabel={{0x28, 'connlabel\x00'}}]}, @common=@unspec=@STANDARD={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00'}}, {{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bridge\x00', 'syzkaller0\x00'}, 0x0, 0x70, 0xb8}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@mcast1, 'veth1_to_hsr\x00'}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x340)

11:39:34 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x7a, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:34 executing program 4:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1400000001080102"], 0x14}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
splice(r0, 0x0, r2, 0x0, 0x207fff, 0x0)

11:39:34 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000100)={@mcast2, 0x800, 0x0, 0x2000000000903, 0x1}, 0x20)

11:39:34 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:34 executing program 2:
perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0x11, 0x800000003, 0x0)
bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x1}}]}}]}, 0x44}}, 0x0)

11:39:34 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:35 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x116, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:35 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:35 executing program 3:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8c}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0)
r1 = socket$inet6(0xa, 0x0, 0x0)
recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0)
r2 = clone3(&(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x40)
rt_sigqueueinfo(r2, 0x9, &(0x7f00000016c0)={0x0, 0x0, 0x80000000})

11:39:35 executing program 2:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0)
perf_event_open(&(0x7f0000000500)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x100002, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700)
write$cgroup_int(r1, &(0x7f0000000200), 0x43400)
setsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000040)={0x0, @local, @broadcast}, 0xc)
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700)
write$cgroup_int(r2, &(0x7f0000000200), 0x43400)
ioctl$PERF_EVENT_IOC_PERIOD(r0, 0xc028660f, &(0x7f00000005c0)=0x415190300)

11:39:35 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  898.195167][T18136] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  898.337501][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:36 executing program 4:
perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x800}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000000240))
r0 = socket$inet6(0xa, 0x2, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
connect$inet6(r0, &(0x7f0000000640)={0xa, 0x1000000000004e24, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x2b}}}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000040)=0x6, 0x4)
sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0)

11:39:36 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x117, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  898.908111][   T28] audit: type=1800 audit(1599046776.340:40): pid=18141 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=collect_data cause=failed comm="syz-executor.2" name="memory.events" dev="sda1" ino=16231 res=0
11:39:36 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:36 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp1\x00', 0x109801, 0x0)
ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000000040))
write$dsp(r0, &(0x7f0000002000)='`', 0x80000)

11:39:36 executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x2}, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000009cc0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0)
pipe(0x0)
fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x3}, 0x0)
r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0)
write$UHID_INPUT(r1, &(0x7f0000000980), 0x10a9)
r2 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
sendmsg$unix(0xffffffffffffffff, &(0x7f0000000900)={&(0x7f0000000200)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f00000019c0)=[{&(0x7f00000002c0)}, {&(0x7f0000000380)="2a92997dde9f81b959d19ef711ce3882f2b6c6b2eee8f19ca2a0fcfecba4edd78a127e05c323349d294b1c64b5d2c579d920a0c30d0b4eba440a3300192ec13e90b3e265a9fcdeff7d40325ef14638a30d1a57584a58c984d175c8415194bb8985924609e0a1d599578289ba4a1861e3796934fbf216f54d5d3202f0912985e0dcca08e3f85fa4bd3f1950881ebee0f628aac1fb68220f90cf876683a57bb8da3cc026ff3afb46c77e1f7d7f64f5b561a0713ad4fd98a0b24278fb0ff8319651e2e130591b5753324f5bd0db70bd66b0797b5104d781026e789295a08568", 0xde}, {&(0x7f0000000140)="6771dc6032", 0x5}, {&(0x7f0000000580)="67f1a740a3dd3d436fbac8336efca8035071812aa4f50a6319a8256366f29484ab0165554c3caaf579172892b936880f88c7c76d6b079dcdd558eb269d841cdd08406555d5f5124fcec8", 0x4a}, {0x0}, {&(0x7f0000000480)="2b2c0c631b52b0e0045b328bae91cd5aa3238810e55d50f468a0f202204f816135e9ab8ee21586059a2e5fda88cf7074ab84b177d8cfdc2a7e927c", 0x3b}, {&(0x7f00000006c0)="fb6736cbc4b017ac545ebdf73500575b16dd8ba6d403bea7d65af2192ed4e6261e651bc31f15dc81300ee00e306321350d2e360c79b70bce7d70993235ebff475af4e9117c50", 0x46}, {0x0}], 0x8, 0x0, 0x20, 0x4810}, 0x0)
fcntl$setstatus(r2, 0x4, 0x46000)
lseek(r2, 0x4200, 0x0)
r3 = creat(&(0x7f0000000000)='./bus\x00', 0x0)
io_setup(0x1ff, &(0x7f00000004c0)=<r4=>0x0)
open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0)
io_submit(r4, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x10000}])
r5 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0)
sendfile(r2, r5, 0x0, 0x8400fffffffb)
sendfile(r1, r1, &(0x7f0000000100), 0x8080ffffff7e)

11:39:36 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  899.362556][ T8723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  899.482697][T18164] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  899.592363][T18164] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  899.619211][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:37 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:37 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x118, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  900.020336][   T28] audit: type=1804 audit(1599046777.450:41): pid=18174 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir159198976/syzkaller.DpY9LB/499/bus" dev="sda1" ino=16190 res=1
11:39:37 executing program 4:
ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000100)={0x0, 0x8, 0x0, 0x0, 0x6, "705e1c887bd10c0dff9e8cbfddc0127d440504", 0x7, 0x8})
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000ac0)=ANY=[@ANYRES16=0x0, @ANYBLOB], 0x84}}, 0x0)
perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x1a404, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0)
r1 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0)
utimes(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={{0x0, 0xea60}})
write$9p(r0, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600)
ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f00000001c0)={0x3, 0x1, 0x19, 0x1e, 0x0, 0x0})
sendfile(r0, r1, 0x0, 0x1c542)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x0, 0xffff0000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40)

11:39:37 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = syz_io_uring_setup(0x76d1, &(0x7f0000000140), &(0x7f0000555000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000), &(0x7f0000000100))
io_uring_register$IORING_UNREGISTER_EVENTFD(r2, 0x4, 0x2, 0x0)

11:39:37 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  900.408149][ T8723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  900.582276][T18183] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  900.668917][T18183] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:38 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_init1(0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  900.749378][   T28] audit: type=1804 audit(1599046778.180:42): pid=18190 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir139518342/syzkaller.kUAq3R/407/file0" dev="sda1" ino=16383 res=1
[  900.884599][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  900.925924][   T28] audit: type=1804 audit(1599046778.260:43): pid=18177 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir159198976/syzkaller.DpY9LB/499/bus" dev="sda1" ino=16190 res=1
11:39:38 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x204, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:38 executing program 4:
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10)
socket$nl_xfrm(0x10, 0x3, 0x6)
ioprio_set$uid(0x0, 0x0, 0x0)
perf_event_open(&(0x7f0000000580)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400001, 0x2, @perf_config_ext, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendto$inet(r0, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
recvmmsg(r0, &(0x7f0000005540)=[{{0x0, 0x28000000, &(0x7f0000000240)=[{&(0x7f0000001340)=""/4067, 0x20002323}], 0x1, 0x0, 0x983a0000, 0x103}}], 0x1, 0x100, 0x0)
pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
io_setup(0x0, 0x0)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x0, 0x0)
io_cancel(0x0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x6, 0x9, 0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x6, 0x0, 0x1, r1}, 0x0)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600), 0x4)
sendto$inet(r0, &(0x7f00000012c0)="0c268a927f1f6588b967480a41ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x170)

11:39:38 executing program 2:
r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0)
ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040))
r1 = creat(&(0x7f0000000380)='./bus\x00', 0x0)
r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0)
write$P9_RREADLINK(r2, &(0x7f0000000300)=ANY=[], 0x65)
fallocate(r1, 0x100000003, 0x0, 0x28120001)

11:39:38 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_init1(0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:38 executing program 3:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
setsockopt$ARPT_SO_SET_REPLACE(r1, 0xa02000000000000, 0x60, &(0x7f0000000340)={'filter\x00', 0x8000000, 0x4, 0x428, 0x230, 0x130, 0x130, 0x340, 0x340, 0x340, 0x4, 0x0, {[{{@uncond=[0x2], 0xc0, 0x130}, @unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, "f67b23ffdfa27f907a03732da3acbc6518e62a77ca06f258762e88c0d9f9d2f413b976613bad414a105f4bdf01425ce81c5d00"}}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 'ip6tnl0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x2, "dcd23740354236d4baa41782325b176ddf7ab200d82bdbd14aa429ea1692"}}, {{@arp={@rand_addr, @multicast1, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {@mac=@dev}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'gretap0\x00', 'wg0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @loopback, @local}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x478)

11:39:38 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_init1(0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  901.453681][ T8723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  901.465518][T18208] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  901.570343][T18208] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:39 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2e7, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:39 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_init1(0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:39 executing program 3:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup3(r1, r0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
r3 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d)
bind$inet(r3, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000600)=0xda6, 0x4)
writev(r3, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a78c7b5a19e97447799d930f9623b", 0x8b}, {&(0x7f00000001c0)="96431fb1cb119741590ad657dc5e5ce3e5fe9f1f639e6a18bc7b6c1d0b424eb306f34cf2429c62c0fdefbae36740a7169721af852826d7f14b6cae8af86507ff78a1dda991aea5952f43e7e0146a3c035f0113d617240e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d784e0c89135b82b321f8e43d7a5db9ab1bfd319f472a94", 0x8d}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c025150940cdead92eb1e6bc6ba45eecf067b32425b6000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68677c7b261de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752cdfe458ddf54e8fc10ff79b5", 0x1b9}], 0x3)
sendto$inet(r3, &(0x7f00000012c0)="1a268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27)

11:39:39 executing program 2:
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
creat(&(0x7f00000000c0)='./bus/file0\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
r0 = open(&(0x7f0000000240)='./file1\x00', 0x141142, 0x0)
write$UHID_INPUT(r0, &(0x7f0000001440), 0xfffffc41)
rename(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000400)='./file1\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0)
perf_event_open(&(0x7f0000000180)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0xfffffff6}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)

11:39:39 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_init1(0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:39 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_init1(0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:39 executing program 4:

[  902.501969][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  902.643516][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:40 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2e8, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:40 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:40 executing program 4:

11:39:40 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  903.527480][ T8723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:41 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2e9, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:41 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:41 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  904.563240][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:42 executing program 3:
syz_open_dev$char_usb(0xc, 0xb4, 0x7f)

11:39:42 executing program 4:

11:39:42 executing program 2:

11:39:42 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x300, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:42 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:42 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:42 executing program 4:
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b702000038000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe0a000000850000000d000000b700000000000000950000000000000023b5922c90d1db26e58a72e306a78bbaf158fce7df486c60f7ae965121eddcd904d19ef8883600dd6f214a4a764f17b5fd74d49fefcafaf4"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffff8b}, 0x48)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0x16, 0x34000, &(0x7f0000000500)="b9ff0300000d698cb89e14f088a8000f88a8003f8847638877fbac141421e9", 0x0, 0x100, 0xe8030000}, 0x28)

[  905.274081][T18294] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:42 executing program 2:

[  905.463120][T18294] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  905.602687][ T8723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:43 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:43 executing program 3:

[  905.684805][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:43 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:43 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x402, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:43 executing program 4:

11:39:43 executing program 2:

[  906.325099][T18317] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:43 executing program 3:

11:39:43 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  906.562534][T18317] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:44 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  906.660789][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:44 executing program 4:

11:39:44 executing program 3:

11:39:44 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x406, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:44 executing program 2:

11:39:44 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  907.253206][T18334] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:44 executing program 4:

11:39:44 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r3, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:44 executing program 3:

[  907.385967][T18334] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:45 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x500, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:45 executing program 4:

11:39:45 executing program 2:

[  907.683256][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:45 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:45 executing program 3:
syz_emit_ethernet(0x300506, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa00200000000086dd60b4090000000000fe80000000a800fbffe0000002ff0200002200000ad0469600000f20018830907800c204"], 0x0)

[  908.059608][T18350] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:45 executing program 2:
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x4240a2a0)

11:39:45 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  908.207512][T18350] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:45 executing program 4:
dup(0xffffffffffffffff)
r0 = msgget$private(0x0, 0x0)
msgrcv(r0, 0x0, 0x0, 0x0, 0x0)
msgsnd(r0, &(0x7f0000000100)={0x2}, 0x8, 0x0)

11:39:45 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:45 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x600, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:46 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0)
ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82)

[  908.723018][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  908.731289][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:46 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  908.989103][T18371] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:46 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:46 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000e15000)={0x2, 0x4e20, @local}, 0x10)
r3 = socket$inet(0x2, 0x1, 0x0)
setsockopt$sock_int(r3, 0x1, 0x0, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4)
bind$inet(r3, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10)
listen(r3, 0x0)

11:39:46 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  909.209917][T18371] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:46 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000000000)='cpuset\x00')
writev(r0, 0x0, 0x0)

11:39:46 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x604, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:46 executing program 2:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet6(0xa, 0x3, 0x2f)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast1, @in=@private=0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@empty, 0x0, 0x33}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0xe6, 0x9f, 0xffffffff}}, 0xe8)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c)
bind$netlink(r3, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8822d55593a2179}, 0xc)
write(r2, 0x0, 0x0)

11:39:47 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
r3 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r3, 0x0)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  909.762931][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:47 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffff85}]})
epoll_create(0x3f)

11:39:47 executing program 4:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10d, 0x10d, 0x3, [@enum, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @const, @datasec={0x0, 0x9, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}, {}, {}], 'u'}, @enum={0x0, 0x5, 0x0, 0x6, 0x4, [{}, {}, {}, {}, {}]}, @func_proto]}, {0x0, [0x0]}}, 0x0, 0x12b}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x40)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

11:39:47 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  909.944661][T18393] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  910.028528][T18396] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  910.104456][T18401] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  910.118061][T18393] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:47 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x700, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:47 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:47 executing program 2:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = memfd_create(&(0x7f0000000500)='+\x8b\x8a\xa9\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\x94a\xac', 0x3)
write$binfmt_misc(r1, &(0x7f0000000c40)=ANY=[], 0xff67)
sendfile(r0, r1, &(0x7f0000000000), 0xffff)
fcntl$addseals(r1, 0x409, 0x8)
r2 = fcntl$dupfd(r1, 0x0, r1)
write$P9_RLERROR(r2, 0x0, 0x0)

[  910.509280][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  910.614773][   T28] audit: type=1326 audit(1599046788.050:44): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18408 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
11:39:48 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  910.719644][T18416] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  910.802825][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  910.824209][T18416] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:48 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  911.018427][   T28] audit: type=1326 audit(1599046788.450:45): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18408 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
11:39:48 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x8e6, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:48 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:48 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffff85}]})
sched_getscheduler(0x0)

11:39:48 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001})
write$tun(r0, &(0x7f0000000240)={@void, @val, @mpls={[], @ipv4=@icmp={{0x8, 0x4, 0x0, 0x0, 0x6c, 0x0, 0x0, 0x0, 0x88, 0x0, @dev, @remote}, @timestamp={0xd, 0x4}}}}, 0x100c)

11:39:48 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchdir(r0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  911.612098][   T28] audit: type=1326 audit(1599046789.040:46): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18436 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
[  911.769252][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  911.843473][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  912.362103][   T28] audit: type=1326 audit(1599046789.790:47): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18436 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
[  912.882584][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:50 executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
recvmmsg(r0, &(0x7f0000005540)=[{{0x0, 0x280000ea, &(0x7f0000000240)=[{&(0x7f0000001340)=""/4067, 0x20002323}], 0x1, 0x0, 0x983a0000, 0x103}}], 0x1, 0x0, 0x0)
sendto$inet(r0, &(0x7f00000012c0)='\f&', 0x2, 0x11, 0x0, 0x0)

11:39:50 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x8e7, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:50 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:50 executing program 2:
prctl$PR_SET_NAME(0xf, &(0x7f0000000000)='//selinux\x00\x00\x01\x10=\x8f\xa2\xc7\x8b\x96|?\x16\xbf\xa1$\xe2\xf4\xa6t#M\xe0l\x0e<\x89\x8df\xa0m\x00\a\xbb\x84\xc2V\xff\xb0j\x06\x00\xba\x1a\xe7@\xab\xe2v\x8a\x97\x88\xd3\xa5\xeePb\x10\xf5\'\xc1\x01\xfew\xdfgCM>\xba\xc6\xe5\xa6\xac\xfa\xed\xdf;')
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x24008000)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
r1 = openat(r0, &(0x7f0000000bc0)='./file0\x00', 0xc0242, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000100)='fd/3\x00')
r3 = openat(r2, &(0x7f0000000040)='./file0\x00', 0x141202, 0x0)
write$FUSE_INIT(r3, &(0x7f0000000140)={0x50}, 0xfffffec8)
fallocate(r1, 0x10, 0x0, 0x5)

11:39:50 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:50 executing program 3:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
dup(r0)
mkdir(&(0x7f0000000140)='./file0\x00', 0x4)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f0000000040)='./file0\x00', 0x0, 0x7a00, 0x0)
chdir(&(0x7f0000000180)='./file0\x00')
r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0)
r2 = open(&(0x7f0000000440)='./bus\x00', 0x6500, 0x0)
r3 = creat(&(0x7f0000000000)='./bus\x00', 0x80)
write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0xd4ba0ff)
dup3(r2, r1, 0x0)
chroot(&(0x7f0000000300)='./file0\x00')
io_setup(0xa, &(0x7f0000000240)=<r4=>0x0)
io_submit(r4, 0x8, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000), 0x200a00}])
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)

11:39:51 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0)

11:39:51 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:51 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:51 executing program 3:
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)

11:39:51 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x900, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:51 executing program 4:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
mkdirat$cgroup(0xffffffffffffffff, 0x0, 0x1ff)

[  913.922894][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  914.187390][T18497] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:51 executing program 2:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
fchmod(r0, 0x0)

11:39:51 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
dup(r1)
fchdir(r0)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  914.307723][T18497] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:51 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:51 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000100)={0xa, 0x2, 0x0, @ipv4={[], [], @loopback}}, 0x1c)
sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2, 0x983a}, 0x1c)

11:39:52 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xa00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:52 executing program 4:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0)
read$FUSE(r0, &(0x7f0000000200)={0x2020}, 0x2020)

[  914.812283][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:52 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
socket$inet_icmp_raw(0x2, 0x3, 0x1)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:52 executing program 2:
io_setup(0x10000, &(0x7f0000000080))
io_setup(0x5, &(0x7f00000000c0))

[  914.964287][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:52 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
unshare(0x600)
r2 = socket(0x1000000000000010, 0x80802, 0x0)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000900)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000200000000000c00095000000000000002ba728041598d6fbd30cb599e83d24a3aa81d36bb3019c13cb2321afb56fa54f26fb0b71d05316996f86aaf1e923a5f3e6ada59dfcfefcf1d8f7faf75e0f226bd99eea7960717142fa9ea4318123741c4a0e168c1886d0d4d94f2f4e345c652fbc16ee988e6e0dc8cedf3ce99fbfbf9b0a4def23d410f6296b32a834388107200759cda9036b4e369a9e152ddcc7b1b85f3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c3b35967deab0200000000000000662ed4048d3b3e22278d00031e5388ee5c867ddd58211d6ececb0cd2b6d357b85a0218ce740068725837074e468ee207d2f73902fbcfcf49822775985bf31b715f5888b24efa000000000000ffffffdf000000000000000000000000020000000000000000000000000000b27cf3d1848a02000000e1ffb0adf9deab29ea3323aa9fdfb52faf449c3bfd09000000b91ab219ef7fbb7b27e8f67581cf796a1d4223b9ff7ffcad3f6c962b9f292324b7ab7ff38cb78c5445080743e6c29fca54cd7da31cf41ab11f12fb1e0a494034127de7c6592df1a6c64d8f20a67745409e011f1264d43e153b3d34899f40159e800ea2474b544035a30b23bcee46762c2093bcc9eae5ee3e980026c96f80ee1a74e04bde740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec309baed0495f06d058a75fa4c81e5c9f42d9383e41d277b10392a912ffaf6f658f3fadd16286744f839c3f128f8f92ef992239eafce5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637598f37ad380a447483cac394c7bbdcd0e3b1c39b6e00916de48a4e70f03cc4146a77af02c1d4cef5379da0700ed8477dfa8ceefb405005c6977c78cdbf37704ec73755539280b064bda144910fe050038ec9e47de89298b7bf4d769ccc18eede00e8ca5457870eb30d211e23ccc8e06cd58b61799257ab55ff413c86ba9affb12ec757c7234c270246c87a901160e6c07bf6cf8809c3a0d46ff7f000000000000ad1e1f493354b2822b9837421134c0167d78e6c24ed0a2768e825972ea3b774a1467c89fa0f82e8440105051e5510a33dcda5e143fbfff161c12ca389cbe4c51b3fa00675cc1b66c5fd9c26a54d43fa050645bd9109b7e7131421c0f39113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a84a4e378a9b15bc20f49e298627340e97cdefb40e56e9cfad973347d0dffba4754ff231a1b033d8f931ba3442b2c7c503f3d0e7ab0e958adb862822e40009995ae166deb9856291a43a6f7eb2e32cefbf46306f2ef7900000000000007b82e6044f643068cd47ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3a3ee6c08384865b66d2b4dcb5dd9cdc41700414251fe5ba16b64ebbbf8702ae12c77e6e34991a225c120a3c950942fe0bc9f2a1a7506d35e5b439edeb7088aeda890cf8a4a6f31ba6d9b8cb098f935bdcbb29fd0f1a342c9eed00000000ab6648a9dea0b6c91996d65da6c24a702a86c814128fd2459f3cdaaf990000000000000000009fb32c826563c518d0ad23bc83ba3f3757210a057e177615c868bd8474233da1a3b56d4e04a7ec4792b1c4cffddbbdcfdd13ab5268f1b3d08ebb8cd198cbaaf7aaab812201d1aba3d70471fcd9b466569f3ef72f39d87fcccab514fc02b70be8629c9b73ce7bc4be7f8be71cb7b2d0a4acff8f6abe7dbad64dfa44966945d93c33b038ce0d890f85f8a6ab8487c383e24d4a8051f80e1811e387723a25dda119f64b35e71c540000000000000000001700000000eebff558cd13756a14bf7efd6fd8284003402c2bef6b997923bc722eb02907c107a55ed6f50fc3144238e24e02f5294a25dc2e3f5f982bdca5fac5d42279b0fea4e041c605f1bf9ca825a028fe8bf50c9c66e1e1e72ec705e9f0d55ee2ca89d96533406a63961a38b6d954f74ff004a98b24f5df05e8e950224fc0bf236a4dca8117244f34c21a8ddcf3b6d85655d7d619464c91bed5122d7f1f42341fe6b7ef59d5700ac17b6c09fb2f49677e05f6e3e5280081cf5938ac68c00fcda6ea4bd81690e5b3bf5318ec137071b07c937c8d79b6593b6bda6e10ffa3cf9366da0c487fa03f1ac49ae023c3d4cfc6c8e73f522f68e8d963054a000f08ca8527f68961bd53fba2bcd104b73a51abcdccc761064e2885b117a67b7923a1c545fb748c46580d98bfb212030f7527a54aa6bbb34149078dc3ba718761b7e8cd20e12b0fd58f7340dc11e7800661e7fd43c65e5ad6cde5f13bffec2334eccbc27a80354e00000e0000000000"], &(0x7f0000000140)='GPL\x00'}, 0x48)
setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000002c0)=r3, 0x4)

[  915.140149][T18519] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:52 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
dup(r1)
fchdir(r0)
r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r2, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  915.244428][T18519] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:53 executing program 2:
pipe(0x0)
clock_gettime(0x4, &(0x7f0000000040))

11:39:53 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:53 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xb00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:53 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
socket$inet_icmp_raw(0x2, 0x3, 0x1)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:53 executing program 3:
mkdir(&(0x7f0000000580)='./file0\x00', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff)
mount$fuse(0x20000000, &(0x7f0000000180)='./file0\x00', 0x0, 0x901000, 0x0)
chdir(&(0x7f0000000080)='./file0\x00')
r0 = open(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0)
fallocate(r0, 0x20, 0x0, 0x10000)

[  916.006073][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  916.111378][T18545] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:53 executing program 4:
perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000)

[  916.285104][T18545] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:53 executing program 2:
io_setup(0x10000, &(0x7f0000000080)=<r0=>0x0)
ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS(0xffffffffffffffff, 0xc0406619, &(0x7f0000001140)={{0x1, 0x0, @descriptor="4a2f092d495fe713"}})
io_destroy(r0)

11:39:53 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:53 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:53 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xc00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:53 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet6(0xa, 0x3, 0x2f)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast1, @in=@private, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@empty, 0x4d4, 0x32}, 0x0, @in=@multicast2, 0x0, 0x0, 0x0, 0xe6}}, 0xe8)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c)
write(r2, 0x0, 0x0)

11:39:54 executing program 4:
seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffff85}]})
get_robust_list(0x0, &(0x7f00000001c0)=0x0, &(0x7f0000000200))

[  917.024205][T18569] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  917.045837][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:54 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:54 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:54 executing program 2:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x84, 0x84, 0x5, [@restrict, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @int, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xa1}, 0x20)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x40)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x7, r0, 0x0, 0x0)

11:39:54 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffbf7a}]})
unshare(0x0)

[  917.267691][T18569] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:39:54 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xd00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:55 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  917.646474][   T28] audit: type=1326 audit(1599046795.080:48): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18575 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7f78549 code=0xffff0000
[  917.862959][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:55 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:55 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14)

[  918.063538][T18594] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  918.085920][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  918.193090][T18594] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  918.244458][   T28] audit: type=1326 audit(1599046795.670:49): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18575 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7f78549 code=0xffff0000
11:39:55 executing program 0:
syz_open_procfs(0x0, &(0x7f0000000240)='net/ip_mr_cache\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:55 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:55 executing program 4:
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @dev}, 0x1c)

11:39:55 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:56 executing program 3:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0)
dup2(r0, r1)
getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x4, 0x0, &(0x7f0000000080))

11:39:56 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  918.996682][T18616] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  919.139377][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  920.082674][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  920.164438][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:58 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffff85}]})
setresuid(0x0, 0x0, 0x0)

11:39:58 executing program 4:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
geteuid()

11:39:58 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:58 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffff85}]})
mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)

11:39:58 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x1020, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:58 executing program 0:
r0 = syz_open_procfs(0x0, 0x0)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  920.739287][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:58 executing program 0:
r0 = syz_open_procfs(0x0, 0x0)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  920.890888][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  921.067841][   T28] audit: type=1326 audit(1599046798.500:50): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18637 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0xffff0000
[  921.091039][   T28] audit: type=1326 audit(1599046798.500:51): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18636 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
11:39:58 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x1100, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:58 executing program 5:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  921.203583][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:58 executing program 4:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
rt_sigpending(&(0x7f0000000080), 0x8)

11:39:59 executing program 0:
r0 = syz_open_procfs(0x0, 0x0)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  921.591389][   T28] audit: type=1326 audit(1599046799.020:52): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18636 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
[  921.714744][   T28] audit: type=1326 audit(1599046799.150:53): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18637 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0xffff0000
11:39:59 executing program 2:
unshare(0x2000400)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0)

11:39:59 executing program 3:
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
removexattr(0x0, 0x0)

11:39:59 executing program 5:
syz_open_procfs(0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:59 executing program 0:
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:39:59 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x1200, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:39:59 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet6(0xa, 0x3, 0x2f)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@mcast1, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@empty, 0x0, 0x32}}}, 0xe8)
connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c)
write(r2, 0x0, 0x0)

[  922.242883][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:39:59 executing program 2:
syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x20, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)

11:40:00 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0xffffff85}]})
lgetxattr(0x0, 0x0, 0x0, 0x0)

11:40:00 executing program 5:
syz_open_procfs(0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:00 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:00 executing program 0:
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:00 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x1601, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:00 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
fanotify_init(0x0, 0x0)

[  923.284439][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  923.289301][   T28] audit: type=1326 audit(1599046800.719:54): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18695 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
11:40:01 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
fanotify_init(0x0, 0x0)

11:40:01 executing program 5:
syz_open_procfs(0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:01 executing program 0:
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:01 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x1701, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:01 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  923.924141][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  923.957285][   T28] audit: type=1326 audit(1599046801.389:55): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=18695 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fcd549 code=0xffff0000
11:40:01 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(0x0, 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:01 executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0xa, 0xa, 0x101}, 0x14}}, 0x0)

11:40:01 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
fanotify_init(0x0, 0x0)

11:40:01 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x1801, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:01 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, 0x0)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  924.322967][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:02 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:02 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(0x0, 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:02 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
mincore(&(0x7f0000ffd000/0x1000)=nil, 0x1000, &(0x7f0000000080)=""/139)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000004c0)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x7, 0x0, "98d3340600c7aa11897ecaab876eab79576839c5656be8410f2802e944af80373be2666b665770173fbd1883303b6ac4749393ad08f139a68f00"}, 0xd8)
bind$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(0x0)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10)
recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, 0x0, 0x0, 0xb01001f1}, 0x1e)
write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r1], 0xc63b9e35)

11:40:02 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, 0x0)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:02 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
fanotify_init(0x0, 0x0)

11:40:02 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  925.363690][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:02 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(0x0, 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:03 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, 0x0)
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:03 executing program 2:
fanotify_init(0x0, 0x0)

11:40:03 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2010, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:03 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:03 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:03 executing program 3:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
writev(r2, &(0x7f0000000080)=[{&(0x7f00000000c0)='X', 0x1}], 0x1)
write$binfmt_misc(r2, 0x0, 0xfef0)
ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f0000000340)=@buf)

11:40:03 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:03 executing program 2:
fanotify_init(0x0, 0x0)

[  926.403583][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:03 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2200, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:04 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)

11:40:04 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  926.963836][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:04 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:04 executing program 2:
fanotify_init(0x0, 0x0)

11:40:04 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
io_submit(0x0, 0x0, 0x0)

11:40:04 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2500, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  927.443982][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:05 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:05 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
fanotify_init(0x0, 0x0)

11:40:05 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(0xffffffffffffffff)
r0 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r0, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r0, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:05 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
fchmodat(0xffffffffffffffff, 0x0, 0x0)

11:40:05 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)

11:40:05 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2f00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:05 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
fanotify_init(0x0, 0x0)

11:40:05 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, 0x0, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:05 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(0x0, 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  928.510535][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:06 executing program 3:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = fcntl$dupfd(r0, 0x0, r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
ioprio_set$uid(0x0, 0x0, 0x0)

11:40:06 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x3f00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:06 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, 0x0, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:06 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)

11:40:06 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
fanotify_init(0x0, 0x0)

11:40:06 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(0x0, 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:06 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
setns(0xffffffffffffffff, 0x0)

[  929.525520][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  929.549423][T15846] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:07 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(0x0, 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  929.586914][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  929.614217][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:07 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, 0x0, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:07 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x4000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:07 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0})
fanotify_init(0x0, 0x0)

11:40:07 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:07 executing program 3:
r0 = socket(0x2, 0x1, 0x0)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='children\x00')
r2 = dup2(r0, r1)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000700)=ANY=[@ANYBLOB="66696c746572000000000000000000000000f5ffffff000000010001001a00000e000000040000009002000000070000c800000060010000c8000000c8000080f8010000f8010000f8010000f8010000f8010000040000000000009cdfffe37e84b885dcb5823777276fb1d90000000100e60000000000000200000000000000efffffffffffffff0000000000000400e2a883ba00000000000300000000000000020000000000000000e0e4ee1a0000000e000000000000a000c800000000000019002600000080df0000000000000030006164647274797065000000000002000005000000000000000000000000007a3c0000000000000000000000000000280052454a4543540000800000cfdcf6e80000df1c0009000000ecff010000000006000000000000e0000101ac1414bb004a0000000400006772653000000000000004000000000000000000000000000000000000000000000091000000000000000000e884c354afa8a803279c0004000c000000000000000000000000000070009800000022b800000000000000000000000000100000280052454a45435400000000e0ff1bff7f000000fcffffbfff7fffffffffff00b6122a913c23374e00000000000000000000000000070000000000affe4a8da7fec0ffffffff00000000ff00010000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000010000007000980000000008d42500000000000000000000000000042800534554000000000000000000000000000800000000000000000000000801000004000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700098000000000000001c6900b2b0b383346782a700000028000000ff00000000009f000000a60000000020ed0020000000000000000000feffffff"], 0x1)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x33}}, 0x10)
connect$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r3, &(0x7f0000007fc0), 0x4000000000002b8, 0x0)

[  930.003203][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:07 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:07 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  930.337772][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  930.348883][T18877] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:07 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  930.549744][T18877] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:08 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0})
fanotify_init(0x0, 0x0)

[  930.643557][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:08 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x4800, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:08 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  930.969294][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:08 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:08 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(0xffffffffffffffff, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:08 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, 0x0})
fanotify_init(0x0, 0x0)

[  931.571315][T18904] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  931.687604][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:09 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  931.797198][T18904] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:09 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, 0x0, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  932.723510][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:10 executing program 3:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
msgsnd(0x0, 0x0, 0x0, 0x0)
msgrcv(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000028ee96297900"/268], 0x107, 0x0, 0x1000)

11:40:10 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:10 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x4c00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:10 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000140)})
fanotify_init(0x0, 0x0)

11:40:10 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:10 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, 0x0, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  933.573104][T18933] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  933.696731][T18933] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:11 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, 0x0, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:11 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000140)})
fanotify_init(0x0, 0x0)

11:40:11 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba40", 0x21)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:11 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x5c00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:11 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:11 executing program 3:
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = open(0x0, 0x18885, 0x0)
open$dir(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)
write$9p(r0, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3", 0x2a0)
sendto$packet(0xffffffffffffffff, &(0x7f0000000280)="b7774fbd5a809af5116093801553af02114f0d3d280e7f3d2d0bb6746a87bf9c45621ec0dcc03732b9456d8823646141fa5a33b7e3adae48ac0590b9e2f5b455e904cbe5912ec3fab38599aefb202fd6c1d8b9420dbefab568723be4b3a0b117a3e2498189ab49eb5941199eb7093458d04c75031187dc2935f48922c5676c00b24c566cd8e0117a5821af88f732bedd1dc8a25074561ef185f437", 0x9b, 0x0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x8, 0x6, @remote}, 0x14)
write$P9_RFLUSH(0xffffffffffffffff, 0x0, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000040)={'filter\x00', 0x33c}, &(0x7f0000000180)=0x360)
sendto(r1, &(0x7f0000000540)="ff451fd266969edccd167294a92e71eedd373f3b3e871b9c7483785ed81c7a8f174606e34c3b154c49170130fda11f9d8b17e92d21", 0x35, 0x0, &(0x7f0000000580)=@l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x80)
r2 = creat(&(0x7f0000000400)='./bus\x00', 0x0)
write$cgroup_type(r2, 0x0, 0x0)
bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0)

11:40:12 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:12 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x0, &(0x7f0000000140)})
fanotify_init(0x0, 0x0)

11:40:12 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba40", 0x21)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:12 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  934.822451][ T9065] net_ratelimit: 2 callbacks suppressed
[  934.822480][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:12 executing program 3:
clone(0x6340100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x2, 0x3, 0x36c, 0x2d8, 0x228, 0x0, 0x228, 0x228, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x2d8, 0x3, 0x0, {[{{@ip={@multicast1=0xe0000f00, @remote, 0x0, 0x0, 'syzkaller0\x00', 'netpci0\x00'}, 0x0, 0x1c8, 0x228, 0x0, {}, [@common=@inet=@hashlimit3={{0x158, 'hashlimit\x00'}, {'ip6tnl0\x00', {0x2, 0x0, 0x60, 0x0, 0x0, 0x7ff, 0x5, 0x2}}}]}, @common=@SET={0x60, 'SET\x00'}}, {{@ip={@remote, @empty, 0x0, 0x0, '\x00', 'ipvlan0\x00'}, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{[], 0x0, 0x70, 0x94}, {0x24}}}}, 0x3c8)

11:40:12 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:12 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:12 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba40", 0x21)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:12 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x7fffff7a}]})
fanotify_init(0x0, 0x0)

11:40:12 executing program 3:
chdir(&(0x7f0000000000)='./file1\x00')
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open$dir(0x0, 0x0, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x48, 0x0, &(0x7f0000000180))
sendto(r0, 0x0, 0x0, 0x840, &(0x7f0000000580)=@l2tp={0x2, 0x0, @dev}, 0x80)

[  935.504585][T18978] Cannot find add_set index 0 as target
11:40:13 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6800, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  935.843558][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:13 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:13 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x7fffff7a}]})
fanotify_init(0x0, 0x0)

11:40:13 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b0000", 0x31)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:13 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  936.187751][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  936.196394][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  936.218102][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:13 executing program 3:
syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00')
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108)
socket$inet6_tcp(0xa, 0x1, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f0000002400)=""/4082, 0xff2}], 0x1, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
preadv(r1, &(0x7f00000017c0), 0x218, 0x0, 0x6c)

11:40:14 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6c00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:14 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x7fffff7a}]})
fanotify_init(0x0, 0x0)

11:40:14 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b0000", 0x31)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:14 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba40", 0x21)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  936.911849][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:14 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:14 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x7400, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:14 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6}]})
fanotify_init(0x0, 0x0)

11:40:14 executing program 3:
syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00')
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000400)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @loopback}}}, 0x108)
socket$inet6_tcp(0xa, 0x1, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000023c0)=[{&(0x7f0000002400)=""/4082, 0xff2}], 0x1, 0x0, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
preadv(r1, &(0x7f00000017c0), 0x218, 0x0, 0x6c)

11:40:14 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b0000", 0x31)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:15 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba40", 0x21)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  937.749434][   T28] audit: type=1326 audit(1599046815.179:56): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=19033 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0x0
11:40:15 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  937.922944][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:15 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00"/57, 0x39)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:15 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x7a00, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:15 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba40", 0x21)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:15 executing program 3:
syz_mount_image$msdos(0x0, &(0x7f00000003c0)='./file1\x00', 0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[])
chdir(&(0x7f0000000000)='./file1\x00')
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
open(&(0x7f0000000240)='./file0\x00', 0x18885, 0x0)
open$dir(0x0, 0x16d900, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x4e, &(0x7f0000000040)={'filter\x00', 0x33c}, &(0x7f0000000180)=0x360)
sendto(r0, &(0x7f0000000540), 0x0, 0x840, 0x0, 0x0)
r1 = creat(&(0x7f0000000400)='./bus\x00', 0x0)
write$cgroup_type(r1, 0x0, 0x0)

11:40:16 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={0x0, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:16 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6}]})
fanotify_init(0x0, 0x0)

11:40:16 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00"/57, 0x39)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:16 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b0000", 0x31)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  938.965309][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:16 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe608, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  939.434708][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  939.507724][   T28] audit: type=1326 audit(1599046816.939:57): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=19065 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0x0
11:40:17 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b0000", 0x31)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:17 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe702, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:17 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00"/57, 0x39)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:17 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={0x0, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:17 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8", 0x3d)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:17 executing program 3:
syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f00000003c0)='./file1\x00', 0x8000d5, 0x1, &(0x7f0000000080)=[{&(0x7f00000000c0)="040014d79cd2000066617400040409000200027400f8", 0x16}], 0x0, &(0x7f0000000280)=ANY=[])
chdir(&(0x7f0000000000)='./file1\x00')
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f0000000240)='./file0\x00', 0x18885, 0x0)
open$dir(&(0x7f0000000100)='./file0\x00', 0x16d900, 0x0)
write$9p(r0, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600)
sendto$packet(0xffffffffffffffff, &(0x7f0000000280)="b7774fbd5a809af5116093801553af02114f0d3d280e7f3d2d0bb6746a87bf9c45621ec0dcc03732b9456d8823646141fa5a33b7e3adae48ac0590b9e2f5b455e904cbe5912ec3fab38599aefb202fd6c1d8b9420dbefab568723be4b3a0b117a3e2498189ab49eb5941199eb7093458d04c75031187dc2935f48922c5676c00b24c566cd8e0117a5821af88f732bedd1dc8a25074561ef185f4", 0x9a, 0x24044085, &(0x7f0000000200)={0x11, 0xd, 0x0, 0x1, 0x8, 0x6, @remote}, 0x14)
write$P9_RFLUSH(0xffffffffffffffff, &(0x7f0000000500)={0x7, 0x6d, 0x2}, 0x7)
r1 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000040)={'filter\x00', 0x33c}, &(0x7f0000000180)=0x360)
sendto(r1, &(0x7f0000000540)="ff451fd266969edccd167294a92e71eedd373f3b3e871b9c7483785ed81c7a8f174606e34c3b154c49170130fda11f9d8b17e92d21", 0x35, 0x840, &(0x7f0000000580)=@l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x80)
creat(&(0x7f0000000400)='./bus\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4ba0ff)
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0x10, &(0x7f0000000380)={&(0x7f0000000440)=""/104, 0x68}}, 0x10)

[  940.057243][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:17 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b0000", 0x31)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:17 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6}]})
fanotify_init(0x0, 0x0)

11:40:18 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8", 0x3d)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:18 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe708, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  940.645375][T19110] FAT-fs (loop3): bogus number of FAT sectors
[  940.651671][T19110] FAT-fs (loop3): Can't find a valid FAT filesystem
[  940.737920][   T28] audit: type=1326 audit(1599046818.169:58): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=19113 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0x0
11:40:18 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8", 0x3d)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:18 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={0x0, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:18 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00"/57, 0x39)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  940.895450][T19110] FAT-fs (loop3): Unrecognized mount option "¤" or missing value
[  941.124546][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:18 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:18 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00"/57, 0x39)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:18 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54", 0x3f)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:18 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:19 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe802, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:19 executing program 2:
capget(&(0x7f0000000300)={0x19980330}, &(0x7f0000000340))

11:40:19 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:19 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00"/57, 0x39)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:19 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54", 0x3f)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  942.099671][T19155] capability: warning: `syz-executor.2' uses 32-bit capabilities (legacy support in use)
11:40:19 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  942.195192][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:19 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:19 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe902, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:19 executing program 2:
clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0)
ioctl$BLKPG(r0, 0x4004092b, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0})
socket(0x0, 0x0, 0x0)
setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0)

[  942.485187][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:20 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:20 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54", 0x3f)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:20 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8", 0x3d)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  942.878290][T19181] md0: error: failed to get bitmap file
11:40:20 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14)
ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r2)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132})
ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400})
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r7], 0x20}}, 0x0)

11:40:20 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:20 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xedc0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  943.204226][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:20 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8", 0x3d)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:20 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da", 0x40)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:21 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xff0f, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:21 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0)
r1 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0)
getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14)
ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r2)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132})
ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400})
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0)
r4 = dup(r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$packet(0x11, 0x3, 0x300)
getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200))
sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d0400"/20, @ANYRES32=r7], 0x20}}, 0x0)

11:40:21 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:21 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8", 0x3d)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:21 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:21 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da", 0x40)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  944.243122][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:21 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:21 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:21 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x14108, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:22 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54", 0x3f)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:22 executing program 2:
r0 = socket$inet6(0xa, 0x3, 0xff)
setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f0000000040)=0x4, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e24, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c)
write$binfmt_elf64(r0, &(0x7f0000000100)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78)

11:40:22 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da", 0x40)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:22 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  944.993684][T19253] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:22 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  945.216435][T19253] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:22 executing program 2:
clone(0x20002044dfc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="70000000000119050301000008000000027d0000240001001400010008000100ffffffff08000200ac1e00e70b0002000500010000000000240002000c00020005000100000000001400010008000100e000000208000200d58dd4"], 0x70}}, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0xb, 0x6000000}, 0x0)

[  945.291223][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:22 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54", 0x3f)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:23 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
dup(r1)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:23 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x20000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  945.527872][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:23 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  945.672107][T19275] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'.
[  945.683930][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:23 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54", 0x3f)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:23 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:23 executing program 2:

11:40:23 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:23 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  946.328180][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  946.336665][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:23 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:23 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2bef8, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:24 executing program 2:

11:40:24 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da", 0x40)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:24 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:24 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:24 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da", 0x40)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:24 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:24 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x80000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:24 executing program 2:
clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x0, 'lo\x00'})

[  947.364308][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:24 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:25 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  947.744611][T19339] 8021q: VLANs not supported on lo
11:40:25 executing program 2:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x7f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x3c, 0x3, 0x6, 0x501, 0x0, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x3c}}, 0x0)

11:40:25 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da", 0x40)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:25 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x10, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:25 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x80040, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:25 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:25 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:25 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:25 executing program 2:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-generic\x00'}, 0x58)
r1 = accept4(r0, 0x0, 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ipv6_route\x00')
r3 = socket$unix(0x1, 0x2, 0x0)
r4 = fcntl$dupfd(r3, 0x0, r3)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
sendfile(r1, r2, 0x0, 0x7ffff00e)

11:40:25 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(0xffffffffffffffff, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{}], 0x1, 0xef)
close(0xffffffffffffffff)

[  948.404908][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:25 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x10, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:26 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x100000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:26 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:26 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:26 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x10, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:26 executing program 2:
clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x0, 0x0)
ioctl$BLKPG(r0, 0x4004092b, 0x0)

11:40:26 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:26 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(0xffffffffffffffff, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{}], 0x1, 0xef)
close(0xffffffffffffffff)

11:40:26 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x400000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  949.363834][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  949.446167][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:27 executing program 2:

11:40:27 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:27 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:27 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  949.953931][T19409] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:27 executing program 2:

[  950.111073][T19409] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:27 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x1000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:27 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(0xffffffffffffffff, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{}], 0x1, 0xef)
close(0xffffffffffffffff)

11:40:27 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x10, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  950.483900][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:28 executing program 2:

11:40:28 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  950.768831][T19429] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:28 executing program 4:
socket$inet6(0xa, 0x2, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

[  951.005840][T19429] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:28 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:28 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x10, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:28 executing program 2:

11:40:28 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:28 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  951.443834][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  951.525114][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  951.793660][T19454] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  951.890593][T19454] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:29 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x10, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:29 executing program 2:

11:40:29 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2040000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:29 executing program 4:
socket$inet6(0xa, 0x2, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:29 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  952.407815][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:30 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  952.567681][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:30 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:30 executing program 2:

11:40:30 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:30 executing program 4:
socket$inet6(0xa, 0x2, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:30 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x3000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:30 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:30 executing program 2:

[  953.335168][T19489] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:30 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
dup(r1)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:30 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  953.507246][T19489] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  953.604183][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:31 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, 0x0, 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:31 executing program 2:

11:40:31 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:31 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x4000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:31 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, 0xffffffffffffffff, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:31 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, 0x0, 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  954.238379][T19508] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:31 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
dup(r1)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

[  954.345460][T19508] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:32 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  954.646472][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:32 executing program 2:

11:40:32 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x5000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:32 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:32 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, 0x0, 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:32 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
dup(r1)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

[  955.246434][T19530] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:32 executing program 2:

[  955.289854][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:32 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:32 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  955.445776][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  955.459921][T19530] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  955.688250][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:33 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:33 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:33 executing program 2:

11:40:33 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:33 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r1, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r2, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r1, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r1}], 0x1, 0xef)
close(r1)

11:40:33 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:33 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  956.360630][T19560] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:33 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  956.475056][T19560] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:34 executing program 2:

[  956.723335][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:34 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6040000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:34 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r1, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r2, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r1, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r1}], 0x1, 0xef)
close(r1)

11:40:34 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, 0x0, 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:34 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:34 executing program 2:

11:40:34 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:34 executing program 3:
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:35 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, 0x0, 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:35 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x7000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:35 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)

11:40:35 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r1, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r2 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r2, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r1, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r1}], 0x1, 0xef)
close(r1)

[  957.764705][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:35 executing program 2:

11:40:35 executing program 3:
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  958.084616][T19610] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:35 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, 0x0, 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  958.250976][T19610] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:35 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)

11:40:35 executing program 2:

[  958.493300][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:36 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x8000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:36 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:36 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:36 executing program 3:
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  958.804002][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:36 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)

11:40:36 executing program 2:

[  959.044199][T19629] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  959.119324][T19629] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:36 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:36 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x8410100, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:36 executing program 3:
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:37 executing program 2:

11:40:37 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

11:40:37 executing program 0:

[  959.727513][T19647] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:37 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

[  959.848270][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:37 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0)

[  959.941273][T19647] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:37 executing program 2:

11:40:37 executing program 0:

11:40:37 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x9000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:37 executing program 3:
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:38 executing program 2:

11:40:38 executing program 4:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:38 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)

11:40:38 executing program 0:

[  960.886297][ T9489] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  960.948209][T19671] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  961.096441][T19671] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:38 executing program 3:
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:38 executing program 2:

11:40:38 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xa000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:38 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)

[  961.526554][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:39 executing program 0:

11:40:39 executing program 4:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:39 executing program 2:

[  961.919733][T19693] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  961.930335][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  962.012246][T19693] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:39 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:39 executing program 5:
syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00')
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd\x00')
fchdir(r0)
r1 = memfd_create(&(0x7f0000000780)='\x00', 0x0)
write(r1, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x11, r1, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000040)='./control\x00', 0xa4000972)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)

11:40:39 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xb000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:39 executing program 0:

11:40:40 executing program 4:
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:40 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:40 executing program 2:

[  962.831143][T19715] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:40 executing program 0:

[  962.912928][T19715] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  962.983522][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:40 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xc000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:40 executing program 5:

11:40:40 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:40 executing program 0:

11:40:40 executing program 4:
r0 = socket$inet6(0xa, 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:41 executing program 2:

11:40:41 executing program 5:

[  963.661030][T19735] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:41 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0), 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  963.819574][T19735] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  964.007560][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:41 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xd000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:41 executing program 0:

11:40:41 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0), 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:41 executing program 5:

11:40:41 executing program 2:

11:40:41 executing program 4:
r0 = socket$inet6(0xa, 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  964.581362][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:42 executing program 0:

[  964.673428][T19761] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:42 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0), 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:42 executing program 5:

[  964.858719][T19761] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  964.883778][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:42 executing program 2:

[  965.047404][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:42 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:42 executing program 0:

11:40:42 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:42 executing program 5:

11:40:42 executing program 4:
r0 = socket$inet6(0xa, 0x0, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:43 executing program 2:

11:40:43 executing program 0:

[  965.709090][T19790] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:43 executing program 5:

[  965.876396][T19790] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  966.085687][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:43 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x10000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:43 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x0, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:43 executing program 2:

11:40:43 executing program 0:

11:40:43 executing program 5:

11:40:44 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  966.614891][T19812] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  966.695279][T19812] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:44 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x0, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:44 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x11000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:44 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:44 executing program 2:

11:40:44 executing program 0:

11:40:44 executing program 5:

[  967.126272][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:44 executing program 2:

[  967.411349][T19834] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  967.591605][T19834] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  967.610760][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:45 executing program 5:

11:40:45 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x12000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:45 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x0, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:45 executing program 0:

[  968.093391][T19848] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  968.165428][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  968.212995][T19848] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:45 executing program 2:

11:40:45 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
socket$packet(0x11, 0x3, 0x300)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:45 executing program 5:

11:40:45 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:45 executing program 0:

11:40:46 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x16010000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:46 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:46 executing program 5:

11:40:46 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
socket$packet(0x11, 0x3, 0x300)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:46 executing program 2:

11:40:46 executing program 0:

[  969.201860][T19868] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  969.204970][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  969.241989][T19868] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:46 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:46 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x17010000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:47 executing program 5:

11:40:47 executing program 0:

11:40:47 executing program 2:

11:40:47 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
socket$packet(0x11, 0x3, 0x300)
r1 = dup(0xffffffffffffffff)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:47 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  969.911069][T19887] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  970.036158][T19887] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  970.244500][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:47 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:47 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x18010000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:47 executing program 5:

11:40:47 executing program 0:

11:40:47 executing program 2:

11:40:48 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

[  970.645938][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:48 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:48 executing program 0:

[  970.710820][T19909] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:48 executing program 5:

[  970.908856][T19909] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:48 executing program 2:

11:40:48 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:48 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x20000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  971.284186][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:48 executing program 5:

11:40:48 executing program 0:

11:40:48 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:49 executing program 2:

11:40:49 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  971.628953][T19937] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:49 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  971.810218][T19937] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:49 executing program 5:

11:40:49 executing program 2:

11:40:49 executing program 0:

11:40:49 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:49 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x20100000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:49 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

[  972.332679][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:49 executing program 2:

11:40:49 executing program 5:

11:40:50 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:50 executing program 0:

11:40:50 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x22000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:50 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:50 executing program 2:

11:40:50 executing program 0:

11:40:50 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:50 executing program 5:

[  973.261686][T19982] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  973.369402][T19982] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  973.373814][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:50 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:51 executing program 2:

[  973.691327][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:51 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x25000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:51 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:51 executing program 0:

11:40:51 executing program 5:

[  974.227786][T20002] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:51 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:51 executing program 2:

11:40:51 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  974.357647][T20002] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:51 executing program 0:

[  974.414085][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:51 executing program 5:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast2, 0xa}, 0x1c)
ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, 0x0)
sendmmsg(r0, &(0x7f0000000280)=[{{0x0, 0x7000000, 0x0, 0x0, 0x0, 0x0, 0xfffffff5}, 0xfffffff5}], 0x400000000000085, 0x0)

[  974.498026][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:52 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x2f000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:52 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:52 executing program 2:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:40:52 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x3, 0x0, 0x0, 0x0, 0xef}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000180), 0x0)
set_mempolicy(0x8003, &(0x7f0000000300)=0x75f, 0x9)
r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio1\x00', 0x80002, 0x0)
ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000040))

[  975.112357][T20026] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  975.255510][T20026] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  975.443982][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:53 executing program 4:
socket$inet6(0xa, 0x2, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:53 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:53 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x3f000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:53 executing program 5:
r0 = getpid()
sched_setscheduler(r0, 0x5, &(0x7f0000000380))
perf_event_open(&(0x7f0000001340)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, &(0x7f0000000340))
stat(0x0, 0x0)
sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0xe0d00, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f0000000400)={"6cdd4237dd245c8404721efdc9c8dc1964125fa96fa42b761c6ec25b2bec0ba4c81036c93a40c8a4d4412a763b00040000000000003c5ca206c047ecee377abaece6b88378e38e06c5fc191f361d264ffa8b46485f02baee1ab6b8154252066178868d1ef4b53606000000000000007c21a984c2b9ca4bbb7a87165c0c1dbc75d7ea4df1001000000000694525952f44500a1f0db509c32cc7ace842c28f37f06e4ea9f1e5f0c6c379f9cc58bf69fcde317fad4825aa1b6a832d4e48cc41bb5a6baa41d614f6c8941bee805954a62d196a4e8d4bf6b21224b57f530d0000c1ff53bf79a1f5c5dc34b22645cbc11c4562d22db88d0edc5daee171cc04d96d9ec2db07478f347edbd6404923ad4a5672b1b285c7988c4ec0922c655ff600000000c00dc290d936d93236051fadfb4b95d02c0bda7ce38dabb7cd103fe4d0c9c963cd717a77f8df8d46099b1f580968af6afbbc19db161c6df3e7c9c71bc08a282fc2c142856b5e4caff4c0a4f72445ef10dcd2c569319d6e9bb2058d023f669a64fc7d9684b45b00000000364673dcfa9235ea5a2ff23c4bb5c5acb290e8976dcac779ff000000000000003d4e185afe28a774b99d3890bd37428617de4cdd6f53c419ce31054182fd098af7b7f1b1152c691611f897558d4b755cb783978d9859b0537b05b623dcb5c4ca9317471a40fa4998cca80e961efffb4e1aa25d8a17deef0c8694c4395fc99be3c3fe7aeb8af4929ce7d346ca62b25d48fda5d10146702f78b233b5208752726ed9f0c340d494b92d19cc930bb8a5f8b4da8f4603ac0c3b698384e17a570dc8524823ed15af4ecfabb4b2541d3c114b7bba1c21a845c9cf0d1cc24aba47e30f558b2246ad95ccf7d2f80cc0ab26f08336ea1a33b79cf35b898837016eb211a1734c7af076e15451e33519fc978f66df7df4557c91024a8dc130a28ef5f63ad07b39c8d23b85cf434e065e8a29a80047fe17dee6f6347b4951f97b5703dc78b1ca9d74ea6a9ae12ab367c0de2659cc38d2f33ddd86e0597d33361eada119b5132145fa4525c488c7fffd6ceda6e9a02ebd97ced6b0161f2cc84615ceb8b18883299c636e9e46724a9a0600a8bb02f3e489631d522019a35fe12a33caf9dd8768ddbc02a484c345c3eff254297b1dbb04989c3f9f3c7b3c985c39b1d313018068d3809bac8c657e39f4f692613e28387e955722908dd88b56163be8312ff47c5b6f280472935af74e97a5a8110a4d74496f4c8ec82ddb010100000000000001a047526865c888c9ff36056cc4ad258021e1581d43badaaec6cc5a2ef989de9801fed6d4be2bfcfe07a69c46bffbe9dd03970800000000000000d372bdd6d89dc1ecf63c23d506114d0fba2bd1c69e8f7e3fccdcda85ce975ec1381b1cec6ddaa76e186719d819164300"})
ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000180)=0x7)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

11:40:53 executing program 2:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:40:53 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:53 executing program 4:
socket$inet6(0xa, 0x2, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

[  976.452723][T20053] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  976.488057][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  976.588886][T20053] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  976.741636][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:54 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x40000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:54 executing program 2:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:40:54 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:54 executing program 4:
socket$inet6(0xa, 0x2, 0x0)
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = dup(r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r2, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r3 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r3, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r2, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r2}], 0x1, 0xef)
close(r2)

11:40:54 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x3, 0x0, 0x0, 0x0, 0xef}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000180), 0x0)
set_mempolicy(0x8003, &(0x7f0000000300)=0x75f, 0x9)
r1 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio1\x00', 0x80002, 0x0)
ioctl$SNDCTL_DSP_SETTRIGGER(r1, 0x40045010, &(0x7f0000000040))

11:40:54 executing program 2:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

[  977.359398][T20081] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:54 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040), 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  977.445173][T20081] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:55 executing program 5:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001400)=@ipx, 0x80, 0x0}}], 0x1, 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000140)='sessionid\x00')
preadv(r0, &(0x7f00000017c0), 0x1a2, 0x0, 0x0)

[  977.528261][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:55 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, 0x0, 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:55 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x40000800, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:55 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040), 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:55 executing program 2:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0))

11:40:55 executing program 5:
r0 = socket(0x10, 0x2, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
write(r0, &(0x7f0000000280)="1c0000001a009b8a14e5f4050009042400000000ff00000000000000", 0x1c)
recvmmsg(r0, &(0x7f0000002ec0), 0x29e, 0x1a, &(0x7f00000001c0)={0x77359400})

11:40:56 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040), 0xf6)
connect$inet(r0, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  978.565743][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  978.630285][T20109] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:56 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, 0x0, 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  978.783715][T20109] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:56 executing program 2:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0))

11:40:56 executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(0xffffffffffffffff, 0x4008941a, &(0x7f0000000240))
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
pwritev(r0, &(0x7f00000004c0)=[{&(0x7f0000000200)="db", 0x27000}], 0x1, 0x400000, 0x1c000000)

11:40:56 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:56 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x48000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:56 executing program 5:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
add_key$keyring(&(0x7f0000000040)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
signalfd(0xffffffffffffffff, 0x0, 0x0)
ioctl$KVM_UNREGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae68, &(0x7f0000000300)={0xf000})
ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb]})
ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(0xffffffffffffffff, 0xc0096616, &(0x7f0000000340)=ANY=[@ANYBLOB="f7f2"])
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)

11:40:56 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, 0x0, 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:57 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

[  979.605866][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:57 executing program 2:
perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0))

[  979.734381][T20142] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:57 executing program 0:
perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x8200, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
epoll_create1(0x0)
socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000180)={<r0=>0xffffffffffffffff})
sendmmsg(r0, &(0x7f0000001e00), 0x3fffffffffffe36, 0x0)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000580)=ANY=[@ANYBLOB="480000003200ffff00000000000000000000001334000100300001000b0001006d6972726564000004000280040006000c00070000000000000000000c0008000000000000000000ef25242f8a526711809331ff284b3bf8566bafaa535996008ad095ee0f937afc265fc93002befcbb1aff3e0c932b1c82543835e92eeadcf25cf5ada18d1f000000199d9b2c8c3aaa21915599b7e306071317b32c4944697e5b166e37e8f21cb810b5745d3b99cff53383"], 0x48}}, 0x0)

[  979.777941][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  979.971921][T20142] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:57 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x0, @empty}, 0x10)

11:40:57 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x4c000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:57 executing program 0:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0)
bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x100000}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(0xffffffffffffffff, 0x4008941a, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.events\x00', 0x7a05, 0x1700)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700)
pwritev(r0, &(0x7f00000004c0)=[{&(0x7f0000000200)="db", 0x27000}], 0x1, 0x400000, 0x1c000000)
socket$packet(0x11, 0x0, 0x300)

11:40:57 executing program 5:
r0 = gettid()
setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, &(0x7f0000000100)={{0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e23, 0x4, 'none\x00', 0x0, 0x10001, 0x100069}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x80, 0x1, 0x3, 0x7f, 0xfffffffe}}, 0x44)
r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1)
prctl$PR_SET_PTRACER(0x59616d61, r0)
write$binfmt_script(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="2321202e2f66696c65302aeeed2414aa090cd8a4588e4b12333878a40659e1d06b6b450705f00196c020ac7cff23a4baf839823763dacbc3119b7810751192b23b5da3f0340d5a19d886b70969afcf7faf3e9091d1982b3d7ad4927a77220d44b1297beca7f2089cb6598b47f0d80fe0b4ede27576aa3d31a1d542d63b8280f2787efd06e9089696923a043d55f940657d133c1c71a8531659c81c"], 0x191)
sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
sendmsg$NL80211_CMD_GET_MPATH(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x2}, 0x2000000c, &(0x7f00000000c0)={0x0, 0x48}}, 0x900)
close(r1)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
r2 = open(&(0x7f0000000080)='./control\x00', 0x0, 0x0)
symlinkat(&(0x7f0000443ff6)='./control\x00', r2, &(0x7f000034aff8)='./file0\x00')
name_to_handle_at(0xffffffffffffffff, &(0x7f0000000040)='./control\x00', &(0x7f0000fbb000)=ANY=[], &(0x7f0000000100), 0x0)
ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000340)={0x11, 0x4, 0x1f})

11:40:57 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440), 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:57 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, 0x0, 0x0)

11:40:58 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

[  980.645264][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:58 executing program 0:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0xac, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_open_dev$vcsn(&(0x7f0000000300)='/dev/vcs#\x00', 0x8, 0x101202)

[  980.818792][T20188] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:58 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, 0x0, 0x0)

[  980.981079][T20188] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:40:58 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440), 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:40:58 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:40:58 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x50b3bdff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:40:58 executing program 3:
clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
exit_group(0x0)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f00000000c0)=0x20001, 0x4)
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x0, 0x1a, 0x0, "246575a43764d9a14f22edd46fe0eeb5025264c73cde9e09f5ff086e859dc6c5f28557a8046964d2a15b4c2a2bb1dcc5a80c010163c84b00837a7e1e000000907900000000000000000000000800"}, 0xd8)
setsockopt$inet_tcp_int(r0, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6)
connect$inet(r0, 0x0, 0x0)

11:40:58 executing program 0:
r0 = socket$kcm(0x10, 0x2, 0x10)
sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000024003505d21b80788c63940d0424fc60", 0x14}], 0x1}, 0x0)

[  981.684950][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:40:59 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440), 0x0, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  982.728091][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  982.824163][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:01 executing program 5:
syz_emit_ethernet(0x76, &(0x7f0000000280)=ANY=[@ANYBLOB="ffffff00fffff676049167a686dd60a4f00800083c00033c0000000000000000000000000000ff0200000000000000000000000000013a0090"], 0x0)

11:41:01 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:01 executing program 0:
syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f00000003c0)='./file1\x00', 0x100000002, 0x1, &(0x7f0000000080)=[{&(0x7f00000000c0)="0400050900000000666174000404090a0200027400f801", 0x17}], 0x8010, &(0x7f00000002c0)=ANY=[])
chdir(&(0x7f0000000000)='./file1\x00')
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b)

11:41:01 executing program 3:
prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff)
clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x4000000a, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)="0f34", 0x2}], 0x1, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f0000000000)=""/3, 0x3}], 0x3, 0x0, 0x0, 0x0)
tkill(r0, 0x40)
write$sndseq(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @ext={0x17b, &(0x7f0000000140)="5cf249b9740c8684445afd26b76af2f3c921bf3c0f339e57f4f21016a5b60a00088024c30e478947d190ad000000000000000000000064bfa6186165224897ba4ecb40aa071d905814c90761600032a3b88a1f000000970e85a63c9a4b0d8b9aad010000000000000002a7bef7fdffff9f8b01647a0200169c864e1d5f8179cba2e43112cfb22f021d3c34e36cc9509795b0e053c9d31e145c97aa793dd8ceb8281f3b812e14d71b59b83e4bc3b529f3ca0900000096e2c2a4fdca75813f78964c6fe77e39d125650da9ab14624d751e10f063962be791ca675617cc866ed67f34f39c92485b48cd8d1901000034e36d6d434409ea8d2905c48d2456252abbf71748433f88570ad2d50c2bb743c830069f192de24b696882145cbcc9b5644ce7a25dac7d3eaf1618db7f3a9b9147b2afa32b5149d23dcad5170f4a36c5fcbb65d18da32aa97691ee513fba29fbfd7dbf231427b158e33ae6e2765ddc9529c54f5c5c2d69e08cd9043c8de3c97b90357d816b0e46b035781605fd99"}}], 0x1c)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x9, r0, 0x0, 0x0)

11:41:01 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x5c000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:01 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x10}}], 0x10}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  983.767434][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  983.818970][T20249] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:01 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:01 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x10}}], 0x10}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:01 executing program 0:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
request_key(&(0x7f0000000140)='asymmetric\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)='syz', 0x0)

[  984.018057][T20249] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  984.096909][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:01 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x22004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
recvmmsg(0xffffffffffffffff, &(0x7f0000002540)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)=""/160, 0xa0}], 0x1}}], 0x1, 0x0, 0x0)
exit(0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000180)='status\x00')
preadv(r0, &(0x7f00000017c0), 0x1b4, 0x0, 0x0)

11:41:01 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x60000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:01 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[  984.805409][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:02 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

[  985.453112][T20277] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:02 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x10}}], 0x10}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  985.524339][T20277] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:03 executing program 0:
syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x1, &(0x7f0000000080)=[{&(0x7f0000000240)="25bca274769e620a2734fa0095e0612687ecb86a548802a902000000000000004e2f98b579a782d270146d0e0206e73ba8c63cd7dcc6760253ef", 0x3a, 0x400}], 0x0, &(0x7f0000000100)={[{@noquota='noquota'}]})

[  985.844075][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  985.852344][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:04 executing program 3:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x71, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$bfs(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
setxattr$system_posix_acl(&(0x7f0000003e40)='./file0\x00', &(0x7f0000003e80)='system.posix_acl_default\x00', &(0x7f00000041c0)={{}, {}, [{}, {}], {}, [{}, {}]}, 0x44, 0x0)

11:41:04 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x68000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:04 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:04 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:04 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:04 executing program 0:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$GIO_FONTX(r0, 0x4b41, &(0x7f0000000000)={0x0, 0x0, 0x0})

[  986.883711][T20302] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[  986.897332][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  987.022205][T20302] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:04 executing program 0:
ioctl$SNDCTL_SEQ_GETTIME(0xffffffffffffffff, 0x80045113, 0x0)
clock_gettime(0x0, &(0x7f0000000200)={<r0=>0x0, <r1=>0x0})
select(0x0, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x100}, &(0x7f0000000400)={r0, r1/1000+10000})
ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0)

11:41:04 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:04 executing program 3:
perf_event_open(&(0x7f00000001c0)={0x2, 0x70, 0x71, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_mount_image$bfs(0x0, &(0x7f0000000240)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
setxattr$system_posix_acl(&(0x7f0000003e40)='./file0\x00', &(0x7f0000003e80)='system.posix_acl_default\x00', &(0x7f00000041c0)={{}, {}, [{}, {}], {}, [{}, {}]}, 0x44, 0x0)

11:41:04 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x6c000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:04 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:04 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[  987.924793][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  988.032388][T20329] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:05 executing program 0:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000600)="585ccbe5ed83b836c1a67e4914dc55e72206297b6895b66147b3c7ed090000a85ea0bdc9e1587a050000000000000042e33089754c8107c3cd3923dd4a71c2ff06cce20c44a73ffbf27c73295a445c01b191007b6b4816122d2550829eaa9435c99926022b8753a188748c569f435fb3ba4a95fd1dd5c44a68b0725be6027d152f5e8e198a29e5c0d0c60000ce0637ce0000b4ec24c53d3d661ff5ff70e48884ca000018ad1fcfacf40d32e4b58a8d2725561f6110fd7b06f90b5274cc5c1e29", 0xc0, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f00000005c0)={'syz'}, &(0x7f0000000100)='\x00', 0x1, 0xfffffffffffffffd)
keyctl$dh_compute(0x17, &(0x7f0000000080)={r0, r0, r1}, &(0x7f0000000440)=""/243, 0xf3, &(0x7f0000000540)={&(0x7f0000000000)={'crc32c-generic\x00'}})

11:41:05 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0)
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:05 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)=[@timestamping={{0x14}}], 0x18}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:05 executing program 3:

[  988.220050][T20329] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:05 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:05 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x74000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:06 executing program 3:

11:41:06 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x0, 0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:06 executing program 0:

[  988.887881][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:06 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  988.965437][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:06 executing program 5:
socket(0x11, 0x800000003, 0x0)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[  989.060426][T20348] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:06 executing program 3:

[  989.256314][T20348] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:06 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x0, 0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:06 executing program 0:
r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0)
write$P9_RREADLINK(r1, &(0x7f0000000300)=ANY=[], 0x65)
ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, &(0x7f0000000180))
sendfile(r1, r1, &(0x7f0000000240), 0x7fff)
sendfile(r0, r0, 0x0, 0x7fff)

11:41:06 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x7a000000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:07 executing program 5:
socket(0x11, 0x800000003, 0x0)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:07 executing program 3:
write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000001440), 0xfffffc41)
perf_event_open(&(0x7f00000002c0)={0x400000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffeffffffffffff, 0xffffffffffffffff, 0x1)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d)
dup(0xffffffffffffffff)
ioctl$sock_SIOCGIFBR(0xffffffffffffffff, 0x8940, &(0x7f0000000000)=@get={0x1, &(0x7f00000001c0)=""/133, 0xfff})
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0)
bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xda6, 0x4)
writev(r0, &(0x7f0000000140)=[{&(0x7f0000000b40)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba00a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296dee360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b7259415f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a", 0x7a}, {&(0x7f0000003280)="1bc72bd99d387d8075383aed46af6ec268f859d9744a10c8770b29c4d0b553d501330c10d16ad73644a81fbfb06c5bdeabcf39139157ec0b873a66269136dd0e797f24afcf068b6a79a643c56a4e3b3b0405ebe8db0c3b36437db5f1181a2d2efa7fecb51cfeb2e399c32b9d0dc29949eae7194d1e1e0171e343931188508cb6142b954358aadf387e68ae5486c73bb635c399a755bcf6b71b494b491727d4959b871e701213b8452690cc8ba94394e6244e455830f16e166ee38c2a4d98a70e39f0fddf45b6a79037aeabe2c8245da4acdd3b148558568d1ea7a8a4c491d7465dec61bd80a9883e2f94abfa3d6872a357b7d15748d2bcd26b47a55e9f81099d61cebd8561f56781dc699812bd3064ca34e19b65cb95e510b7c9cda8cd5f631094d953ff7203b06784438784c01042679540076aee842bcef98fbedfae2581e1258f0cecf99cef4c0e1231577f6cc4308c8d0e13d1e7af3c3bc2884ec46a38793d9fb2ad5f22efcd91e61ce2bdb9569ac60cce629853a693bf5136357f8ee729c1b3ad37a4210f9c4f112b17cbe13251877297d7940510850b731039680e61ce7ce9801f5a0fc417fc7deb623063cb1dd9d3627579aff98187b57179c51c990d912373b0716d4a93c26bbe0169cedabc3c09e9cbdc4fab4cc631c99cda7f090dd5e1b2e61d2fc5543f62b2665bd9f8c38b0e7b90dca8d53f890f148e50c2635a1c1a301398eff903d6eda5d7b3af30b6fe8617e57c9513099fce85d899e358d094a9a3841c1ee7766ce7f3cf1e4a541b11fe1b06280a5480c4f0c2c33b1e66ad2aa5f172680b694256f6b9a94447fbb2b752d9a0b5477eb421bd1e4c2f9778e0f8b766ac4b4f67247575afcefe332da072967827f770eb66d9bbabed97108f57cdd21da0cd6f8aeb3cde11e7a1db6c92f9fac73e8f902c97d7b637bd4da8efacd1ac2267dd20708a2b4e397a88a44966d468d15c2c96460894b16e047c5e91c59cc5897e742c929345b3537e3b5f6583f5ab7191cf72de2ed6567c4651f685efe8d14d4276bb8729b57485506315363ed16f8908a314e7e09e8aabc98e306f944aa97f8ea395edfccf559bbed2e4a887a861736004070568e66318f2705bbe6aa7fc655d9b23264bb84bb14efcf68804ad", 0x331}], 0x2)
sendto$inet(r0, &(0x7f00000012c0)="1a268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27)
ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r0, 0x8982, 0x0)
read(0xffffffffffffffff, &(0x7f0000000180)=""/19, 0xfffffe47)

[  990.007655][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:07 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  990.055062][T20370] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:07 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x0, 0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

[  990.240223][T20370] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:07 executing program 5:
socket(0x11, 0x800000003, 0x0)
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:07 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x8cffffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:08 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x0, &(0x7f0000000140)})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:08 executing program 0:

[  991.045720][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:08 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:08 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x97ffffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:08 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:08 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x0, &(0x7f0000000140)})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:09 executing program 3:

11:41:09 executing program 0:

11:41:09 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:09 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xc0ed0000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:09 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x0, &(0x7f0000000140)})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

[  992.004578][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  992.084508][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:09 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:09 executing program 0:

11:41:09 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[  992.499336][T20427] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:10 executing program 3:

11:41:10 executing program 0:

[  992.683882][T20427] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:10 executing program 0:

11:41:10 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:10 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe0f5e1e2, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  993.126045][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:10 executing program 5:
r0 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:10 executing program 3:

11:41:10 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:10 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:10 executing program 0:

[  993.686985][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:11 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe2e1f5e0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:11 executing program 5:
r0 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:11 executing program 3:

11:41:11 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x0, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:11 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  994.164641][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:11 executing program 0:

11:41:11 executing program 3:

11:41:11 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe6080000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:12 executing program 5:
r0 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:12 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:12 executing program 0:

11:41:12 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:12 executing program 3:

[  995.050328][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:12 executing program 5:
r0 = socket(0x0, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[  995.205789][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[  995.239030][   T28] audit: type=1326 audit(1599046872.678:59): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=20489 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0x0
11:41:12 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe7020000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:12 executing program 0:

11:41:12 executing program 3:

11:41:13 executing program 0:

11:41:13 executing program 5:
r0 = socket(0x0, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:13 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:13 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[  996.245735][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:13 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe7080000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:13 executing program 0:

11:41:13 executing program 3:

[  996.725760][   T28] audit: type=1326 audit(1599046874.158:60): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=20510 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0x0
11:41:14 executing program 0:

11:41:14 executing program 5:
r0 = socket(0x0, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:14 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, 0x0, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:14 executing program 3:

11:41:14 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe8020000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:14 executing program 0:

[  997.288111][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:15 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f00000000c0))

11:41:15 executing program 5:
r0 = socket(0x11, 0x0, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:15 executing program 3:

11:41:15 executing program 0:

11:41:15 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, 0x0, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:15 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xe9020000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[  998.059361][   T28] audit: type=1326 audit(1599046875.498:61): auid=0 uid=0 gid=0 ses=4 subj=system_u:system_r:kernel_t:s0 pid=20546 comm="syz-executor.2" exe="/root/syz-executor.2" sig=31 arch=40000003 syscall=265 compat=1 ip=0xf7fba549 code=0x0
[  998.086052][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:15 executing program 5:
r0 = socket(0x11, 0x0, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[  998.325607][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:15 executing program 0:

11:41:15 executing program 3:

11:41:16 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xf6ffffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:16 executing program 5:
r0 = socket(0x11, 0x0, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:16 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, 0x0, 0x0)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:16 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0))

11:41:16 executing program 0:

11:41:16 executing program 3:

[  999.365696][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:17 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x0, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:17 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xf8be0200, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:17 executing program 3:

11:41:17 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0))

11:41:17 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, 0x0}, 0x8)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:17 executing program 0:

11:41:17 executing program 3:
r0 = getpgid(0x0)
perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3}, 0x0, 0x0, 0x0, 0x0, 0x3}, r0, 0xffffffff, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000180)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
write$binfmt_misc(r2, &(0x7f0000000000)=ANY=[], 0x4240a543)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000500)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
recvfrom(r4, &(0x7f0000000040)=""/184, 0xffffffc9, 0x40012584, 0x0, 0xfffffe53)
splice(r1, 0x0, r3, 0x0, 0x8900000, 0x0)

[ 1000.406575][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:18 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xf9fdffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:18 executing program 2:
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f00000000c0))

11:41:18 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x0, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:18 executing program 0:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x0, 0x0)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f00000000c0))

11:41:18 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, 0x0}, 0x8)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1001.124845][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1001.445657][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:19 executing program 0:
setresgid(0xee01, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, <r1=>0x0}, 0x2020)
write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1}, 0x50)
syz_fuse_handle_req(r0, &(0x7f000000e3c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000027000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x0, 0x0)
ioctl$BLKTRACESTOP(r2, 0x40086602, 0x7ffffffff000)

11:41:19 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfbffffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:19 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x0, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:19 executing program 2:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000001c0)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fffff7a}]})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, 0x0)

11:41:19 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r0=>0xffffffffffffffff})
r1 = socket$xdp(0x2c, 0x3, 0x0)
r2 = socket(0x100000000011, 0x2, 0x0)
bind(r2, &(0x7f0000000300)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
getsockname$packet(r2, &(0x7f0000000240)={0x11, 0x0, <r3=>0x0}, &(0x7f00000002c0)=0xfeeb)
r4 = dup2(r1, r0)
bind$xdp(r4, &(0x7f0000000100)={0x2c, 0x0, r3}, 0x10)

11:41:19 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, 0x0}, 0x8)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:19 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x0, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:19 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfdfdffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:19 executing program 2:
mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x400002200006007, 0x0)
r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0)
unshare(0x44000600)
ioctl$LOOP_CLR_FD(r0, 0x4c01)

11:41:19 executing program 3:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8c}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0)
ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f0000003280)=[{{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}}, {{&(0x7f0000000ac0)=@ax25={{0x3, @rose}, [@netrom, @netrom, @bcast, @bcast, @null, @default, @remote, @bcast]}, 0x80, 0x0, 0x0, &(0x7f0000000540)=""/46, 0x2e}, 0x4}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000640)=""/161, 0xa1}, {&(0x7f00000004c0)=""/118, 0x76}, {&(0x7f0000001500)=""/4096, 0x1000}], 0x3, &(0x7f0000000340)=""/27, 0x1b}, 0xdd7}, {{&(0x7f0000000700)=@x25={0x9, @remote}, 0x80, &(0x7f0000001080)=[{&(0x7f0000000800)=""/158, 0x9e}, {&(0x7f0000000cc0)=""/96, 0x60}, {&(0x7f0000000e40)=""/217, 0xd9}, {0x0}, {0x0}], 0x5, &(0x7f0000001100)=""/102, 0x66}, 0x2}, {{&(0x7f00000009c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000002500)=[{&(0x7f00000002c0)=""/59, 0x3b}, {&(0x7f00000008c0)=""/181, 0xb5}, {&(0x7f00000007c0)=""/44, 0x2c}, {&(0x7f0000000c00)=""/59, 0x3b}], 0x4}}, {{0x0, 0x0, &(0x7f0000002600)=[{&(0x7f0000002540)=""/1, 0x1}, {0x0}, {0xffffffffffffffff}, {&(0x7f0000002580)=""/75, 0x4b}], 0x4, &(0x7f0000002640)=""/2, 0x2}}, {{&(0x7f0000000580)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x80, &(0x7f0000000c40)=[{&(0x7f0000000980)=""/31, 0x1f}, {&(0x7f0000000a40)=""/20, 0x14}, {&(0x7f0000000a80)=""/55, 0x37}, {&(0x7f0000000b40)=""/168, 0xa8}], 0x4, &(0x7f0000000c80)=""/21, 0x15}, 0x8}, {{&(0x7f0000000d40)=@ax25={{}, [@null, @bcast, @netrom, @bcast, @rose, @remote, @bcast]}, 0x80, &(0x7f0000001040)=[{&(0x7f0000000f40)=""/245, 0xf5}, {&(0x7f0000001180)=""/224, 0xe0}, {0x0}], 0x3, &(0x7f00000028c0)=""/123, 0x7b}, 0x8}, {{&(0x7f0000002940)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000002e40)=[{&(0x7f00000029c0)=""/205, 0xcd}, {&(0x7f0000002ac0)=""/217, 0xd9}, {&(0x7f0000002bc0)=""/210, 0xd2}, {&(0x7f0000001280)=""/12, 0xc}, {&(0x7f0000002cc0)=""/156, 0x9c}, {&(0x7f0000002d80)=""/181, 0xb5}], 0x6}, 0x7}, {{&(0x7f0000002ec0)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000002fc0)=[{&(0x7f0000002f40)=""/71, 0x47}], 0x1, &(0x7f0000003000)=""/57, 0x39}, 0x6}, {{0x0, 0x0, &(0x7f0000003180)=[{&(0x7f00000030c0)=""/182, 0xb6}], 0x1}, 0x8}], 0xc, 0x22, 0x0)
pipe(&(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
fcntl$setpipe(r3, 0x407, 0x0)
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000100)={0x0, 0x3, 0x800, 0xfffffffffffffffd})
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x3, 0x100000000, 0x2000002, 0x0, 0x0, 0xe7}, 0x0)
r4 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d)
bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10)
setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10)
sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0xda6, 0x4)
writev(r4, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a78c7b5a19e97447799d930f9623b", 0x8b}, {&(0x7f00000001c0)="96431fb1cb119741590ad657dc5e5ce3e5fe9f1f639e6a18bc7b6c1d0b424eb306f34cf2429c62c0fdefbae36740a7169721af852826d7f14b6cae8af86507ff78a1dda991aea5952f43e7e0146a3c035f0113d617240e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d784e0c89135b82b321f8e43d7a5db9ab1bfd319f472a94", 0x8d}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c025150940cdead92eb1e6bc6ba45eecf067b32425b6000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68677c7b261de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752cdfe458ddf54e8fc10ff79b5", 0x1b9}], 0x3)
sendto$inet(r4, &(0x7f00000012c0)="1a268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27)

[ 1002.492675][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:20 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x0, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1002.930784][T20658] IPVS: ftp: loaded support on port[0] = 21
11:41:20 executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@bridge_delneigh={0x24, 0x1d, 0x1, 0x0, 0x0, {0xa}, [@NDA_DST_IPV4={0x8, 0x1, @local}]}, 0x24}}, 0x0)

11:41:20 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, &(0x7f0000000280)}, 0x8)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:20 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x0, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:20 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfdffffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[ 1003.299477][ T9488] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1003.371978][T20658] IPVS: ftp: loaded support on port[0] = 21
[ 1003.525658][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1003.690654][T15864] tipc: TX() has been purged, node left!
11:41:21 executing program 5:
socket(0x11, 0x800000003, 0x0)
r0 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:21 executing program 3:
r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0)
r1 = creat(&(0x7f0000000040)='./bus\x00', 0x0)
ftruncate(r1, 0x12081ff)
fcntl$setstatus(r0, 0x4, 0x6100)
write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0xf642e7e)
fallocate(r1, 0x0, 0x1000000, 0x4003fe)

11:41:21 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xff0f0000, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:21 executing program 0:
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@local, @in6=@mcast1}, {@in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}]}, 0x138}}, 0x0)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg(r0, &(0x7f0000000180), 0xf1, 0x0)

11:41:21 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, &(0x7f0000000280)}, 0x8)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:21 executing program 2:
mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x400002200006007, 0x0)
r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0)
unshare(0x44000600)
ioctl$LOOP_CLR_FD(r0, 0x4c01)

[ 1004.167572][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:21 executing program 5:
socket(0x11, 0x800000003, 0x0)
r0 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1004.565360][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:22 executing program 0:
mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x400002200006007, 0x0)
r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0)
unshare(0x44000600)
ioctl$LOOP_CLR_FD(r0, 0x4c01)

11:41:22 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xffbdb350, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:22 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x0, &(0x7f0000000280)}, 0x8)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1005.151318][T20746] IPVS: ftp: loaded support on port[0] = 21
11:41:22 executing program 5:
socket(0x11, 0x800000003, 0x0)
r0 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1005.605196][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1005.714408][T20770] IPVS: ftp: loaded support on port[0] = 21
11:41:23 executing program 0:
r0 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd)
keyctl$chown(0x3, r0, 0x0, 0x0)
keyctl$read(0xb, r0, &(0x7f0000000140)=""/139, 0x8b)

11:41:23 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfffffdf9, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:23 executing program 3:
r0 = epoll_create1(0x0)
r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff)
r2 = syz_io_uring_setup(0x76d1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
r5 = socket$inet_udplite(0x2, 0x2, 0x88)
r6 = dup(r5)
ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200)
syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_WRITE_FIXED={0x5, 0x0, 0x0, @fd_index=0x4}, 0x0)
io_uring_enter(r2, 0x346a, 0x0, 0x0, 0x0, 0x0)

11:41:23 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:23 executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@ipv6_newnexthop={0x1c, 0x68, 0x101, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4, 0x3}]}, 0x1c}}, 0x0)

11:41:23 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x0, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1006.644995][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1006.800017][T20820] netlink: 'syz-executor.2': attribute type 3 has an invalid length.
11:41:24 executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x8, &(0x7f00000002c0)=0x3, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x20000004, &(0x7f0000b63fe4), 0x1c)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0)
openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x1c3d40, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
r3 = creat(&(0x7f0000000300)='./bus\x00', 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611)
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0)
getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @vti={{0x8, 0x1, 'vti\x00'}, {0xc, 0x2, 0x0, 0x1, [@vti_common_policy=[@IFLA_VTI_LINK={0x8, 0x1, r7}]]}}}]}, 0x38}}, 0x0)
sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @vti={{0x8, 0x1, 'vti\x00'}, {0x14, 0x2, 0x0, 0x1, [@vti_common_policy=[@IFLA_VTI_FWMARK={0x8, 0x6, 0x6}, @IFLA_VTI_LINK={0x8, 0x1, r7}]]}}}]}, 0x40}}, 0x0)
bind$xdp(r3, &(0x7f0000000180)={0x2c, 0x0, r7, 0xa}, 0x10)
getsockopt$inet6_buf(r2, 0x29, 0x45, 0x0, &(0x7f0000000140))
ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000100)={'virt_wifi0\x00', {0x2, 0x4e23, @local}})
ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000000040)={0x4, 0x9, {0x57, 0xfa, 0x4, {0x9, 0x401}, {0x4385, 0x1ff}, @ramp={0xf582, 0xfffb, {0x2, 0x5, 0x7fff}}}, {0x55, 0x8, 0x7, {0x1, 0xe000}, {0x6, 0x3}, @const={0x5884, {0xff, 0x0, 0x80, 0x4}}}})

11:41:24 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:24 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfffffdfd, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:24 executing program 2:
r0 = socket(0x10, 0x80002, 0x0)
r1 = epoll_create1(0x0)
r2 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240))
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x10000001})

[ 1007.211077][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:24 executing program 3:
r0 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x0, 0x2)
syz_open_pts(0xffffffffffffffff, 0x2e0841)
write$binfmt_elf64(r0, &(0x7f0000003880)=ANY=[@ANYBLOB="7f454c46067f1f010800000000000000020003000600000080030000000000004000000000000000e60100000000000000000000400738000100050007000002050000002d010000e1780000000000000000000000000000760a000000000000ffffffff0000000006000000000000000300000000000000783e3a5ee762aa49d5bc317a8ef6abff3bf4db8e95ec86408cc4addcc25320da3b38abe1926195b44b876ec5960ae4751002b0ace80e206d39da6dd1b1163270c5882bc5af5ef587f10e2b2f52cfb25b952b39f76091e8292e87f0a5e305c2b37108d90891159d8a76e3ce8f950185bf6a8bcba5f6c77c24dafc37dc3fb800438483bc8dcc1a0f768ad5e49e9e544c29de5ad76636cf8d1d75567c82e0511b7bbc653f039758f4ccf96a60693f4169c0a05647af9fec26c331c71c7359aadb6d9d99284b17d93ec12d7262e66ecdd40ed7f8bbe6f3e3a5d0fb93b5b974a5b392e157215b3d5162d745390844ffbddfc8c24156ffc849514c999284f1a4b01482403a42793aea5e5c399e3978ebef1f8d4df2fddb70f881f85eaeeb4b2eb4eee2b943a74842d27342806c4da821020e65a044d2638588988a2920ca28a912fb9554fd1005e365a0e2469c884a64039782fe2077155e5f209148d7b969f859ce2f541765cdadbbf9cf76074b2c9ba110c9e90fd880c6dab6c06bef93605f7a083daec28b50bd43754806d61af1aff5b4644d5fe9290349343a6f46a8a3082a51cb4afae6c3db523fafa7bf50926801062e8aabed653f0ba97d51edebad27c048108cac6dde9dbb0b6ce44359c7af6bfb96e40124f55558fb6ea0d738acd682d07cb35cead5b805ea03171134a62f88958b221b99f95ae2fed48c87bfb81a5a2eefd5114775313056ee9f1b83f88bde26a63bac034754805b0df6575614f63a4c5e2978ca1177fbf21003513f1b5b5274262cb99348202fe1c1af8c73619946d5a17447a827397bc6c6f817f3a5a3524bc7f88bafe62c4f2922940e2e3d71991f10c1397e5e7808a8f64d7a51475fa359092330a5faba34fc859324e40e80bc7c4c0294f06ae25c8f0247d9b5296b44ef18405f6e735eddb1af2373a8cc07e1667aed79259888f9d025499a76fb73bb85e6f684f24655c37c6e36976533982bb4783764b37f7bdd951f611f7d80aead7fb39c585263a51adfe5681c20987fafae8019a08ff10f65cf86448476d70123abafd78ac220a445236059949414f74a0351f1611e31524faef73eecf0fffa831acf451cc0e76257f388b6bb8fdda3674cc34064f71a219341897f593ec4e2cb482457e55fbdf41dcceda4b80ab4c00fe5557e4e14d19a820726fbb8d0731f790f98e3cb4670708bc75f587c099756b7d58c013b04e9d18bac63c0cd86192d90276d02be15ef57f90006a439c680fb4e86134dcb78e8cd2d767cf2e0cc05108e211c91d5f775f37be7b82212015e3b66d94416516451d8febff74cabbd0dd09f64659a648f83f7a88a18fd02036f5441eadafd5c51a0024e92f27582c400d4a9f59d8810e57a59329d000ff480dcfab6eb2e7527a80fa71a62e5bb830dcf8e3414fce003c9923a43a03fcced287e0152eef6aabd4e9d73e4f5ca1faa27fc16fe798efcdfc75e3cfbcd00e5299918c04294a77cb3fa5ea26dc4d7cb0f823f489efe31c564594d731c01e260b8051447b348fc8042ba18c3df20e3ffd85f393d559a077118486fb3985793adbb70ebcd4e68e5a92b4077a1c779667bdc7594767c5e10380583586a2c98a2bb17e27d547aef51e5cdcf8cea490a0358e45421d26f74b2cce0149818afef25096542664ce630966439fd31f1b941dfd015b8a5b0872ed2cfc53791a0022054067ae92ea7efaf259e18c3078ba09ed8934f496312ae4b0e0aa3570bd4ffd42616599044bd50f6f831787ac7d7e834e5d9c41eec21e9cf2b8de39a06ec58ca8659644f15b1f5ae0176069b518c0a69e9d943e89b398639e57a9c03a461ef522b6284ddbf27ca77b1f2b05e423cd11b2e2062a948c53ff530ffce17a07882532cf3eba802eff71f17d1545669b243a24666d78f0737f2621f8743625e0c5ee63f7a7793ed578440a78c698f499abf6290957f9ebb6a6fe81dae016a13a3cf944f30220aba18fbc3409e753020a4ecacb518fbf9dcc5499d9f4637458ac4aab637aebc63981530b7c5f301e1b1ae1b1fd5ebded9d962df5b7e1361aaaa6ebcb8199a5bd9ad0e5d8613300ed3af091d4c65e1228d9417bfce5db2e3b3081a018ca7431259cf44b198c198da838c25394a7cc607e35ea1d3de6d87cd29ee6e42bea156f7db235952fa2de67cf2347305ac4f163216711fb4165a4966058993fa172366ebddb23ddc24613741cb3c06f2f4e2c7ae2685b2691d67ffc1d72bb875d9d12b23a03fa4ffb06e6b57a7ddbebbdb680fb001bb373603f4ff1a9be790ad52826f338f55905926e90cdcd5e1d64353b05f249e900355fdcfa36b30ee85968d6275bf19b67bad038f9961fcc9b511936c1b40a54a03b7f9f40503cf7d93c1ee8e16d0010e237891992088f15d4ea3ca9a37861c9dd56acbbe360b4951654672b283a74ec5a6b04841283fa2224b36361f9477d06e248bbb974c35912c1936b6ef20f8040ae892ae20437fb340f2640b900027667ba1b4264b8e79ee1ca4d42870852c4949ab880375d1c0ca5bdf27849d726caf80d3e181cdfcabb484d575260156911c45180f643cf962290c153499efb7b53440c5eb27326bdb98d71005c71af9213f6b42035f1599783c9f02a1a9beaaef418d608dcfdcfc4ef2aeca168561c17300166d2ce5056a05b6ec739b163b5bb21b2a8e16920b63a9e07942c6957f13e4025eb8cdcdaec154ca732a56b2bc83d869627cbba3338e68789c413864c06007e8a739fad611c65959382fd66334f5ed5f084616dbb02063eb50bc34e34511ca74732216115727c655e411c7d708322262b9348ecef642935245f2e08566429f31e969e8cb5a0c7c553518c6ecceeb1ad4ca538531f557880a77eaa99cb94c63c07bab5979194d6f2b9d37c3aa144e5f06ac29070717d67c6a391798401ff84b1abedd5af5b1dbd05bbea122db0723e3253304e76d1620ad6a440ea2dbdc01108478f25eacbf0cef67bd105a818e21dc80e03e2170e7e2c366aae2c04200b686139be05bbbb558ee8366b477669c94d8e420cb83872e6b6f8f4ae78abf7c2639645906b278c94c2fe5e76c37a85d2d3969b5c8d535cd70997f82e80428dddf23170d622c2a0e8b364536571da0737162c21fde3cefd62c6141eae58258d3678443ef626cffe78cf645c1930fe5426ab05b78c91fe5b5c358b4da7a9e2a4cc74cd8de66381d68573f5c0857864da1a6e7e934a063ddd15ddbfae9f70655039eec28f842e41f517d49e6581bb543d340680196e67718b02597c190e4aa762ebb9c24ac5c71482f56789fb56f4db8d596c9b93e4999f141e76dfc75f45711fc0028ed0ec6b307b095d3ee5da91a323c9b688b262d18a93a38fb0b0c9239ca07bb6b262b69419642a7ad1e45d1665db46d6607e77c6129b8610d7358dbda78bc2db01dfd302fbf8190947ca57e807a76325a792a442ee5e4a4e506f6ec3351a17e6ca4acb827eacf45ac39812392c3d3cd20b1789b3209265d7ee40f4ddd7f61e671782f4bc4415adce34eb486fbbdb48582afd206f47763916d708887298ef8276d0f134696cea70a8dcbdf312c5aad2431ae549a0a6cacd0d0dc9e40bb46ada88e8f222f7675a32bb7132abf5a3a4af0fef56e0e1d9540b56999a28dfefb559eb5db23acf8cf3f777a7bd258bbb3a9501e55593b2b688bc3a8be9196f4b3fa74c8b2232715f3fdbe3ca3153be026fc16d5f24194f8a85f38a04ad90645d47f3fc4e4377fa632f7aa639842d03c4d1866c1174f3270586dbe12e636de128656008724e44171120489bccb147bb7a5aa93421d1c4ac045df2efbd98b475a5d7b87b6d36b88f1eef2d30ca316506ec2727efe4de2ce290ecd93ab561b4166927959e0bc91d357e76215e0e49986b3791339cb9144b3d3f2acc96b2d353f4678e4edeadbb5857ebec4937654dcbf3086bc329022d7e97b633f418910b4e3590939d13c3e1181c418f7e2150734bce02fb7106aae6e5f1e4ca2046ca2f9ac182ea1cf34ed37da0d052236fb2b2db272416506fa2da54391ae92982c55f67082077af529fcbc915893c0ca20b11617e3965ae25efd538704e751d9b8269a1c91e3c4e93ecd3526b34a26a81ff8658f4a1914e7405acbaf9757588e6cf47ced466a09b58b6d74c17ba0afe65ec8558396e71c20bac66e7e32b3fa728532bf6c8cb3e2c48d61aad5eb4ddbb21c5882a57a3661e413dd0084312c27edde18354f1b757ddda42ab724656bb67bb1f128829f1bffdf60c739f2fc0f496f8839c073ff70a7c457c8c173725483414611acb6b9bcab3f671520e46a6363aa996c411010d20429d63ddbffd44ba8eb7a0b3446a62cd75a82b4da438aea7676c72554113b421629899afa32a0782985522128f56acdb4247e06f44c5271968fa683b356416b69d3150e733b1239b820640b8622ca302caca47d96c6fd046390a7bef1d15e913ee972802ccafda71209ede2e6f556dcd4c3dfaddb53bbf3009042c286648aa0b8cac36407c37ed7ced2093e4c38a0f0ba270be4a89f29066458a5ef5e4a37915ce5d3deed8472307137159b6da09389c9b8b6cff5a37e4a867bfdf65fc879f97526c84b5ca7b628d78b8620e8719d34dc3ef4f45d287cd22ac862e7cf3b08f51b87044508ab0573c89903000000009b10faa87aac5eb852837e1bd259061335446212d39d11d25c36704db0bdafd282500377b90c040da2de5442964c9ad92086b7161388312bec00575a60ac088b4f7be1bbcd4dcd254d4294b388606e6e4eba9f00348b730b17040de48342e3ddfd9df9f6ecf7ef9f517a423018efdf2c040169eab5ff5adff5e67997db7ad10016a1a997e0df4b179fac7fabe68ffe23f8ab09b03788e958de29fbbb6f74f9a6f0a6b2f768a79972116ffa28ffafcf401be5e324c7760132e9d18409bb0741e09174bae22666f16bc30a2a5dafb7ff8458730885ebf5a8eda5f3a5746385aae18ee1b68194faf4fe0eb7437f030e2fdca6e967ac69b6d8c92bb88890b76b66222515d64d73c33b5eff741f38fa0a412a395f9e5b535098ac94059fd79d77d33d7519583f1357cf3df94a14888300d9255060f52d2edd7170c41d90456b18ebb6d900e67e50068541745c88901ad4ab783213d3aa7c40c022a98f89a6603e192b198d22b42118f5d66fc19e7a259453b5e2267437d1ebcc3a473cf54d645e950c045f841ec5f88a45556bae9fecedb614173f2a43921380c44024ffa0d4dcf9cbd71d2a0fa583da5bef6dd07e6ec6b5640fc3bbc06aa4b9d22b31d305ae227aff6cc78961ba8e7306967a7842fa8c65d21f7ae63a0ff063997eccf70d43a50edb591b52b5603eb19cee353568fac80f4a9958a51a885779cbcde1c082cc3bae1f96cef54c5408dfde2d835d78ef02a2f87e0ae8b53af7356cd03689baa69b9dcbf3f1156d50f7cee3320f03953665f1cdb29be2a39bbb0df81484d03571f49e0d028e55ea8a5759439a8c7f7815a621e1d260042c87fb0b86da7b972645912a46892dbc4d57dbf912a527aa5bff67514e707ba0f55133eb520cdf0e4e38d467d606e59e2d43d6f96e189c7f8b9aff38b692bb7697a6f6247645acc50e4bf478058ff8faf8916038cd07d4d88700434a4886761e5f9a188ff15ffd5154c152a3b30209b9a7b859430a4d6d62ebf48e4f7e01d6b23f60156e69ed101254bdcc8d7b74c812c61a5a070245fd78de9c42c8078662cc8a3d4a978fc6e9f0a5ddf36ffff04b500ec221ca8a3bc709c0319b7bc9057af2bdc2563bc9afb18d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000084a5ce175b87fe6fda000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000210000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001200000000000000000000000000bab44c2070e49c2100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000013ec000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000072a520f53ffc760163f9e473d6d884661ae04780ae691d769e90ba1caf5803d343a1d044f7693abea0622085fc221d37e37bc847f6a8ad77f0c2590bfaf9b4923087bc64a628880f9dfab736fc13cd0bb546bd8ba9e1eaa486b511b6793ac69e2b3798d3ce3d6dab1863a377385182e15d90"], 0x1a78)
ioctl$TIOCMBIC(0xffffffffffffffff, 0x5417, &(0x7f0000000040))
dup(r0)
ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000000140)=""/24)
r1 = open(&(0x7f0000000000)='./bus\x00', 0x141842, 0x0)
mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x2812, r1, 0x0)

11:41:24 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x0, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1007.686731][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:25 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:25 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xffffff7f, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[ 1007.938014][T15864] tipc: TX() has been purged, node left!
[ 1007.972959][T15864] tipc: TX() has been purged, node left!
11:41:25 executing program 2:
r0 = socket(0x10, 0x80002, 0x0)
r1 = epoll_create1(0x0)
r2 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000240))
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x10000001})

11:41:25 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1008.027723][T15864] tipc: TX() has been purged, node left!
11:41:25 executing program 3:
open(&(0x7f0000000080)='./file0\x00', 0x881ff, 0x0)
r0 = open(&(0x7f00009e1000)='./file0\x00', 0x0, 0x0)
fcntl$setsig(r0, 0xa, 0x11)
fcntl$setlease(r0, 0x400, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
fcntl$setlease(r0, 0x400, 0x1)

11:41:25 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x0, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:25 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1008.725388][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:26 executing program 2:
r0 = socket$inet6(0xa, 0x800000000000002, 0x0)
setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast2}}}, 0x20000290)

11:41:26 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xffffff8c, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:26 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:26 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:26 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:26 executing program 2:
syz_emit_ethernet(0x56, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, {[@timestamp={0x5, 0xa}]}}}}}}}}, 0x0)

[ 1009.300759][   T28] audit: type=1804 audit(1599046886.738:62): pid=20867 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir809268201/syzkaller.e2hHTV/477/file0" dev="sda1" ino=15797 res=1
[ 1009.451783][   T28] audit: type=1804 audit(1599046886.778:63): pid=20883 uid=0 auid=0 ses=4 subj=system_u:system_r:kernel_t:s0 op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir809268201/syzkaller.e2hHTV/477/file0" dev="sda1" ino=15797 res=1
11:41:27 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000180))
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:27 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1009.769462][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:27 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xffffff97, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:27 executing program 2:
syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1}}]}}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x101, &(0x7f00000002c0)=@string={0x101, 0x3, "c43daceee5e11c0f4e8d40b85afe7319e67445fbc99ec1ba081344b653da5b396451fb6d10e07ca22b1791848f3185c336a80b5980faab8b21d4544c3b71f22767b2a661ce6eaf09a638d22e967ecffebd1051414b8e5169be72a31c0292dec998a5d6bbaee5caa98f81df2b4defbc488c595bb8c429db5d03b8b597b9747b7088b6c7ec7b8ec1d7fc8f61873ed09b2f07874db93358a77308439bdbbaa1e4fdee5e2cf6820f204e0686ef68389dfe9677f306252c91a0a44e742bd7c25702af2457764e6102d8bc52688987c87f82eca21a73420413c9f236eebd7bfe67c4bc6c8ce5874069e2272abff50b0d8658273b7ce182c43906018fc7e4680f4622"}}]})

[ 1009.891051][T20897] syz-executor.2 (20897) used greatest stack depth: 3928 bytes left
11:41:27 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r1=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1010.244458][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:27 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:27 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1010.654200][T13250] usb 3-1: new high-speed USB device number 13 using dummy_hcd
11:41:28 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfffffff6, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:28 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, 0x0, 0x0)

[ 1010.811323][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1011.035351][T13250] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[ 1011.086461][T13250] usb 3-1: string descriptor 0 read error: -22
[ 1011.093181][T13250] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[ 1011.102591][T13250] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
11:41:28 executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)

11:41:28 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000180))
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1011.360385][ T3389] usb 3-1: USB disconnect, device number 13
11:41:28 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfffffffb, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:29 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, 0x0, 0x0)

[ 1011.847732][   T27] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:29 executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)

11:41:29 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1012.144924][ T3389] usb 3-1: new high-speed USB device number 14 using dummy_hcd
[ 1012.505136][ T3389] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[ 1012.559939][ T3389] usb 3-1: string descriptor 0 read error: -22
[ 1012.566887][ T3389] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40
[ 1012.576279][ T3389] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 1012.804332][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1012.814014][    C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1012.890488][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1012.899021][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1012.925792][ T9489] usb 3-1: USB disconnect, device number 14
11:41:30 executing program 2:
mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000010)

11:41:30 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xfffffffd, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:30 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, 0x0, 0x0)

11:41:30 executing program 0:
bpf$PROG_LOAD(0x5, 0x0, 0x0)

11:41:30 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000180))
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1013.295184][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:30 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:30 executing program 2:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="b400f2ffffffffff6011040000000000071e81000100000085000000fd"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x78)
pipe(&(0x7f0000000180)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet(0x10, 0x2, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="240100002e00"], 0x2}}, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc)
splice(r0, 0x0, r2, 0x0, 0x84ffde, 0x0)

11:41:30 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)

11:41:30 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:31 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0xffffffff, &(0x7f00000014c0)={[{@noacl='noacl'}]})

[ 1013.873317][T20996] netlink: 256 bytes leftover after parsing attributes in process `syz-executor.2'.
[ 1013.926613][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:31 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:31 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000180))
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:31 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)

11:41:31 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl', 0x22}]})

11:41:31 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:31 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1014.559728][T21010] erofs: Unknown parameter 'noacl"'
11:41:32 executing program 2:
clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000002, 0x0)
vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000200)="1f5583624999c4665398664c3fd64362f39caf1701d25c2fd6d42bce84c2e238b5eae719fd6321452d791cc0576c8624862bd395fea6432d69e5cc27d7b0ca298f52e4be0721915e61ca9791d9da035fcb039c7c6138b7c754ff41c5d3cd1b6eabd323eb69bf5ec29954197b5564e6ac851909cf99421f46b04fff0c935433e6691f8b25bee7df03b08db40ba73ac381dd4dea5dac863b5e2e3300bbd04055fff98a5c92c4b0b0deb44d872aa7bb025d0118d0e12363949f0f52917f95dc079f7c82a8e9eb1c1c840ec3dc93d87be6f6ed2195e8083b0c00ade4a74bd32932f9671a6ec9642e8a4fb6f987dbfeb3ffa2bee7909330daebfb1da08dc6bb6f2996bca3f9f4b274946420d43ce7a7915180e87d140b67", 0x115}], 0x4, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
tkill(r0, 0x3c)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x1f, r0, 0x0, 0x0)

[ 1014.718662][T21010] erofs: Unknown parameter 'noacl"'
11:41:32 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0)

11:41:32 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1014.965289][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:32 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}]})

11:41:32 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1015.127412][T21029] ptrace attach of "/root/syz-executor.2"[21028] was attempted by "/root/syz-executor.2"[21029]
11:41:32 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:32 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0)

[ 1015.369620][T21035] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
[ 1015.469038][T21035] erofs: (device loop1): erofs_read_superblock: cannot find valid erofs superblock
11:41:33 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000180))
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:33 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:33 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x2})

11:41:33 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, 0x0, 0x0)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1016.005754][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:33 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0)

11:41:33 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:33 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1016.253594][T21065] erofs: Unknown parameter ''
[ 1016.330539][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1016.344518][T21065] erofs: Unknown parameter ''
11:41:33 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000180))
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:33 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x3})

11:41:34 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x0)

11:41:34 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, 0x0, 0x0)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:34 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:34 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

[ 1017.048700][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1017.217039][T21090] erofs: Unknown parameter ''
11:41:34 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
clock_gettime(0x0, &(0x7f0000000180))
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:34 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:35 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x4})

11:41:35 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, 0x0, 0x0)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:35 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:35 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:35 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1018.086365][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1018.146298][T21113] erofs: Unknown parameter ''
11:41:35 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:35 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1018.250998][T21113] erofs: Unknown parameter ''
11:41:35 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x5})

11:41:36 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:36 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1018.915105][T21138] erofs: Unknown parameter ''
11:41:36 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1018.985533][T21138] erofs: Unknown parameter ''
11:41:36 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

[ 1019.126071][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:36 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x6})

11:41:36 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1019.369975][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:36 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:37 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1019.710801][T21160] erofs: Unknown parameter ''
11:41:37 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:37 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

[ 1019.876834][T21160] erofs: Unknown parameter ''
11:41:37 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x7})

11:41:37 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:37 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1020.165970][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:37 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:37 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1020.450208][T21180] erofs: Unknown parameter ''
[ 1020.580713][T21180] erofs: Unknown parameter ''
11:41:38 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:38 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x8})

11:41:38 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:38 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:38 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00'})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:38 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1021.205402][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1021.234354][T21201] erofs: Unknown parameter ''
[ 1021.334998][T21201] erofs: Unknown parameter ''
11:41:39 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:39 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x9})

11:41:39 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:39 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:39 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:39 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1022.053279][T21226] erofs: Unknown parameter '	'
[ 1022.145103][T21226] erofs: Unknown parameter '	'
[ 1022.248651][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:39 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:39 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1022.423005][   T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1022.484744][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1022.508906][T15869] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:39 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:39 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:40 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0xa})

[ 1022.546002][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:40 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

[ 1023.070990][T21259] erofs: Unknown parameter '
[ 1023.070990][T21259] '
11:41:40 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:40 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:40 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1023.232417][T21259] erofs: Unknown parameter '
[ 1023.232417][T21259] '
11:41:40 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x0, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1023.296696][ T3389] net_ratelimit: 1 callbacks suppressed
[ 1023.296725][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:40 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0xb})

11:41:40 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:41 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1023.920457][T21277] erofs: Unknown parameter ''
11:41:41 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:41 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1024.049488][T21277] erofs: Unknown parameter ''
11:41:41 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:41 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

11:41:41 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0xc})

11:41:41 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x0, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1024.330200][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:42 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x5, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:42 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1024.849403][T21307] erofs: Unknown parameter ''
11:41:42 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1024.995353][T21307] erofs: Unknown parameter ''
11:41:42 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x0, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:42 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:42 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:42 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0xd})

[ 1025.365193][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:42 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1025.445289][ T8722] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:43 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0)

11:41:43 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, 0x0, 0x0)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1025.779563][T21331] erofs: Unknown parameter '
'
11:41:43 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1025.893406][T21331] erofs: Unknown parameter '
'
11:41:43 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:43 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0xe})

11:41:43 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0)

[ 1026.405948][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:43 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, 0x0, 0x0)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:43 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1026.559650][T21349] erofs: Unknown parameter ''
[ 1026.683586][T21349] erofs: Unknown parameter ''
11:41:44 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:44 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:44 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x10})

11:41:44 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0)

11:41:44 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, 0x0, 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:44 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, 0x0, 0x0)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1027.437463][T21369] erofs: Unknown parameter ''
[ 1027.452259][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:44 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1027.503153][T21369] erofs: Unknown parameter ''
11:41:45 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:45 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:45 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x11})

11:41:45 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, 0x0, 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:45 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1028.377096][T21395] erofs: Unknown parameter ''
[ 1028.486109][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1028.493108][T21395] erofs: Unknown parameter ''
[ 1028.502822][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1028.528732][T15846] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1028.565772][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1028.594542][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:46 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
dup2(r0, 0xffffffffffffffff)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x20000036}])

11:41:46 executing program 3:
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:46 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x12})

11:41:46 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, 0x0, 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:46 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:46 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{}, 0x0, 0x0, 0x0, 0x9, 0x3f}}}]}, 0x78}}, 0x0)

[ 1029.041874][T21408] erofs: Unknown parameter ''
11:41:46 executing program 3:
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1029.164996][T21408] erofs: Unknown parameter ''
11:41:46 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x0, 0x3f}}}]}, 0x78}}, 0x0)

11:41:46 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x0, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:46 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x22})

11:41:46 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(&(0x7f00000004c0)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1029.527589][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:47 executing program 3:
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:47 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
dup2(r0, 0xffffffffffffffff)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x20000036}])

[ 1029.887183][T21435] erofs: Unknown parameter '"'
11:41:47 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x0, 0x3f}}}]}, 0x78}}, 0x0)

11:41:47 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x0, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1029.964892][T21435] erofs: Unknown parameter '"'
11:41:47 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={r4, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:47 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x25})

11:41:47 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x0, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

11:41:47 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:48 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x0, 0x3f}}}]}, 0x78}}, 0x0)

[ 1030.568868][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:48 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
dup2(r0, 0xffffffffffffffff)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x20000036}])

[ 1030.731652][T21458] erofs: Unknown parameter '%'
[ 1030.852927][T21458] erofs: Unknown parameter '%'
11:41:48 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x2f})

11:41:48 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:48 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

11:41:48 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9}}}]}, 0x78}}, 0x0)

11:41:48 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, 0x0, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1031.604863][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1031.626894][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1031.675924][T21487] erofs: Unknown parameter '/'
11:41:49 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1031.742811][T21487] erofs: Unknown parameter '/'
11:41:49 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:49 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9}}}]}, 0x78}}, 0x0)

11:41:49 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:49 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x48})

[ 1032.086809][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:49 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, 0x0, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:49 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x64}, @exit], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x74)

[ 1032.504994][T21506] erofs: Unknown parameter 'H'
11:41:50 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:50 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:50 executing program 5:
r0 = socket(0x11, 0x800000003, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000600)={'team0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8, 0x1, 'sfq\x00'}, {0x4c, 0x2, {{0x0, 0x0, 0xbb}, 0x0, 0x0, 0x0, 0x9}}}]}, 0x78}}, 0x0)

11:41:50 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x4c})

11:41:50 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, 0x0, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:50 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x9, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x69, 0x11, 0xc}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000000200)=""/4096, 0x0, 0x0, [0x4c, 0x2], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70)

[ 1033.472769][T21522] erofs: Unknown parameter 'L'
11:41:51 executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
r1 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(r0, r1)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r2=>0x0)
io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r1, &(0x7f0000000000), 0x20000036}])

11:41:51 executing program 5:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c)
r1 = dup2(r0, r0)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x200000ee)
setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x24, &(0x7f0000000040)=@gcm_128={{}, "00ed4af3f0bf5106", "0c7aa39be39357704191c51c415adc1e", "aebe9063", "3c4a3518dd152294"}, 0x28)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000013c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
r4 = fcntl$dupfd(r3, 0x0, r2)
ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200)
clone(0x0, 0x0, 0x0, 0x0, 0x0)

[ 1033.641538][T21522] erofs: Unknown parameter 'L'
11:41:51 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1033.685610][ T9065] net_ratelimit: 1 callbacks suppressed
[ 1033.685713][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:51 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x5c})

11:41:51 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={0x0, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:51 executing program 0:
syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0)
r0 = epoll_create1(0x0)
r1 = epoll_create1(0x0)
close(r0)
r2 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r2, &(0x7f0000003000)=@abs={0x1}, 0x6e)
listen(r2, 0x0)
shutdown(r2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0xa0000004})
shutdown(r2, 0x1)
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

[ 1034.421687][T21543] erofs: Unknown parameter '\'
11:41:51 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(0x0, 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1034.708036][ T3224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1034.730584][ T3389] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:52 executing program 2:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(0xffffffffffffffff, r0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r0, &(0x7f0000000000), 0x20000036}])

[ 1034.759109][T21543] erofs: Unknown parameter '\'
11:41:52 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x60})

[ 1035.264495][   T28] audit: type=1400 audit(1599046912.698:64): avc:  denied  { block_suspend } for  pid=21554 comm="syz-executor.0" capability=36  scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1
11:41:52 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={0x0, 0x0, 0x95}, &(0x7f0000000340)={'enc=', 'pkcs1', ' hash=', {'blake2s-160\x00'}}, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

[ 1035.562975][T21571] erofs: Unknown parameter '`'
11:41:53 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:53 executing program 5:
mlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000)
socketpair(0x0, 0x0, 0x0, &(0x7f0000000300))
munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000)

[ 1035.647356][T21571] erofs: Unknown parameter '`'
11:41:53 executing program 0:
syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0)
r0 = epoll_create1(0x0)
r1 = epoll_create1(0x0)
close(r0)
r2 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r2, &(0x7f0000003000)=@abs={0x1}, 0x6e)
listen(r2, 0x0)
shutdown(r2, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000c85000)={0xa0000004})
shutdown(r2, 0x1)
epoll_wait(r1, &(0x7f0000000080)=[{}], 0x1, 0x0)

[ 1035.765320][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:53 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x68})

11:41:53 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0)={0x0, 0x0, 0x95}, 0x0, 0x0, &(0x7f00000014c0)=""/149)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:53 executing program 5:
prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8d, 0x400000008c}, 0x0)
r0 = getpid()
sched_setattr(r0, &(0x7f0000000280)={0x89, 0x1, 0x0, 0x0, 0x8, 0xfffffffffffffffd, 0x0, 0xe5bd}, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
recvmmsg(r1, &(0x7f00000041c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000bc0)=""/98, 0x62}}], 0x1, 0x120, 0x0)
pipe(&(0x7f0000000300)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
fcntl$setpipe(r3, 0x407, 0x0)
write(r3, &(0x7f0000000340), 0x41395527)
vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x0, 0x3}, 0x0)
mkdir(&(0x7f00000000c0)='./file0\x00', 0x0)
r4 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffffd, 0x0, @perf_bp={&(0x7f0000000380)}, 0x9000, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r4, 0x0)
clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4000000000000071, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000540)={'syztnl0\x00', 0x0})
lsetxattr$security_selinux(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='security.selinux\x00', &(0x7f0000000340)='system_u:object_r:login_exec_t:s0\x00', 0x22, 0x1)

[ 1036.401111][T21593] erofs: Unknown parameter 'h'
11:41:53 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1036.496044][T21593] erofs: Unknown parameter 'h'
11:41:53 executing program 2:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(0xffffffffffffffff, r0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r0, &(0x7f0000000000), 0x20000036}])

11:41:53 executing program 0:
r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000039542f108c07021047e6000000010902240001000000000904db00010a04c80009210300000000810009050a"], 0x0)
write(0xffffffffffffffff, &(0x7f0000000080)="83", 0x1)
syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="0000810000008100836f642d7e6a2fd00104815aefd738524f86"], 0x0, 0x0, 0x0, 0x0}, 0x0)

11:41:54 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x6c})

[ 1036.814641][ T9065] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:54 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

[ 1037.170447][ T3224] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 1037.230326][T21616] erofs: Unknown parameter 'l'
11:41:54 executing program 5:
prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0)
pipe(&(0x7f0000000840)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f0000000340), 0x41395527)
vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0)
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x14, 0x42, 0x301}, 0x14}}, 0x0)
readahead(r2, 0x3, 0xfffffffffffffc01)

[ 1037.363189][T21616] erofs: Unknown parameter 'l'
[ 1037.433990][ T3224] usb 1-1: Using ep0 maxpacket: 16
11:41:54 executing program 4:
r0 = socket$inet6(0xa, 0x2, 0x0)
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = dup(r1)
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
sendmmsg$sock(r0, &(0x7f0000000440)=[{{&(0x7f0000000000)=@in6={0xa, 0x4e21, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000200)}}], 0x1, 0x0)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f00000001c0)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0x8000000006}]}, 0x10)
bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendto$inet6(r3, 0x0, 0x0, 0x20000042, &(0x7f0000000380)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff)
keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f00000001c0), 0x0, 0x0, 0x0)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='syzkaller\x00', &(0x7f0000000100)=@secondary='builtin_and_secondary_trusted\x00')
sendto$inet6(r3, &(0x7f00000002c0)='\x00', 0x1, 0x20042001, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev}, 0x1c)
poll(&(0x7f0000000040)=[{r3}], 0x1, 0xef)
close(r3)

11:41:54 executing program 1:
syz_mount_image$erofs(&(0x7f0000000180)='erofs\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, &(0x7f0000001480), 0x0, &(0x7f00000014c0)={[{@noacl='noacl'}], [], 0x74})

[ 1037.598386][ T3224] usb 1-1: config 0 has an invalid interface number: 219 but max is 0
[ 1037.607265][ T3224] usb 1-1: config 0 has no interface number 0
[ 1037.613536][ T3224] usb 1-1: config 0 interface 219 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0
[ 1037.623766][ T3224] usb 1-1: New USB device found, idVendor=078c, idProduct=1002, bcdDevice=e6.47
[ 1037.632892][ T3224] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[ 1037.773580][T13250] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
[ 1037.823951][ T3224] usb 1-1: config 0 descriptor??
[ 1037.852121][T20952] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
11:41:55 executing program 3:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe(&(0x7f0000000200))
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_open_dev$binderN(&(0x7f00000004c0)='/dev/binder#\x00', 0x0, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x0, 0x0)
pselect6(0x0, 0x0, 0x0, &(0x7f0000000240)={0x1ff}, 0x0, 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @local}, 0x10)

11:41:55 executing program 2:
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'\x00', 0x7132})
r0 = creat(&(0x7f0000000200)='./bus\x00', 0x0)
dup2(0xffffffffffffffff, r0)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, &(0x7f0000000000)=0xfffffe01, 0x4)
io_setup(0xb, &(0x7f0000000080)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f0000000180)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r0, &(0x7f0000000000), 0x20000036}])

[ 1038.058505][T21632] erofs: Unknown parameter 't'
[ 1038.117567][ T3224] =====================================================
[ 1038.124642][ T3224] BUG: KMSAN: uninit-value in gtco_probe+0x1c62/0x39b0
[ 1038.131509][ T3224] CPU: 0 PID: 3224 Comm: kworker/0:2 Not tainted 5.8.0-rc5-syzkaller #0
[ 1038.139829][ T3224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1038.149916][ T3224] Workqueue: usb_hub_wq hub_event
[ 1038.154943][ T3224] Call Trace:
[ 1038.158254][ T3224]  dump_stack+0x21c/0x280
[ 1038.162629][ T3224]  kmsan_report+0xf7/0x1e0
[ 1038.167070][ T3224]  __msan_warning+0x58/0xa0
[ 1038.171593][ T3224]  gtco_probe+0x1c62/0x39b0
[ 1038.176181][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.181412][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.187232][ T3224]  ? store_tabletExecute+0x150/0x150
[ 1038.192593][ T3224]  usb_probe_interface+0xece/0x1550
[ 1038.197835][ T3224]  ? usb_register_driver+0x900/0x900
[ 1038.203204][ T3224]  really_probe+0xf20/0x20b0
[ 1038.207820][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.213040][ T3224]  driver_probe_device+0x293/0x390
[ 1038.218180][ T3224]  __device_attach_driver+0x63f/0x830
[ 1038.223582][ T3224]  bus_for_each_drv+0x2ca/0x3f0
[ 1038.228448][ T3224]  ? coredump_store+0xf0/0xf0
[ 1038.233156][ T3224]  __device_attach+0x4e2/0x7f0
[ 1038.237958][ T3224]  device_initial_probe+0x4a/0x60
[ 1038.243000][ T3224]  bus_probe_device+0x177/0x3d0
[ 1038.247871][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.253696][ T3224]  device_add+0x3b0e/0x40d0
[ 1038.258251][ T3224]  usb_set_configuration+0x380f/0x3f10
[ 1038.263740][ T3224]  ? usb_set_configuration+0xb41/0x3f10
[ 1038.269348][ T3224]  usb_generic_driver_probe+0x138/0x300
[ 1038.274912][ T3224]  ? usb_choose_configuration+0xe70/0xe70
[ 1038.280647][ T3224]  usb_probe_device+0x311/0x490
[ 1038.285523][ T3224]  ? usb_register_device_driver+0x540/0x540
[ 1038.291428][ T3224]  really_probe+0xf20/0x20b0
[ 1038.296062][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.301285][ T3224]  driver_probe_device+0x293/0x390
[ 1038.306417][ T3224]  __device_attach_driver+0x63f/0x830
[ 1038.311817][ T3224]  bus_for_each_drv+0x2ca/0x3f0
[ 1038.316681][ T3224]  ? coredump_store+0xf0/0xf0
[ 1038.321382][ T3224]  __device_attach+0x4e2/0x7f0
[ 1038.326179][ T3224]  device_initial_probe+0x4a/0x60
[ 1038.331220][ T3224]  bus_probe_device+0x177/0x3d0
[ 1038.336093][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.341915][ T3224]  device_add+0x3b0e/0x40d0
[ 1038.346473][ T3224]  usb_new_device+0x1bd4/0x2a30
[ 1038.351365][ T3224]  hub_event+0x5e7b/0x8a70
[ 1038.355854][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.361064][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.366879][ T3224]  ? led_work+0x7c0/0x7c0
[ 1038.371302][ T3224]  process_one_work+0x1688/0x2140
[ 1038.376391][ T3224]  worker_thread+0x10bc/0x2730
[ 1038.381184][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.386448][ T3224]  kthread+0x551/0x590
[ 1038.390536][ T3224]  ? process_one_work+0x2140/0x2140
[ 1038.395752][ T3224]  ? kthread_blkcg+0x110/0x110
[ 1038.400627][ T3224]  ret_from_fork+0x1f/0x30
[ 1038.405059][ T3224] 
[ 1038.407386][ T3224] Uninit was stored to memory at:
[ 1038.412419][ T3224]  kmsan_internal_chain_origin+0xad/0x130
[ 1038.418150][ T3224]  __msan_chain_origin+0x50/0x90
[ 1038.423095][ T3224]  gtco_probe+0x1e77/0x39b0
[ 1038.427612][ T3224]  usb_probe_interface+0xece/0x1550
[ 1038.432821][ T3224]  really_probe+0xf20/0x20b0
[ 1038.437417][ T3224]  driver_probe_device+0x293/0x390
[ 1038.442540][ T3224]  __device_attach_driver+0x63f/0x830
[ 1038.447918][ T3224]  bus_for_each_drv+0x2ca/0x3f0
[ 1038.452778][ T3224]  __device_attach+0x4e2/0x7f0
[ 1038.457547][ T3224]  device_initial_probe+0x4a/0x60
[ 1038.462576][ T3224]  bus_probe_device+0x177/0x3d0
[ 1038.467448][ T3224]  device_add+0x3b0e/0x40d0
[ 1038.471959][ T3224]  usb_set_configuration+0x380f/0x3f10
[ 1038.477426][ T3224]  usb_generic_driver_probe+0x138/0x300
[ 1038.482975][ T3224]  usb_probe_device+0x311/0x490
[ 1038.487841][ T3224]  really_probe+0xf20/0x20b0
[ 1038.492442][ T3224]  driver_probe_device+0x293/0x390
[ 1038.497561][ T3224]  __device_attach_driver+0x63f/0x830
[ 1038.502936][ T3224]  bus_for_each_drv+0x2ca/0x3f0
[ 1038.507794][ T3224]  __device_attach+0x4e2/0x7f0
[ 1038.512568][ T3224]  device_initial_probe+0x4a/0x60
[ 1038.517598][ T3224]  bus_probe_device+0x177/0x3d0
[ 1038.522450][ T3224]  device_add+0x3b0e/0x40d0
[ 1038.526974][ T3224]  usb_new_device+0x1bd4/0x2a30
[ 1038.531831][ T3224]  hub_event+0x5e7b/0x8a70
[ 1038.536256][ T3224]  process_one_work+0x1688/0x2140
[ 1038.541288][ T3224]  worker_thread+0x10bc/0x2730
[ 1038.546055][ T3224]  kthread+0x551/0x590
[ 1038.550134][ T3224]  ret_from_fork+0x1f/0x30
[ 1038.554544][ T3224] 
[ 1038.556871][ T3224] Local variable ----globalval.i@gtco_probe created at:
[ 1038.563810][ T3224]  gtco_probe+0xda0/0x39b0
[ 1038.568232][ T3224]  gtco_probe+0xda0/0x39b0
[ 1038.572639][ T3224] =====================================================
[ 1038.579570][ T3224] Disabling lock debugging due to kernel taint
[ 1038.585720][ T3224] Kernel panic - not syncing: panic_on_warn set ...
[ 1038.592334][ T3224] CPU: 0 PID: 3224 Comm: kworker/0:2 Tainted: G    B             5.8.0-rc5-syzkaller #0
[ 1038.602045][ T3224] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1038.612116][ T3224] Workqueue: usb_hub_wq hub_event
[ 1038.617147][ T3224] Call Trace:
[ 1038.620454][ T3224]  dump_stack+0x21c/0x280
[ 1038.624872][ T3224]  panic+0x4d7/0xef7
[ 1038.628825][ T3224]  ? add_taint+0x17c/0x210
[ 1038.633261][ T3224]  kmsan_report+0x1df/0x1e0
[ 1038.637788][ T3224]  __msan_warning+0x58/0xa0
[ 1038.642307][ T3224]  gtco_probe+0x1c62/0x39b0
[ 1038.646890][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.652100][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.657924][ T3224]  ? store_tabletExecute+0x150/0x150
[ 1038.663242][ T3224]  usb_probe_interface+0xece/0x1550
[ 1038.668472][ T3224]  ? usb_register_driver+0x900/0x900
[ 1038.673778][ T3224]  really_probe+0xf20/0x20b0
[ 1038.678386][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.683603][ T3224]  driver_probe_device+0x293/0x390
[ 1038.688734][ T3224]  __device_attach_driver+0x63f/0x830
[ 1038.694138][ T3224]  bus_for_each_drv+0x2ca/0x3f0
[ 1038.699000][ T3224]  ? coredump_store+0xf0/0xf0
[ 1038.703706][ T3224]  __device_attach+0x4e2/0x7f0
[ 1038.708499][ T3224]  device_initial_probe+0x4a/0x60
[ 1038.713539][ T3224]  bus_probe_device+0x177/0x3d0
[ 1038.718424][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.724241][ T3224]  device_add+0x3b0e/0x40d0
[ 1038.728802][ T3224]  usb_set_configuration+0x380f/0x3f10
[ 1038.734286][ T3224]  ? usb_set_configuration+0xb41/0x3f10
[ 1038.739904][ T3224]  usb_generic_driver_probe+0x138/0x300
[ 1038.745469][ T3224]  ? usb_choose_configuration+0xe70/0xe70
[ 1038.751202][ T3224]  usb_probe_device+0x311/0x490
[ 1038.756092][ T3224]  ? usb_register_device_driver+0x540/0x540
[ 1038.762003][ T3224]  really_probe+0xf20/0x20b0
[ 1038.766614][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.771832][ T3224]  driver_probe_device+0x293/0x390
[ 1038.776967][ T3224]  __device_attach_driver+0x63f/0x830
[ 1038.782381][ T3224]  bus_for_each_drv+0x2ca/0x3f0
[ 1038.787242][ T3224]  ? coredump_store+0xf0/0xf0
[ 1038.791942][ T3224]  __device_attach+0x4e2/0x7f0
[ 1038.796739][ T3224]  device_initial_probe+0x4a/0x60
[ 1038.801778][ T3224]  bus_probe_device+0x177/0x3d0
[ 1038.806649][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.812467][ T3224]  device_add+0x3b0e/0x40d0
[ 1038.817034][ T3224]  usb_new_device+0x1bd4/0x2a30
[ 1038.821923][ T3224]  hub_event+0x5e7b/0x8a70
[ 1038.826412][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.831622][ T3224]  ? kmsan_get_shadow_origin_ptr+0x81/0xb0
[ 1038.837438][ T3224]  ? led_work+0x7c0/0x7c0
[ 1038.841791][ T3224]  process_one_work+0x1688/0x2140
[ 1038.846858][ T3224]  worker_thread+0x10bc/0x2730
[ 1038.851635][ T3224]  ? kmsan_get_metadata+0x116/0x180
[ 1038.856874][ T3224]  kthread+0x551/0x590
[ 1038.860956][ T3224]  ? process_one_work+0x2140/0x2140
[ 1038.866189][ T3224]  ? kthread_blkcg+0x110/0x110
[ 1038.870965][ T3224]  ret_from_fork+0x1f/0x30
[ 1038.876574][ T3224] Kernel Offset: disabled
[ 1038.880899][ T3224] Rebooting in 86400 seconds..