"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000bc0)={&(0x7f0000000a80), 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x14}, 0x14}}, 0x40) 00:15:16 executing program 3: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) 00:15:16 executing program 0: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000880), 0xffffffffffffffff) 00:15:16 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x14}, 0x14}}, 0x0) 00:15:16 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0xffffff1f}, 0x0) 00:15:17 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:17 executing program 2: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0) 00:15:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(r0, &(0x7f0000001d80)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="ac", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="1d", 0x1}], 0x300, &(0x7f00000021c0)=ANY=[@ANYBLOB="14000000000000000000000001000000030b000000000000110000000000000000000000011000001f00000000000000b400000000000000000000000700000007138eac141418000000057f000001ac1414bb444cf2017f00000100000001ac1e01010000d558ac14143e00000006ac1e01010000001f64010100ffffffff64010100000000050a010100000000046401010100000005ac1eaa7f00000164010101441cc88304010101000000030a010102000000fbac1e000100000002440cbb21e000000201000000000200860b3ac3c4f0e4d370cfdd0000000000000011000000000000000000000001"], 0x1f0}}], 0x2, 0x0) 00:15:17 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x4402) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "2b6201630b0ffb7ed8f6288179c17ce18037f6c6ccc02225260de14f3d419269afb34ab80fe689f6b1227e743a775e5b7f09625b25298490c23106b7b673f496", "9c9df980e1a1425415be36add3435a37c27d483e19a87471347cb5c84f2202c1bebc9d6f93a2be666d6aae169614d6aa6dcdd042bfea4eec86054e7011d9cc0b", "56a0eeafed80aa3e13075af46a51afa0737ef3fcc5201e14ed8ecbbdfd1e4d7b"}) [ 370.139815][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:17 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000040)=0x5, 0x4) 00:15:17 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(0x0, 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:17 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@getneigh={0x14}, 0x14}}, 0x0) 00:15:17 executing program 3: add_key$fscrypt_v1(&(0x7f0000000180), &(0x7f00000001c0)={'fscrypt:', @desc4}, &(0x7f0000000200)={0x0, "08309bd52f361fa26d7a669667b6a78dc5df18d6d12442e9d3dd2f34e8e6c388d6a287d8b8763d50ec016ecbc3070000006d00"}, 0x48, 0xfffffffffffffffb) 00:15:17 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:17 executing program 5: r0 = socket(0x1, 0x2, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r0, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={0x0}}, 0x0) 00:15:17 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$DEVLINK_CMD_PORT_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0xf0ff7f00000000}, 0x300}, 0x0) 00:15:17 executing program 3: syz_open_dev$vcsu(&(0x7f0000000180), 0x0, 0x440) 00:15:17 executing program 0: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "7551a49fb2c83488ad7b73d8a8452c103cda095c73dfcaeb9be88027bb7dcc1c9f5a54ae1af50056dd14b0f247a896c2bbbbbbb8e20292a7eb358e3a26ad68fa"}, 0x48, r0) keyctl$unlink(0x9, r1, r0) 00:15:17 executing program 5: r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time\x00') ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, 0x0) 00:15:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(r0, &(0x7f0000001d80)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="ac", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="1d", 0xfffffdef}], 0x1, &(0x7f00000021c0)=ANY=[@ANYBLOB="f0010000000000000000000001000000030b000000000000110000000000000000000000011000001f00000000000000b400000000000000000000000700000007138eac141418000000057f000001ac1414bb444cf2017f00000100000001ac1e01010000d558ac14143e00000006ac1e01010000001f64010100ffffffff64010100000000050a010100000000046401010100000005ac1eaa7f00000164010101441cc88304010101000000030a010102000000fbac1e000100000002440cbb21e000000201000000000200860b3ac3c4f0e4d370cfdd0000000000000011000000000000000000000001"], 0x1f0}}], 0x2, 0x0) 00:15:17 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:17 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@can_newroute={0x14, 0x18, 0x1}, 0x14}}, 0x0) [ 370.790250][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:18 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(0x0, 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:18 executing program 5: add_key(&(0x7f0000000000)='encrypted\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) 00:15:18 executing program 0: r0 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc4}, &(0x7f0000000080)={0x0, "fc2412685023ff599065d7b8220532c8a27a956d882f14e470f65bcd58aafd8d15d118f3f03fa9b2e8dc23b2289b35fe169ad696c2b9b1875da4322ab800a8f4"}, 0x48, 0xfffffffffffffffc) keyctl$search(0xf, r0, 0x0, 0x0, 0x0) 00:15:18 executing program 2: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f00000002c0)={0x14, 0x453, 0x0, 0x0, 0x0, "aa"}, 0x14}}, 0x0) 00:15:18 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xa) sendmsg$NL80211_CMD_GET_WOWLAN(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)={0x28, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void, @val={0xc}}}}, 0x33fe0}}, 0x0) 00:15:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:18 executing program 0: r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x10000001) 00:15:18 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000500)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 00:15:18 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001840)={0x34, 0x0, 0x2, 0x0, 0x0, 0x0, {}, [@CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}, @CTA_EXPECT_MASK={0xc, 0x3, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6}]}]}, 0xf}}, 0x0) 00:15:18 executing program 5: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$link(0x8, r0, r0) [ 371.263650][ T27] audit: type=1107 audit(1649722518.259:12): pid=10824 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='ª' 00:15:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:18 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000001600)=0x10, 0x4) 00:15:18 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(0x0, 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:18 executing program 0: r0 = syz_open_dev$vcsu(&(0x7f0000000000), 0x1, 0x204102) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, 0x0) 00:15:18 executing program 5: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x40300, 0x0) 00:15:18 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000500)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 00:15:18 executing program 3: syz_mount_image$fuse(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYRESDEC=0x0]) 00:15:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:18 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x945f947e691748ed}, 0x20}}, 0x0) 00:15:18 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000500)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 00:15:18 executing program 3: syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x4402) [ 371.828255][T10855] fuse: Bad value for 'fd' [ 371.833085][ T26] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:18 executing program 5: r0 = socket(0x1, 0x2, 0x0) connect$bt_rfcomm(r0, &(0x7f0000000d80), 0xa) [ 371.899680][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:19 executing program 0: pselect6(0x2c, &(0x7f0000000140), &(0x7f0000000180)={0x9}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)={&(0x7f0000000240), 0x8}) 00:15:19 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:19 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x1c, 0x0, 0x2, 0x101, 0x0, 0x0, {}, [@CTA_EXPECT_MASK={0x4}, @CTA_EXPECT_TUPLE={0x4}]}, 0x1c}}, 0x0) 00:15:19 executing program 3: syz_open_dev$vcsn(&(0x7f0000001dc0), 0x0, 0x0) 00:15:19 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000500)) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1ff}, &(0x7f0000000200), 0x0) 00:15:19 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:19 executing program 0: openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x412402, 0x0) 00:15:19 executing program 5: syz_open_dev$loop(&(0x7f0000000080), 0xfffffffeff3ffffd, 0x0) 00:15:19 executing program 0: r0 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc4}, &(0x7f0000000080)={0x0, "fc2412685023ff599065d7b8220532c8a27a956d882f14e470f65bcd58aafd8d15d118f3f03fa9b2e8dc23b2289b35fe169ad696c2b9b1875da4322ab800a8f4"}, 0x48, 0xfffffffffffffffc) keyctl$search(0x7, r0, 0x0, 0x0, 0xfffffffffffffff9) 00:15:19 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001840)={0x14, 0x3, 0x2, 0x101}, 0x14}}, 0x0) 00:15:19 executing program 2: openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001b40)='./cgroup.net/syz0\x00', 0x200002, 0x0) 00:15:19 executing program 5: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={0x0}, 0x7}, 0x0) 00:15:19 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 372.869892][ T26] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:20 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) chdir(0x0) [ 373.249595][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(r0, &(0x7f0000001d80)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)="1d", 0x1}], 0x1, &(0x7f00000021c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x1f0}}], 0x1, 0x0) 00:15:20 executing program 0: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f00000002c0)={0x10, 0x834}, 0x10}}, 0x0) 00:15:20 executing program 2: r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x11000001) 00:15:20 executing program 5: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000580)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 00:15:20 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:20 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r0, 0x10e, 0x5, &(0x7f0000000280)=""/4096, &(0x7f0000000000)=0x1000) 00:15:20 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, 0x0) 00:15:20 executing program 3: keyctl$search(0xb, 0x0, 0x0, 0x0, 0x0) 00:15:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r0, &(0x7f0000000bc0)={&(0x7f0000000a80), 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x14}, 0x14}}, 0x0) 00:15:20 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:20 executing program 0: getresuid(&(0x7f0000001780), &(0x7f00000017c0), &(0x7f0000001800)) [ 373.900389][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:21 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) chdir(0x0) 00:15:21 executing program 2: ioctl$sock_ipv6_tunnel_SIOCCHG6RD(0xffffffffffffffff, 0x89fb, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000003100)={0x1, &(0x7f00000030c0)=[{}]}) pipe2$watch_queue(&(0x7f0000003140), 0x80) syz_open_dev$usbfs(0x0, 0x0, 0x0) 00:15:21 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:21 executing program 3: syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000d00)={'wpan1\x00'}) 00:15:21 executing program 5: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, r0) add_key(&(0x7f00000001c0)='asymmetric\x00', 0x0, &(0x7f0000000240)="1f26", 0x2, r1) 00:15:21 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0) 00:15:21 executing program 2: add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc4}, &(0x7f0000000080)={0x0, "fc2412685023ff599065d7b8220532c8a27a956d882f14e470f65bcd58aafd8d15d118f3f03fa9b2e8dc23b2289b35fe169ad696c2b9b1875da4322ab800a8f4"}, 0x48, 0xfffffffffffffffc) 00:15:21 executing program 5: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r0, 0x6, 0x3, &(0x7f0000000ac0)=0x6, 0x4) 00:15:21 executing program 3: openat$bsg(0xffffffffffffff9c, &(0x7f0000000240), 0x107000, 0x0) 00:15:21 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:21 executing program 2: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0x5421, &(0x7f0000000040)) 00:15:21 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000000004dd"], 0x34}}, 0x0) [ 374.346893][T10959] netlink: 32 bytes leftover after parsing attributes in process `syz-executor.0'. 00:15:21 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) chdir(0x0) 00:15:21 executing program 3: rt_sigaction(0xd, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0, 0x8, &(0x7f00000003c0)) 00:15:21 executing program 5: bpf$BPF_PROG_QUERY(0x1b, 0x0, 0x0) 00:15:21 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:21 executing program 0: socketpair(0x25, 0x3, 0x200, &(0x7f0000000100)) 00:15:21 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict={0x0, 0x0, 0x0, 0x3}]}}, &(0x7f0000000140)=""/4096, 0x26, 0x1000, 0x1}, 0x20) 00:15:21 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x5, &(0x7f0000000040), 0x4) 00:15:21 executing program 5: bpf$BPF_PROG_QUERY(0x16, &(0x7f0000000040)={0xffffffffffffffff, 0x10, 0x0, 0x0, 0x0}, 0x20) 00:15:21 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict={0x0, 0x0, 0x0, 0xf, 0x2}]}}, &(0x7f0000000140)=""/4096, 0x26, 0x1000, 0x1}, 0x20) 00:15:21 executing program 3: openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x250000, 0x0) 00:15:21 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:21 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000000)={{0x2, 0x0, @multicast1}, {0x1, @remote}, 0x2, {0x2, 0x0, @broadcast}, 'veth1_to_team\x00'}) [ 374.950759][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:22 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[]) chdir(0x0) 00:15:22 executing program 0: syz_io_uring_setup(0x96f, &(0x7f0000000140)={0x0, 0x0, 0x22}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f00000001c0), &(0x7f0000000200)) 00:15:22 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f00000000c0), 0x4) 00:15:22 executing program 3: add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f0000000340)='encrypted\x00', 0x0) 00:15:22 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:22 executing program 2: r0 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) add_key$keyring(&(0x7f0000000080), &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, r0) r1 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$unlink(0x9, r1, r0) 00:15:22 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0x8000, 0xb0) 00:15:22 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_SB_GET(r0, &(0x7f0000000300)={&(0x7f0000000140), 0xa, &(0x7f00000002c0)={&(0x7f0000000340)={0xd0, 0x0, 0x0, 0x0, 0x0, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {@pci={{0x8}, {0x11}}, {0x8}}, {@pci={{0x8}, {0x11}}, {0x8}}, {@pci={{0x8}, {0x11}}, {0x8}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}, {@nsim={{}, {0x0, 0x2, {'netdevsim', 0x0}}}}]}, 0xd0}}, 0x0) 00:15:22 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x21, &(0x7f0000000000)=0xfffffffd, 0x4) 00:15:22 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x0, 0x0, 0x800000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x90}, 0x48) 00:15:22 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000040), 0x4) 00:15:22 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x891d, &(0x7f0000000240)={'ip6gre0\x00', 0x0}) 00:15:22 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[]) chdir(0x0) 00:15:22 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@restrict={0x0, 0x0, 0x0, 0x2, 0x2}, @union]}}, &(0x7f0000000140)=""/4096, 0x32, 0x1000, 0x1}, 0x20) 00:15:22 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:22 executing program 0: bpf$BPF_PROG_QUERY(0x14, 0x0, 0x0) 00:15:22 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000040), 0x4) 00:15:22 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x0, 0x0, 0x800000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x90}, 0x48) 00:15:22 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2c, &(0x7f0000000000)={0x0, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @remote}}}, 0x108) 00:15:23 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000000)={'tunl0\x00', 0x0}) 00:15:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 375.979782][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:23 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000040), 0x4) 00:15:23 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, 0x0, 0x0) 00:15:23 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000040), 0x4) [ 376.304487][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:23 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[]) chdir(0x0) 00:15:23 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001b40)={0x11, 0xc200, &(0x7f0000001800)=@framed={{}, [@func]}, &(0x7f0000001880)='syzkaller\x00', 0x0, 0xde, &(0x7f00000018c0)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 00:15:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:23 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x0, 0x0, 0x0, 0x0, 0x8, 0x1}, 0x48) 00:15:23 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0xf, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}}, 0x0) 00:15:23 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x0, 0x0, 0x800000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x90}, 0x48) 00:15:23 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x9, 0x2, [@restrict, @union]}}, &(0x7f0000000140)=""/4096, 0x32, 0x1000, 0x1}, 0x20) 00:15:23 executing program 3: bpf$BPF_BTF_LOAD(0x7, &(0x7f0000001140)={0x0, 0x0, 0x0, 0x0, 0x1}, 0x20) 00:15:23 executing program 3: r0 = epoll_create(0x5) r1 = socket$inet_udp(0x2, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000040)) 00:15:23 executing program 5: prctl$PR_MCE_KILL(0x2, 0x1ffff000, 0x0) 00:15:23 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="02050000030000000000000000000000010015"], 0x18}}, 0x0) 00:15:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) [ 377.029718][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:24 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:15:24 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x4, 0x0, 0x4, 0x87}, 0x48) 00:15:24 executing program 0: r0 = socket(0x10, 0x2, 0x0) connect$bt_sco(r0, &(0x7f0000000700)={0x1f, @fixed}, 0x20000708) 00:15:24 executing program 5: syz_clone(0x55040400, 0x0, 0x0, 0x0, 0x0, 0x0) 00:15:24 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1b, 0x0, 0x0, 0x800000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x90}, 0x48) 00:15:24 executing program 1: r0 = socket(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x9effffff}, 0x0) 00:15:24 executing program 0: prctl$PR_MCE_KILL(0xf, 0x20000000, 0x0) 00:15:24 executing program 3: prctl$PR_MCE_KILL(0x1c, 0x20000000, 0x0) 00:15:24 executing program 1: syz_clone(0x4c240080, 0x0, 0xffffffdb, 0x0, 0x0, 0x0) 00:15:24 executing program 3: prctl$PR_MCE_KILL(0x1b, 0x0, 0x0) [ 377.566326][T11081] lo speed is unknown, defaulting to 1000 00:15:24 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0x40383d0c, &(0x7f00000000c0)) 00:15:24 executing program 3: r0 = fsopen(&(0x7f0000001100)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) dup2(r1, r0) 00:15:24 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:15:24 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000001680), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, &(0x7f00000016c0)={0x8, 0x0, 0x0, 0x0, 'syz1\x00'}) 00:15:24 executing program 3: r0 = fsopen(&(0x7f0000001100)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) dup2(r1, r0) 00:15:24 executing program 5: syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2000, &(0x7f00000006c0), 0x0, &(0x7f0000000780)={[{@creator={'creator', 0x3d, "985000db"}}]}) 00:15:24 executing program 1: r0 = fsopen(&(0x7f0000001100)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) dup2(r1, r0) 00:15:24 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0xc4c03d09, 0x0) 00:15:24 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:24 executing program 3: r0 = fsopen(&(0x7f0000001100)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) dup2(r1, r0) 00:15:24 executing program 2: syz_clone(0x3000, 0x0, 0x0, 0x0, 0x0, 0x0) 00:15:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000), r0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)={0x30, r1, 0x1, 0x0, 0x0, {0x3}, [@HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x30}}, 0x0) 00:15:25 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:25 executing program 3: r0 = fsopen(&(0x7f0000001100)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) dup2(r1, r0) 00:15:25 executing program 1: r0 = fsopen(&(0x7f0000001100)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) dup2(r1, r0) [ 378.059856][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:25 executing program 2: r0 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x18b9c2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN_UNNAMED(0x11, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) faccessat(0xffffffffffffffff, 0x0, 0x100) ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, 0x0) write$cgroup_pressure(r0, &(0x7f0000000200)={'some'}, 0x2f) 00:15:25 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0x40103d0b, &(0x7f00000000c0)) [ 378.303286][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.309656][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.332988][T11116] hfsplus: unable to parse mount options 00:15:25 executing program 5: syz_clone(0x3000, 0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) 00:15:25 executing program 3: r0 = fsopen(&(0x7f00000000c0)='rpc_pipefs\x00', 0x0) r1 = dup2(r0, r0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000040)='/dev/udmabuf\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffff9c) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) dup2(r2, r0) 00:15:25 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:25 executing program 1: r0 = fsopen(&(0x7f0000001100)='tmpfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) dup2(r1, r0) 00:15:25 executing program 2: r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) name_to_handle_at(r0, &(0x7f0000000140)='\x00', 0x0, 0x0, 0x1400) 00:15:25 executing program 0: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8903, 0x0) 00:15:25 executing program 2: r0 = fsopen(&(0x7f0000000040)='devpts\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000180)='system.posix_acl_default\x00', &(0x7f00000001c0)='/dev/loop#\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) 00:15:25 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYNAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x28, 0xe, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}}, 0x0) 00:15:25 executing program 0: openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x200000, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) select(0x40, &(0x7f0000000040), &(0x7f0000000080)={0x9}, 0x0, 0x0) 00:15:25 executing program 5: openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/custom1\x00', 0x0, 0x0) prctl$PR_MCE_KILL(0xf, 0x20000000, 0x0) 00:15:25 executing program 3: r0 = fsopen(&(0x7f00000000c0)='rpc_pipefs\x00', 0x0) r1 = dup2(r0, r0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000040)='/dev/udmabuf\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffff9c) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) dup2(r2, r0) 00:15:25 executing program 4: r0 = fsopen(&(0x7f0000000000)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x0) 00:15:25 executing program 0: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0x80503d01, &(0x7f00000000c0)) 00:15:25 executing program 1: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='loginuid\x00') write$eventfd(r0, &(0x7f00000000c0), 0x8) [ 378.576840][T11153] devpts: called with bogus options 00:15:25 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@getae={0x40, 0x1f, 0x43b, 0x0, 0x0, {{@in=@multicast2, 0x0, 0xa}, @in=@private}}, 0x40}}, 0x0) 00:15:25 executing program 3: r0 = fsopen(&(0x7f00000000c0)='rpc_pipefs\x00', 0x0) r1 = dup2(r0, r0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000040)='/dev/udmabuf\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffff9c) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) dup2(r2, r0) 00:15:25 executing program 2: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0xc0603d06, &(0x7f00000000c0)) 00:15:25 executing program 5: prctl$PR_MCE_KILL(0x18, 0x20000000, 0x0) 00:15:25 executing program 1: r0 = socket(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0xffffff1f}, 0x0) 00:15:25 executing program 0: mount$fuse(0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0) 00:15:25 executing program 4: r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$PTP_PEROUT_REQUEST(r0, 0x43403d0e, 0x0) 00:15:25 executing program 3: r0 = fsopen(&(0x7f00000000c0)='rpc_pipefs\x00', 0x0) r1 = dup2(r0, r0) fsconfig$FSCONFIG_SET_PATH_EMPTY(r1, 0x4, &(0x7f0000000040)='/dev/udmabuf\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffff9c) r2 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000000), 0x2) dup2(r2, r0) 00:15:25 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB='\r'], 0x3c}}, 0x0) 00:15:25 executing program 1: r0 = socket(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x3639}, 0x0) 00:15:25 executing program 0: openat$incfs(0xffffffffffffff9c, &(0x7f0000000040)='.log\x00', 0x18b9c2, 0x0) 00:15:25 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x3, [@var={0x1, 0x0, 0x0, 0xe, 0x4}]}, {0x0, [0x61]}}, &(0x7f0000000280)=""/4096, 0x2b, 0x1000, 0x1}, 0x20) 00:15:25 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000000), r0) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000100), r0) sendmsg$ETHTOOL_MSG_PAUSE_GET(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000002c0)={0x14, r1, 0x1}, 0x14}}, 0x0) 00:15:25 executing program 5: add_key$keyring(&(0x7f0000000000), &(0x7f0000000200)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) 00:15:25 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), r0) 00:15:25 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r0, &(0x7f0000001500)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000000440)={0x20, r1, 0x1, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_TID_CONFIG={0xc, 0x11d, 0x0, 0x1, [{0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x4}]}]}]}, 0x20}}, 0x0) 00:15:25 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8941, 0x0) 00:15:25 executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) 00:15:25 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000004c0)={'tunl0\x00', &(0x7f0000000440)={'erspan0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@timestamp_prespec={0x44, 0x4}]}}}}}) 00:15:26 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r0, 0x89f8, &(0x7f00000004c0)) pipe(&(0x7f00000007c0)) 00:15:26 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x8947, &(0x7f0000000900)={'sit0\x00', 0x0}) 00:15:26 executing program 2: pipe(&(0x7f00000007c0)={0xffffffffffffffff}) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000700)=0x80080) 00:15:26 executing program 0: getsockopt$CAN_RAW_JOIN_FILTERS(0xffffffffffffffff, 0x65, 0x6, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_SET(r0, &(0x7f00000002c0)={&(0x7f0000000040), 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x54, r1, 0x1, 0x0, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0xfffffffffffffd5e}}]}, 0x54}}, 0x0) 00:15:26 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8912, 0x0) 00:15:26 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$sock(r0, &(0x7f0000001240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) [ 379.110043][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:26 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@bloom_filter={0x1e, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x48) 00:15:26 executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)={0x28, 0x1, 0x7, 0x201, 0x0, 0x0, {}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8}, @NFACCT_FILTER_VALUE={0x8}]}]}, 0x28}}, 0x0) [ 379.175931][T11212] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 00:15:26 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_MAC_ACL(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r1, 0x119, 0x0, 0x0, {{}, {@void, @val={0xc}}}}, 0x20}}, 0x0) 00:15:26 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@bloom_filter={0x1e, 0x0, 0x7, 0x9, 0x0, 0x1}, 0x48) 00:15:26 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCDELRT(r0, 0x2, 0x0) 00:15:26 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0xc0189436, &(0x7f0000000900)={'sit0\x00', &(0x7f0000000880)={'ip6tnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @mcast2, @mcast2}}) 00:15:26 executing program 1: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000001380)={'sit0\x00', &(0x7f0000001300)={'ip6gre0\x00', 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, @private2, @empty}}) 00:15:26 executing program 0: pselect6(0x40, &(0x7f0000000640), &(0x7f0000000680), 0x0, &(0x7f0000000700)={0x77359400}, &(0x7f0000000780)={&(0x7f0000000740)={[0x40]}, 0x8}) 00:15:26 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000004c0)={'tunl0\x00', &(0x7f0000000440)={'erspan0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x29, 0x0, @empty, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}) 00:15:26 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8912, &(0x7f0000000040)={0x0, @rc, @rc={0x1f, @fixed}, @nfc}) 00:15:26 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x8924, &(0x7f0000000900)={'sit0\x00', 0x0}) [ 379.339690][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:26 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000280)={'ip_vti0\x00', &(0x7f0000000180)={'tunl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x4, 0x0, @multicast1, @multicast2}}}}) 00:15:26 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x34, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}]}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x7}]}, 0x34}}, 0x0) 00:15:26 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0x0) 00:15:26 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x5421, &(0x7f0000000900)={'sit0\x00', 0x0}) 00:15:26 executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) bind$packet(r0, &(0x7f0000000000)={0x11, 0xf5, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x14) 00:15:26 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='wlan0\x00', 0x10) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='net_prio.prioidx\x00', 0x26e1, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1c2dc0000}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r2) sendmsg$TIPC_CMD_SHOW_PORTS(r3, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r4, 0x800, 0x70bd29, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x44014) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x28, r4, 0x800, 0x70bd25, 0x25dfdbfd, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x24008820) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_REMOVE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x0, 0x1}, 0x14}}, 0x0) sendmsg$NLBL_MGMT_C_REMOVE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)={0x50, 0x0, 0x20, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @mcast1}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x1d}}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x40) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00042cbd7000fcbe712501000000000000000b0000a7aff6ffcaaa3aeab24559ad00000c001473797a301c0000006fe6baadfd7b12a1262c4cab1f39a7b6361f400700000000000000d12db3f9e09f484d781bef268136837fa9fbadac"], 0x28}, 0x1, 0x0, 0x0, 0x44041}, 0x40000) sendmmsg(r0, &(0x7f00000039c0)=[{{0x0, 0x1e, 0x0, 0x0, 0x0, 0x0, 0xa}}], 0x311, 0x0) 00:15:26 executing program 1: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000000200)=0x1000, 0x4) 00:15:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_MODIFY(r0, 0xfffffffffffffffc, 0x0) [ 380.149706][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:27 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$sock(r0, &(0x7f0000000380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 00:15:27 executing program 4: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01000000000000000000070000000c00060001"], 0x28}}, 0x0) 00:15:27 executing program 2: pselect6(0x0, 0x0, &(0x7f0000000680), &(0x7f00000006c0), &(0x7f0000000700)={0x77359400}, &(0x7f0000000780)={&(0x7f0000000740)={[0x40]}, 0x8}) 00:15:27 executing program 3: bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000500)={0x0, 0x0, 0x8}, 0xc) 00:15:27 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8901, 0x0) 00:15:27 executing program 5: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan1\x00'}) 00:15:27 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCDELRT(r0, 0x8901, &(0x7f0000000040)={0x0, @rc, @rc={0x1f, @fixed}, @nfc}) 00:15:27 executing program 1: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCDELRT(r0, 0x5421, &(0x7f0000000040)={0x0, @rc, @rc={0x1f, @fixed}, @nfc}) 00:15:27 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f0000000040)={0x0, @rc, @rc={0x1f, @fixed}, @nfc}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@bloom_filter={0x1e, 0x5, 0x7, 0x9, 0x14d2, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5, 0x4}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0x58, &(0x7f0000000140)}, 0x10) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000200)={0x0, 'tunl0\x00', {0x1}, 0xdfd7}) 00:15:27 executing program 5: r0 = socket(0xf, 0x3, 0x2) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x2c}}, 0x20000011) [ 380.314898][T11265] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 00:15:27 executing program 4: r0 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) connect$nfc_raw(r0, &(0x7f0000001100), 0x10) 00:15:27 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) accept4$tipc(0xffffffffffffffff, &(0x7f0000000280)=@id, &(0x7f0000000100)=0x10, 0x40c00) 00:15:27 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000040)={'wg2\x00'}) 00:15:27 executing program 5: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER_AVC(r0, &(0x7f0000000b00)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x54010003}, 0xc, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x2c, 0x453, 0x0, 0x0, 0x25dfdbfc, "c4f3fc403c5376b04ac85d66b2aaa694849f05bc0a3ef4a4a4f552", ["", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) [ 380.604733][ T27] audit: type=1107 audit(1649722527.599:13): pid=11283 uid=0 auid=4294967295 ses=4294967295 subj=_ msg='Äóü@ô¤¤õR' 00:15:28 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) accept4$tipc(0xffffffffffffffff, &(0x7f0000000280)=@id, &(0x7f0000000100)=0x10, 0x40c00) 00:15:28 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0x14}, 0x48) 00:15:28 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000080)={0x0, 0xe, &(0x7f0000000040)={&(0x7f00000001c0)={0x30, 0x3, 0x8, 0x101, 0x0, 0x0, {}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_UNREPLIED={0x8}]}, @CTA_TIMEOUT_L3PROTO={0x6}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x30}}, 0x0) 00:15:28 executing program 1: r0 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r0, 0x0, 0xaa, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev, 0x2}, 0x20) 00:15:28 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x24, r1, 0x4f8bb69e5a1fe09, 0x0, 0x0, {{}, {}, {0x8}}}, 0x24}}, 0x0) 00:15:28 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) accept4$tipc(0xffffffffffffffff, &(0x7f0000000280)=@id, &(0x7f0000000100)=0x10, 0x40c00) 00:15:28 executing program 0: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@private0, @private0, @loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}) 00:15:28 executing program 4: socket(0x22, 0x3, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) 00:15:28 executing program 1: r0 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom$l2tp6(r0, 0x0, 0x0, 0x2, 0x0, 0x0) 00:15:28 executing program 5: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) getsockopt$sock_buf(r0, 0x1, 0x0, &(0x7f00000028c0)=""/102400, &(0x7f0000000480)=0xfffffffffffffe79) [ 381.180227][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:28 executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x4}}, 0x26) 00:15:28 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r0, &(0x7f0000002cc0)={0xa, 0x0, 0x0, @local, 0x1}, 0x20) [ 381.502649][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:29 executing program 2: r0 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r0, 0x0, 0xaa, 0x7fffffffef56, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev}, 0x20) 00:15:29 executing program 4: r0 = socket(0x1e, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'batadv0\x00', &(0x7f0000000100)=@ethtool_coalesce={0xc}}) 00:15:29 executing program 5: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@local, @private0, @loopback, 0x0, 0x88f0, 0x0, 0x0, 0x0, 0x1000000}) 00:15:29 executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000740), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000003100000008000e"], 0x28}}, 0x0) 00:15:29 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) accept4$tipc(0xffffffffffffffff, &(0x7f0000000280)=@id, &(0x7f0000000100)=0x10, 0x40c00) 00:15:29 executing program 1: r0 = socket(0x15, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x89e0, &(0x7f0000000000)) 00:15:29 executing program 4: r0 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r0, 0x0, 0xaa, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev, 0xdc05}, 0x20) 00:15:29 executing program 5: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@private0, @private0, @loopback, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1000000}) 00:15:29 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000040)={0x6, @local, 0x0, 0x0, 'dh\x00'}, 0x2c) 00:15:29 executing program 0: syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/mnt\x00') [ 382.229650][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:29 executing program 2: r0 = socket$vsock_stream(0x28, 0x1, 0x0) sendmmsg$sock(r0, &(0x7f0000002440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x240204d1) 00:15:29 executing program 5: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) shutdown(r0, 0x0) 00:15:29 executing program 1: r0 = socket(0x1e, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000180)={'batadv0\x00', &(0x7f0000000100)=@ethtool_coalesce}) 00:15:29 executing program 4: r0 = socket$kcm(0x29, 0x5, 0x0) sendmmsg$sock(r0, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x4080) 00:15:29 executing program 2: r0 = socket(0x1e, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'batadv0\x00', &(0x7f0000000100)=@ethtool_coalesce={0x45}}) [ 382.379899][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:29 executing program 5: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890b, &(0x7f0000000140)={@private0, @private0, @loopback, 0x300}) 00:15:29 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) accept4$tipc(0xffffffffffffffff, &(0x7f0000000280)=@id, &(0x7f0000000100)=0x10, 0x40c00) 00:15:29 executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x660a405ab70faa85) 00:15:29 executing program 1: r0 = socket(0x1e, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'batadv0\x00', &(0x7f0000000100)=@ethtool_coalesce={0x4e}}) 00:15:29 executing program 4: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000004a00)={'wlan1\x00'}) 00:15:29 executing program 2: r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000140)='V', 0x1}], 0x1, &(0x7f00000001c0)=[{0x28, 0x0, 0x0, "43e98be5fd459bee0d0a53bbf6ba2703fa"}], 0x28}, 0x0) 00:15:29 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x0, 0x0, @private2, 0x7}, 0x20) 00:15:30 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x36}, 0x1}, 0x20) 00:15:30 executing program 1: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) getsockname(r0, 0x0, 0x0) 00:15:30 executing program 4: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890b, &(0x7f0000000140)={@mcast2, @private0, @loopback, 0x0, 0x0, 0x7, 0x0, 0x0, 0x400000}) 00:15:30 executing program 2: r0 = socket$inet6_dccp(0xa, 0x6, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000000)={'wg2\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000000140)={@local, @private0, @loopback, 0x0, 0x88f0, 0x0, 0x0, 0x0, 0x1000000, r2}) 00:15:30 executing program 0: r0 = socket$kcm(0x29, 0x5, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000004c0)=ANY=[@ANYBLOB="70010000", @ANYRES16=0x0, @ANYBLOB="00042dbd7000fddbdf25150000004c00018008000100", @ANYRES32, @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="1400020076657468310000000000000000000000080003000300000014"], 0x170}}, 0x0) sendmmsg$sock(r0, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)="ac", 0x1}], 0x1}}, {{0x0, 0xffca, &(0x7f0000000500), 0x1}}], 0x2, 0x0) 00:15:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x14, r1, 0x1}, 0x14}}, 0x0) [ 383.280333][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:31 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:31 executing program 1: socket(0x1d, 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(0xffffffffffffffff, 0x4010942a, 0x0) 00:15:31 executing program 4: pselect6(0x40, &(0x7f0000000000), 0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000140)={&(0x7f0000000100)={[0xc3b3]}, 0x8}) 00:15:31 executing program 2: r0 = socket(0x1e, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'batadv0\x00', &(0x7f0000000100)=@ethtool_coalesce={0x1d}}) 00:15:31 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000040)={0x6, @local, 0x0, 0x1, 'dh\x00'}, 0x2c) 00:15:31 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r0, 0x0, 0x0, 0x900, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev}, 0x20) 00:15:31 executing program 2: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000740), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000031000000080006"], 0x28}}, 0x0) 00:15:31 executing program 4: r0 = socket$l2tp6(0xa, 0x2, 0x73) recvfrom$l2tp6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$l2tp6(r0, 0x0, 0xaa, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev}, 0x20) 00:15:31 executing program 0: pselect6(0x12, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0)={0x0, 0x989680}, &(0x7f0000000180)={&(0x7f0000000100), 0x8}) 00:15:31 executing program 5: r0 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)) 00:15:31 executing program 0: r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x19, 0x0, 0x0) 00:15:31 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x10, 0x4, 0x0, 0x623ffa69}, 0x48) [ 384.250033][T11371] can: request_module (can-proto-0) failed. [ 384.309812][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:32 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:32 executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x15, 0x0, 0x7}, {}]}) 00:15:32 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) recvmsg(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000580)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9}, 0x12141) 00:15:32 executing program 1: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001440)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000014c0)={r0, 0x0, 0x0, 0x0, &(0x7f0000001480)=[0x0], 0x1}, 0x20) 00:15:32 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x16, 0x3f, 0x0, 0x8}, 0x48) 00:15:32 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xf, 0x0, 0x0, 0x8}, 0x48) 00:15:32 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001780)={0x2c83524e359dec82, 0x3, &(0x7f0000001400)=@framed, &(0x7f0000001480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 00:15:32 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001600)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNGETSNDBUF(r0, 0x800454d3, 0x0) 00:15:32 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001700)=[{&(0x7f00000014c0)='4', 0xffac}], 0x1}, 0x30000014) recvmsg(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000001980)=""/4096, 0x1000}], 0x1}, 0x40002040) 00:15:32 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x7, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x48) 00:15:32 executing program 4: mkdir(&(0x7f0000000600)='./file0\x00', 0x0) sendmsg$sock(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) syz_clone(0x0, &(0x7f0000000180), 0x0, 0x0, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f00000005c0)) 00:15:32 executing program 5: socketpair(0x11, 0x3, 0x8, &(0x7f0000000280)) [ 385.339879][ T1130] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 385.420832][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:33 executing program 1: pipe(&(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RFLUSH(r0, 0x0, 0x4) 00:15:33 executing program 0: pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$9p(r0, &(0x7f0000000140)="9110c8a782fdf5b14f2a2392f99c174edbae57627d51b9ac10b96aabc48fc891b677b44f435b5e633f9ff12470d1077f28e1c4e3dc020a02b9b71947924b2a0513b0021ddd68368dc480c9011ec44405a73f71bc13ebe885de4faa579e52fa9832455918e58275c415d825ef6b03b9e3a8fe7e002bbf70f3487ffccc6de6417165b4b8648eb1de0be7d4a49dfb5e9f523ef451e4d172968fe3beab02cd1c5851090aefa7ab22f0b60aa2ff87664920eb57c70d6e3f370ee87a9fa0f661d3a461e8b2f85c650f3de072099dfeb388137f7b0720feaba37a3999d082b42f20ff4e8af52b3607464aaacb71d32c7eff45dce0894dbd332d83dd568533bc84d7118f436c8c087f727503ccd37403241b5c6c7e8a0c925ae2396b4261bfa98c48c8c06ac77ccaca4124c1e51cef48f095d9f98b087930b251613ed9b3e20fa443e899b3e871165847304445d7c2cba270e64328dad5d4b9f16e5544693522486344458e6c27abd02420b38bea42c6bfb4766cfd60047f6ccb2fd5752b", 0xfffffe1e) write$P9_ROPEN(r0, 0x0, 0x0) 00:15:33 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) close(r1) 00:15:33 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000002980)={0x0, 0x0, &(0x7f0000002900)=[{&(0x7f0000001400)="37f7046629e3d3e373fc465289d0c5e8a83f92abbbd605ff0093f32e879077650bffcb03c4857ba743aa076a12c33fad5d39a7baf880cf9c543858a4a036a0c8af64e8e67d9d1cbfc17941c5435579daeeab577542cf27135f5002cc598e3153f529f499cd2a08905acde418167b4a9ed5a93b006853945bcf9222590cb2a7eee3a35619f9d4eccfe777e3d4198ee02cbb6909a86bdda4d601591603ef0e923de7ef64e7af6782c36dc25ad922d24862b7eef7a7", 0xb4}, {&(0x7f0000001500)="63d17e2a37a5a4f4f681d79c8f290df9cdbaf88fa562957db926d7efcefb74b5194190524f22f4433c02215a6f7cec7a86d379461809afbbf041f935f43ae7995685fe506eaa22fc4b9de959183a2b6473b45da773023b557c23544e674007c0e16294af0e4b7103ecce091dd81125e9e01df9773d67ea82ae3e59b376ddaa1bf33f1e1708000f9e81902cfd473931b06879aa66a97bdb5fac29e704e486f38218e4b6ca6a9def55c0cc8a97e94c3b1583022310d2e19eb257b6c695e3326967d9a4d283f846a1f1ac3bf05818058a2ccef944bc8ef79d7ba6d2c208a944f304e1d2181b7dd7df11902f703b2008f7fd57874f80a7d7e2232c6fc7be57531d2dc91eeb88cc820e662773223b70b723a4a961b616141e0948490b752dc3a016bab7a1fe231fbaddc3bebbc7b093303798767228f4c66581a3d124551490b4894c18da5a2b57040f4bc13e5c62eb8942f65967a7b6bb8bc233fe18af56d0855d5f91ad4dabac5006bdffd9a5da29aff4a88e4d0fe90b5420446697b181d421a2d6cc9aaeaa9961edb3a9413fd7ff12a225727169db4f5b0d8995b696c6b91498858d129ba31be073e0c5d60cbae7578339d5a2b47bb213dc82007ba29097eae02f440a929a75dde069b61c3c413d26dd71d1ec671130567f48aca4bcc0f56d3de2d06f30e5843d5b85612370dfc76abd34c9242892f66c823786d2fe974e8058fac9b01681d49c01d6bcf999cf4eb2200246e09a3526a12b4a6690c7b797404a46feb6145e05f8c25f6143df61fcaa18fa8ed030de4fdb24e66c29996b8795894e9c6681bb31ad54e58b818bd8d7fd77e4253aada38d0ff306f29bae5c45dfd0a6c8d892de5b5f80b9b4d5b43f80dd7e2b1a893cf30e42cdc0e3d7c973d59e640ee91e9f5e0bff975c4787f220fdc19c28a946e1c7b3491cddf5a3773311e6acf8ab70c1d786725759267e0fae00e4780c3aeab90fa55636ef041a2573faef17649c6952c2c72416c95009997aa2bcd3c04d3e81cf02605f8ea70fd0b21ee842d0b0f00370113ff401d9d8a103f9261da65b7bd6da61609c08af49285465baedd61880ef9330e6c142041169e8e48a96dbfcedc1e862734f588d828f7c02b819f9a71863927cc793d88656e8dfbc216c19404372a255a3736932244c88a6f0aef9cca7ecadb62fecb415dc64ba747e93e0d6ebe7289313d08055523fe32bf52b400310c279259c751a7a14d71e1369837a087eefa6fd64a8cac4290277df969835cc18ad5cadeb058b7caa885ca30d37db80121366c38da369819c9b83d5870db403047238cbc394de1c510562bd54dc066052277d6348a55671d6d5e0335e440ab98796665fac1435c9a9f44e22ee97a6b2ab535d16e7687c61028b6e9c4493a05bfce81b31ef1409d0e7e6cfc5c10db5411acc52cb1fc989b76f9e5b1891acaab8f71ef2bbd44162debb0310abe8f4c378cdfba1a60d68c2bda6a201d3c4b9dae68e8737c643dc0575c9c3cca3df2aebe50f2993e9fc10407c4216dd4cfa043d897028f7e0b029d58da20314f36324781ef43ae319386773871474b33acc785c91ec6dbcc594ea8d7aef228e964bf771209e46e81b51e6dbaa41cc6e5e5eb081301cdcf59fc0c4090da38bff21f7912706fcf7fc37d2d272b415160ff22d5cd34101ce451418722eeb0d7573804c6c32efb0a70047beca877acbad4a428dfaa4def33182dde3025a2b251555beb2895e94f67aa4a92d6cf70d921ccaed87fd81c5520a5e5dae44b0045322892f396d3ce73cc39c644ecd09ac471af8b671bab82603f152c52378f007c61e9f3f919ee6957207c449f1c4457c032ffeffc34d912ccb8fc2c5bdd6b9cc572144bda6850718675e8a9725d18415467ce2b4e5afdbdbe97f3bd3ddfde9191e4610046aa05fb95f4a8a587cb8d81eb5f669cee0393df80d876bc9da7b6b84f1fd593dd0a8744952d5d02f14ed780f096c2446af459f898331c2b0af296d329221888fcb78f0c5a3bf31991229f62e5a2c31efd0f15dcff2aaae2c2486e84e19d08a8e850e32bf28296158e599c8802bf1a068ac8d7043b129cc9cbcd9449c51e9c1b4c6080223ce9a2fe785aec6832e9df5ec56e7567741522890afb8e9a195efc0d724627d94d8b8ceec0018c64da0d7f8113ced714059758e5ff92cea5bb1aad74c93771a0b4d80549b6a79e9c6dca752fe849c586e2bd966705d278eee715252ed9769ff3c8028a6aa2e3a37bb57c5be895047e00301838f79ac2fa26bfb1541a3c29af1f5a73b4b5b9d67b459b8795ea2b0145957d852065f99df979422c5a252c3a3b20af4ae2e78319c391227f2d01ef7ab8f03d1899b130b1a6341d2d60f04719a2baeb3171abec0efa6af49706e8293090161ed9b9fe2c2e7b798316e1f9513490f5209d5c3e693970efdc3cd0a5707e29f1f2ce4eff6437213b7a2b987ec601dae0e8a9a451e8398838568bf48206448391fffc439efab8ebc6a0f2dbeed7d7eed536f3e89fa63216dfeb8a5e2ed34f7a37f621dcce65e2e03d4c21357447d6fdd21e859bd4d2980a7b509fcec654638560e3dcf5d389dc5a50fdc32650488e2304ee9d08293dd5434210b3b3fd9ea192e5147df8555efde3e8bdee1f4f7f78d2e1cc79de8de47b6dbea85f4ccb25e7bc0f4e6f9016fd38d6e7b7858b9f04097aacb5e9c9bf723df5b9bc321c5669f54d07e9ab774eb4feb6890336bb076a3ffc3f7615b21c1e58f30a9beb58bf5b44c76142eefebf7bcaa09c4f55974d823f3c261ac78f31c9b9b056c8f9a3c00cf51421cd9749f9e62ff1cfffa1d0adb007c2bf2f5fc1304e3bb811d23c7003731ffa7313f4d4bf447f0ca16a7f04f1498550dddde315d4b19a2bd1697401c8fdeda4de0fd1d6bae814c7087ce423368fc66b6cca9c376b17f26ae2fc5637c04d1edb28e4bb5f679266d1cf89fcab1b26e485b25a86cb6e2e76348d3acd11ebcecde5a72a01160314cc6f6ca10cb12643c68ad070915cb856db52cde62d6f230e568ce889256fce10b31118d945d40602a79870d743b956be8bd534b22cb563d8c9805d5a5c50df81fb2cdccee160e5ccf9f9150a64062a32687a6c055f2f401be8303c57af1d5cef087fb2bbfff594e8fa5411e50794a885e7104c13e54fb24ed7d4b9ab3b2d78dfb332f283132ec00a3825b36cb08edd03b9b1143f1ca3b02868f7ffd7b900f1f1f46fd54f432cb71d15dad5b49590c0ce3ed9f13861573e21d99b6fb787e132033d03aee84b6d530d8ee2c57b6c104fe468f493354d9993b4a9b86e3b198b9ba2393dd51e84c50dc217ffc3d2990d37912aaf384b7e8eb15fba7675be9e15c6271a3ce57006bbe9c3ada32c9b02a0cc452b9c5ae6ff3b9465be0e70f24d6fc2ab37189eef2ba1a6f9fc289b6e14fa32661b2e71a8981c387988087c5ddd27432318dcd2f7e88cfdf20bde7eea62759eb4c54d3d8082ef0f976fef0d82f2b955182651384a149e9ec8eeca0ca6262d01c84cc7180208bb2b7ca5099281851e81e15cdec7c19f8453cbc9749a9374faafb6c57cef349f7988c547400f5ee40f33cbba42c45afa141de014a86e1589d52f5af4ff0bb097f277fbd4871dc4a3451c8b6edb2956dfbee97d6e0fb62736c9bafbb393dca89c1b7a4811b0a06cc556066fd628f44505fb49ab7758d7be0c59c9d75a5b00118e98382dcc9b13c8a75841a6adcc19b7506fc836b0884468d472d76042eb965981dfb9d7788ba30e61bd98e10c24194f0a25bb5ad12ac90d39a877c5062a04f526ebeec5d5251d56cd7c9ca947daa86e53a3431d0f4a62f3294b45b9679617a019d45bcbd7a2f88000759a5b1431ee4a41a922c612305faeefab10306ae44765a9379ce545d7432205f44db4e955906de60ecdc30515e0e64adbdd1dc69190f477035d2d4c16dee6f4447c9ad3a24bd095853672be6c4a63650e31ac462658237a4a2ff62050f01d32e6b437caa7aafbb62ceb724ff66c25595bdb039bbaef0ea6820dc14217baf144bfa97e2eb616efc76c15a26dd51d60eb9269c020fa6810f8c623b293773090cf0e4bbe473f9a433e45a55df8a24fb96978168080af047b1e9e91a1d2103fdc5a16760473f1c3d1c6d4dd38ba4df71f2eb1a1f1e5af6956d8adda55133f65d288d54ab0f2eb3899ca24be06c5a8f7b663f51db748702626fd0502fd838508f118ef725ff64d162e6c0398096f043e0b30dcbac5f77f18dd75d61ee0c493329d0ea246574909d363075031991de145682c385a58d36b0e388a1e8845db7163be0d8dfee5faa999898174f558fbcb01315c830941d81132cebf951ca661cbef4d2cca1667fd7e706cb209031ec03cf7164a34bf010ee2b9b3b6d199807be287f133eb4d27e2637c8e92fa4dc745dcbb3febf4767efb1dfab65950216ce26d2401602f6e2412f545522516a6385b018cba75fe5940ad42e03245b63189e51666f2fe75f3755ba9f5d439f80bffa188477696150239a840aa6ffd312cfef96ababc652511881ad9f47f52225951bdeafd622c42aca50bf2fcc721f2427aa1e961af0ea5abbb8352277696b53bb385d7eddd73e05fb54b8ca697fe15eb10850202afc8c9bdc6fa00be23032130f00b8d907c4586675c714dfefa5ef62616be2b3802e4b8d192338bc951ebdd2b87903e748d095347568c1249a35ddd30dd0bf44b11a6f6ee1d73c65b8477d26b3ee6b16acef83cfa814c34d429a45efe48e6136f0d1a87e99856af509fb274a4aea66cd8c2cd010913c97357f381e01799de14c3af84588f4a1136ee803b9fd2efc93cd0991fa1cba45a6b18bf9c551cd6994b2ebfa13a2613e8583e965f21388180513bc05ed9899f204ab8ac6637b95e076c799c263f9320efcf3071cc02e39ac416cb965edef5428282eafd3575d4ecc8ee8bbc607800e3d4a6463b0cd7504b2cf192cb1715362c5a97dd460528670dd3b5a447e3e9f4c3b71f6e6d7cdb5e955e7c1121517abba376536796d0ed86443f7160294190375a47b9e7b92f0d0cfbbfb5d19c07f2602a1259a2c656eedabf0c993f8d7c7bb33da39230b5b6f5d6a", 0xe0d}], 0x2}, 0x0) 00:15:33 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:33 executing program 4: ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000080)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_TASK_FD_QUERY(0x7, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) 00:15:33 executing program 0: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup/syz1\x00', 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f0000000080)='syz1\x00', 0x1ff) 00:15:33 executing program 1: syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000001000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}}}}]}}, 0x0) syz_usb_connect$uac1(0x0, 0x71, &(0x7f0000003e00)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f, 0x3, 0x1, 0x0, 0x0, 0x0, {{}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7}}}}}}}]}}, 0x0) 00:15:33 executing program 4: ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000080)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_TASK_FD_QUERY(0x7, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) 00:15:33 executing program 5: syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x0, 0x0, 0x0, 0x80}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff}}}}}}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x2, &(0x7f00000001c0)=@string={0x2}}, {0xbc, &(0x7f0000000240)=@string={0xbc, 0x3, "4e45e5a4eacd178add3e1890f72fd40d3c76e8609cf70e17c13c98c900b0f9850742eb2de2beb23f23a82714c1f8c849a1eec107b9b2b8ee136d861f76f039a97e78adf8b3c3abd5e19324a32f4c2f4eef44378f8dc0bff8d22a6489ce9fbb4803eb924a5994ebb1b61ccd4e3fed4a1b02466e1ceb9649881d0ec4e8c6d61cedc7a8e7cf36b1e0aeba38af17a15641d7091f02550816d304480157bbad3e4dc9ce8614d25abddcb18833b1ec9635e96f8386fb4d36c45f719bd9"}}]}) 00:15:33 executing program 2: r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000080)=@ready={0x0, 0x0, 0x8, "19cb5bbb"}) 00:15:33 executing program 0: syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000640)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_connect$printer(0x0, 0x0, 0x0, 0x0) 00:15:33 executing program 4: ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000080)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_TASK_FD_QUERY(0x7, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) 00:15:33 executing program 4: ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, &(0x7f0000000080)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_TASK_FD_QUERY(0x7, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) [ 386.390873][ T3680] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:33 executing program 4: syz_usb_connect$uac1(0x0, 0xe2, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xd0, 0x3, 0x1, 0x0, 0x90, 0x2, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4f46}, [@input_terminal={0xc, 0x24, 0x2, 0x4, 0x0, 0x0, 0xff, 0x6}, @selector_unit={0x5, 0x24, 0x5, 0x6, 0x6}, @extension_unit={0x7, 0x24, 0x8, 0x4}, @feature_unit={0x11, 0x24, 0x6, 0x0, 0x0, 0x5, [0x9, 0x0, 0x1, 0x0, 0x0], 0x9b}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x0, 0x0, 0x0, 0x9}, @as_header={0x7}, @format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x1, 0x1, 0x3, "b095c1a4"}]}, {{0x9, 0x5, 0x1, 0x9, 0x0, 0x0, 0x0, 0x0, {0x7, 0x25, 0x1, 0x82, 0x8a, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0x8000, 0x40, 0xff, "de"}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x50, 0x2}, @as_header={0x7, 0x24, 0x1, 0x1, 0x81}, @as_header={0x7, 0x24, 0x1, 0x0, 0x6, 0x1002}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x5, 0x0, 0xa7, 0x1, "28ff78", '@'}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x81, 0x4, 0x2, {0x7, 0x25, 0x1, 0x83, 0x55}}}}}}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0x20, 0x0, 0x5, 0x0, 0x6}, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) [ 386.619536][ T1130] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 386.629753][ T3767] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 386.669615][ T26] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 386.711355][ T3680] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 386.849658][ T3682] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 386.879594][ T3767] usb 6-1: Using ep0 maxpacket: 32 [ 387.019753][ T1130] usb 2-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 387.028755][ T3767] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 387.040087][ T1130] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 387.050689][ T3767] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 387.061293][ T1130] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 387.070558][ T3767] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 387.080996][ T3767] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 387.090955][ T3767] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1023 [ 387.101191][ T3682] usb 5-1: Using ep0 maxpacket: 32 [ 387.150157][ T3767] usb 6-1: language id specifier not provided by device, defaulting to English 00:15:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) [ 387.244287][T11447] syz-executor.3 (11447) used greatest stack depth: 20080 bytes left [ 387.252934][ T3682] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 387.262572][ T3682] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 387.273230][ T26] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 387.282528][ T3680] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 387.291803][ T1130] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 387.301181][ T3682] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 387.310391][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.318525][ T1130] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.326796][ T3680] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.335169][ T26] usb 3-1: Product: syz [ 387.339927][ T3767] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 387.349179][ T3680] usb 1-1: Product: syz [ 387.353804][ T1130] usb 2-1: Product: syz [ 387.358320][ T3767] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.367427][ T1130] usb 2-1: Manufacturer: syz [ 387.372504][ T3680] usb 1-1: Manufacturer: syz [ 387.377245][ T26] usb 3-1: Manufacturer: syz [ 387.382246][ T1130] usb 2-1: SerialNumber: syz [ 387.387476][ T3680] usb 1-1: SerialNumber: syz [ 387.393055][ T26] usb 3-1: SerialNumber: syz [ 387.398150][ T3767] usb 6-1: Product: syz [ 387.410205][ T3767] usb 6-1: Manufacturer: 䕎ꓥ췪託ã»é€˜â¿·à·”瘼惨ᜎã³ì¦˜ë€€è—¹äˆ‡â·«ë»¢ã¾²ê £á§ï£ä§ˆîº¡ß늹洓ᾆï¶ê¤¹ç¡¾ï¢­ìŽ³í–«é¡êŒ¤ä°¯ä¸¯ä“¯è¼·ì‚⫒襤鿎䢻䪒鑙뇫Ჶä»î´¿á­Šä˜‚ᱮ雫衉à¸î£„훆꣇쿧넶껠㢺ឯ嚡íἉ唂ᘈӓň뭗㺭ì¥è›Žíˆ”뵚뇜㎈㖖濩蚃䷻ì¶ç…Ÿ [ 387.438986][ T3767] usb 6-1: SerialNumber: syz [ 387.451830][ T3680] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 387.463500][ T26] usb 3-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 387.498185][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 387.609711][ T3682] usb 5-1: string descriptor 0 read error: -22 [ 387.617113][ T3682] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 387.634000][ T3682] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.651888][T11442] UDC core: couldn't find an available UDC or it's busy: -16 [ 387.666661][T11442] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 387.750023][ T3767] cdc_ncm 6-1:1.0: bind() failure [ 387.755301][ T1130] usb 2-1: 0:2 : does not exist [ 387.770959][ T3767] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 387.777903][ T3767] cdc_ncm 6-1:1.1: bind() failure [ 387.789661][ T3682] usb 5-1: 0:2 : does not exist [ 387.798954][ T1130] usb 2-1: USB disconnect, device number 2 [ 387.886923][ T3721] usb 5-1: USB disconnect, device number 11 [ 387.895149][ T3767] usb 6-1: USB disconnect, device number 64 00:15:35 executing program 1: syz_usb_connect$uac1(0x0, 0xa8, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x20, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x96, 0x3, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x4f46}, [@selector_unit={0x5}, @selector_unit={0x5, 0x24, 0x5, 0x5}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x0, 0x0, 0x5, 0x9, "", "cd"}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0x1, 0x1, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x6, 0x0, 0x5, {0x7, 0x25, 0x1, 0x82, 0x8a, 0x8}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0x50, 0x0, 0x1f}, @as_header={0x7, 0x24, 0x1, 0x1, 0x81, 0x4}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x5, 0x3, 0xa7, 0x1, "28ff78", '@'}]}, {{0x9, 0x5, 0x82, 0x9, 0x0, 0x81, 0x0, 0x2, {0x7, 0x25, 0x1, 0x0, 0x55, 0x7}}}}}}}]}}, &(0x7f0000000200)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0x20, 0x0, 0x0, 0x0, 0x6}, 0xc, &(0x7f0000000180)={0x5, 0xf, 0xc, 0x1, [@ext_cap={0x7, 0x10, 0x2, 0x12, 0x1, 0x0, 0xeb8}]}, 0x1, [{0x4, &(0x7f00000001c0)=@lang_id={0x4}}]}) [ 388.139894][ T3678] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 388.149011][ T22] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 00:15:35 executing program 5: syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5c, 0x2, 0x1, 0x0, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, {0x6}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x0, 0x0, 0x0, 0x80}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff}}}}}}}]}}, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x2, &(0x7f00000001c0)=@string={0x2}}, {0xbc, &(0x7f0000000240)=@string={0xbc, 0x3, "4e45e5a4eacd178add3e1890f72fd40d3c76e8609cf70e17c13c98c900b0f9850742eb2de2beb23f23a82714c1f8c849a1eec107b9b2b8ee136d861f76f039a97e78adf8b3c3abd5e19324a32f4c2f4eef44378f8dc0bff8d22a6489ce9fbb4803eb924a5994ebb1b61ccd4e3fed4a1b02466e1ceb9649881d0ec4e8c6d61cedc7a8e7cf36b1e0aeba38af17a15641d7091f02550816d304480157bbad3e4dc9ce8614d25abddcb18833b1ec9635e96f8386fb4d36c45f719bd9"}}]}) 00:15:35 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:35 executing program 4: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x5, &(0x7f0000000000)=@framed={{0x18, 0x9}, [@initr0]}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) [ 388.344003][ T3719] usb 1-1: USB disconnect, device number 5 00:15:35 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000d00), 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000140)={'ipvlan0\x00', 0x400}) [ 388.459872][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 388.489549][ T3721] usb 2-1: new high-speed USB device number 3 using dummy_hcd 00:15:35 executing program 4: openat$tun(0xffffffffffffff9c, 0x0, 0x400000, 0x0) [ 388.529995][ T3767] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 388.547362][ T3633] usb 3-1: USB disconnect, device number 10 [ 388.556512][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 388.729595][ T3721] usb 2-1: Using ep0 maxpacket: 32 [ 388.809533][ T3767] usb 6-1: Using ep0 maxpacket: 32 [ 388.929649][ T3721] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 388.943622][ T3721] usb 2-1: config 1 has no interface number 1 [ 388.952837][ T3721] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 388.966482][ T3721] usb 2-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 388.969667][ T3767] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 388.986803][ T3721] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 129, changing to 7 [ 388.990426][ T3767] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 388.990469][ T3767] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 00:15:36 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f00000028c0)={0x0, 0x0, &(0x7f0000002780)=[{0x0}, {&(0x7f0000001480)="8d", 0x37fe0}], 0x2}, 0x0) 00:15:36 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0x0, 0x4}]}]}}, &(0x7f0000000200)=""/209, 0x32, 0xd1, 0x1}, 0x20) 00:15:36 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x6, [@func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x5}, {0x8, 0x1}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000000280)=""/252, 0x3a, 0xfc, 0x1}, 0x20) [ 389.012776][ T3721] usb 2-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 389.022019][ T3767] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 389.042611][ T3767] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1023 00:15:36 executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001640)={0x9, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 00:15:36 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xb, 0x0, 0x0, 0x1c0000}, 0x48) 00:15:36 executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x10, 0x5, &(0x7f0000000000)=@framed={{}, [@func, @func={0x85, 0x0, 0x1, 0x0, 0x7}]}, &(0x7f0000000140)='GPL\x00', 0x2, 0xaa, &(0x7f0000000180)=""/170, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) [ 389.099828][ T3767] usb 6-1: language id specifier not provided by device, defaulting to English [ 389.189630][ T22] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 389.198947][ T22] ath9k_htc: Failed to initialize the device [ 389.233652][ T3719] usb 1-1: ath9k_htc: USB layer deinitialized [ 389.240280][ T3721] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 389.249334][ T3721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.259694][ T3767] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 389.270296][ T3767] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.286586][ T3767] usb 6-1: Product: syz [ 389.289513][ T3721] usb 2-1: Product: syz [ 389.293406][ T3767] usb 6-1: Manufacturer: 䕎ꓥ췪託ã»é€˜â¿·à·”瘼惨ᜎã³ì¦˜ë€€è—¹äˆ‡â·«ë»¢ã¾²ê £á§ï£ä§ˆîº¡ß늹洓ᾆï¶ê¤¹ç¡¾ï¢­ìŽ³í–«é¡êŒ¤ä°¯ä¸¯ä“¯è¼·ì‚⫒襤鿎䢻䪒鑙뇫Ჶä»î´¿á­Šä˜‚ᱮ雫衉à¸î£„훆꣇쿧넶껠㢺ឯ嚡íἉ唂ᘈӓň뭗㺭ì¥è›Žíˆ”뵚뇜㎈㖖濩蚃䷻ì¶ç…Ÿ [ 389.294965][ T3721] usb 2-1: Manufacturer: syz [ 389.337426][ T3767] usb 6-1: SerialNumber: syz [ 389.362339][ T3721] usb 2-1: SerialNumber: syz [ 389.419672][ T3678] usb 3-1: Service connection timeout for: 256 [ 389.425862][ T3678] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services [ 389.434818][ T3678] ath9k_htc: Failed to initialize the device [ 389.441569][ T3633] usb 3-1: ath9k_htc: USB layer deinitialized [ 389.603322][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 389.629631][ T3767] cdc_ncm 6-1:1.0: bind() failure [ 389.638078][ T3767] cdc_ncm 6-1:1.1: CDC Union missing and no IAD found [ 389.645244][ T3767] cdc_ncm 6-1:1.1: bind() failure [ 389.659201][ T3767] usb 6-1: USB disconnect, device number 65 [ 389.734089][ T3721] usb 2-1: USB disconnect, device number 3 00:15:37 executing program 1: syz_clone(0x44108000, &(0x7f0000000040)="caed65c228893c654e4ce7a6b14cbb512ffda8e82a1264f02387e529287f8df30905a828daba74e0cced1a8ea82ce6e9b011804ad2e2078c1c56ce5e77", 0x3d, 0x0, 0x0, &(0x7f00000001c0)="29db991fb9980af0c2d441992d4ed8a64e33f1ba3210940f9d938fddc192a491fe22d4d2dd662e306b59839bae2232f16b7fcb5627bb97111755e41a650fd38c9ae20bc0bffcfb53237a84028a4bdcc22f15b4dc2443e79465a05534d170de1157") bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x7, 0x2, &(0x7f0000000000)=@raw=[@alu={0x4, 0x0, 0x5, 0xf, 0x8, 0xfffffffffffffff4}, @ldst={0x1, 0x3, 0x6, 0x7, 0x6}], &(0x7f0000000300)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00, 0x3, '\x00', 0x0, 0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x0, 0x1}, 0x8, 0x10, &(0x7f0000000380)={0x0, 0x1, 0x1, 0x6}, 0x10}, 0x80) 00:15:37 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:37 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xd, 0x1, &(0x7f00000001c0)=@raw=[@kfunc], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 00:15:37 executing program 4: bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000cc0)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 00:15:37 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0xda000000, 0x0, 0x0, 0x2}}, &(0x7f0000000500)=""/219, 0x1a, 0xdb, 0x1}, 0x20) 00:15:37 executing program 5: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@bloom_filter={0x1e, 0x8, 0x0, 0x3, 0xd02, 0xffffffffffffffff, 0xfffffffb, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x0, 0x2}, 0x48) bpf$LINK_DETACH(0x22, &(0x7f0000000080), 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz1\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz1\x00', 0x1ff) 00:15:37 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x16, 0x0, 0x3, 0x7}, 0x62) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000300)={&(0x7f00000002c0)='./file0\x00', r0}, 0x10) 00:15:37 executing program 2: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x1) 00:15:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) sendmsg(r0, &(0x7f00000019c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003980)=[{0x10}, {0x18, 0x1, 0x1, "8ed100a7"}], 0x28}, 0x0) 00:15:37 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000002280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x4}]}]}, {0x0, [0x0, 0x0, 0x0]}}, &(0x7f0000000640)=""/216, 0x35, 0xd8, 0x1}, 0x20) 00:15:37 executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000002300)={0x0, 0x0, &(0x7f0000002200)=[{&(0x7f00000000c0)="2e595b752f29c6d11d632f35c416b1d056ad663205b8aa58d46c39cf51ba9866f0dc296b8b99041fccfad81f253eac812019960e6433c65ec844e2d4c66dd4080a0a65558d977605b5678e4a3831ba0cf2cea370f3149f07ae696969c7f3a88e72d9713dcd05d9eae199df16e7fe98de8e5df7ebd352f16fb21ae6be239beae91dede0a0f4649eecbb8ba09bda1a99bc428bccf7191029f5198beb77e97a1017464cb4307706a7b63c96ef5922620846e100a488add1485351fe82c04062e0213bf0ee38ca29265a0197d37c34ce663eaf91fd502beb0cf1841fde94eca0bc75c2c53cea3416b33b2cf916d8d5ac783d72454d73db774036ca6d37b61125a3eb80741e3d88539102ebdb2a82624f755bc03857f00c9ba77455d592def1152c2fb2d2fc86de2ca79c7eccbdc5efc6dfacb4a7ec6c1d6256a40b866646799e2651701c1deed724457760db1f4b240aeda838d5086bdefe4d6a359194d8d194b4741b75351b21a49c13579ac80e90226cd12db7d14a40e74ab52843961447969ac4c223c142749f876adae1ec6068d5e6b0165cb7f9cede1e472714625af12c430f2b8b76007a3f16c351834fb9fe08799264d1f10198f970af67a9b4a3a0805a8273ae9eab6922e92ec2a9dd7eb20ef601e500033fc4d21306004067a45128e852f36ea2c61def6bddea3e1c49d23e9d76ea7b3b24ee3019648e1030de5af91e2103c7170ae5921c4a68bb1c6286fd505e9bad48830e50c061151f4e289efed4909a70f735986455ce8f20adbd5be16c0cac99a23cd1b9a810aa287ffc91c03d12fb98b467705d41a7b41e2e11ec1fd4c37ca91a85a7a759ffe1f6d32d81e1221c02944b3794a4cf6acd64c659ee82640a2182a73bd4ccfd7080916919c829895dad57225de3440617b00162bc52f317bbde593225763bfe4faebcb6b2cd3dddf1ba7bb2449145e3d4afb55e9b8bab3835decefb6a151947c52dbaed16ada797ec6cd60ebe0771e3524946bf9ca1385fe9df6b9a72fd5b929b49a867011a9cf714efc5a0f7a462bece91a0db41beeae42adec066bcd647e48469d6b605c3e356e4c39fabb32b95e756fa7d6a52406340ff21a84fc5dc2de56d48eb7c5dc4671f8b4f8ae613ac34abc2f8e89b82f7043d842297c12221a456daed6eb5995d18572fd2e983d65384f5d509c10054a809fdb057490c90deb0940c15ebd43f36900b55389ae6a3d939a944da0b78357df73de254598457d33c1924405f42b86e1ab116dd1e0886677b687c3d3e5658dfa8d53e049ac340bf3ae9129d1747db5b794588d8fb48094abcb35f2ace08dabcbae615c7c3e69043deaf1966448d2f2f402054aa13ea1d0eb12d9e60f5c87e391978c5a33d204ea552270b95df5b07323cfd220da1ae0f1285c56c7d3508d0d6004d0e70a6be6fd6c3aae6e3f4facd6e02fa0fb655c1e1fced0a3608b88fb40e3d76bbb5b4a044ad9c454effaf200bd39ae5b4aec053b9e7c55ca816256a2e6bbb68048c53caaae5bf3bab02608cedaadf5731f3c55dde128c8240180ab788d8fb8e41aa0e0e71076ce883e53a9f5b4ec72b01776e53f122fafbfdc8314d5b3d87efa703801ef4f3999abe64293416345287d8524c8f1cbc280aa945ed1d9e99db275eaf805ad93f0f8b12a4bc3ae8191dbad1d6b901349d01e19d30cb2833fb2f3cc131f281f0b1a4bb9455fdfb89bcded7e8a912fa7b3512497c7d2d9e7cb1944a41d6514fbee90b22ae2fc90e91a7c276261cc69a0493ac69d70cf79cadfa49f8dc7b3fc7254a10d4732933e8d60db3f2088a22ea50b4ba975a9b41908679a737d9ddb2c0d6fa43b237f0f5ce3c5ca629e291c472a8b690ee8e95bf4bc2443284c51f483351157a61a6517e2785cb63cf57c92c4a6e0da48ecd4cdea24ad78f0a35f15a823426f711eb17cf0f7a6b2fdf52e056c23907eec3e300508de0be8fc74daac733301e086843e8448f12c25c133e31e994cb299e5c93a700ac2b1b71d7aa6f136fb1c11202f717fa877bb7f00afa473357ad5e35e495d4a410e3f116cd111ae249dfe4310df688050a5ec40684745c17955b295ae896a0ce337981f9c12c422e6aceb74f3789dcc0e50c9763ab2860dfd8b63951875fec8622ee397d007bc0df065a3f7cbe07ee54d2f72640d1d0d8c44912e1fd6fff42310ea591f3c9b9cb71b32d2e63d3fd9e2971c0c699fce2edc8cfce8828e2122db9740755d46bcd20b21217fadd9c836ef0c67eff42549167cd5745d6dae7dedc5a4efd85187140fd889b2131b88a71c147ab104dd29fc08bb23b7e21302d1aa4a6841eb8e1eb9506819a6fd54d3dc293215c607ba443750dfe811bf67bb17f695372face2b609f91fb93798b654a5ef333ed570b72a2ca6fcdf2823e43531b02cf8260774632b40855a45e1a46b8cacf74ff5faa1d1845806ed46cdae02ed528d66148e6b3ad87f57b0c89f5c4194dbfd5e568cb09d11379d14b26f6c2f87d77f95f7fe8bec15aa8bab918c6c5642c1b266e3b0bf34ed735c113a45b2119efd21687ce26630103c359b4fab69d92c5fd3dbbca8368db72ccc6ede84078e0502b3ca6235411dbd3343c86b8daaad611dc3c4a1bcaccfb8794bbb7a6c364b4a97b0a9dc1c7f81ed0d02ef3a155ab4e1012c4305cb17820fc63e8d950dbc91225b351cd24b885ac7d734b8836c1d4681e0f72e2e0c4e1c47d5978295000c3dcd282dfe4a092ff6963bd404f9696572102fd90d83e5e9e822accdc6aa11d1a32963d957ec5e615a89325f1011879502f6aea114aee905698120bcb8fac4ddd2ab91b5d54beee716ac20cb49ef27543231719b8e923a4f9f1df71894636285157c04d6b0100daa2b34126e8830c39f9ba1077ff74166ff3b8098e0068174dab5a38d02c0a6052d90568b97ea1f8d66818a2f5dd754cd4abd85e1a59b5dd559f33339431b73cc444951ea13694a4377801bc1110493d86ff3a3bb20cf2c0096209c398ff2a8398cb47bb679b15f622826ba3fd4e02c40199c9f6941a41d49fc5ab90422069c14f7a31eb6d161608b3afc7b14f241294bdb4689945421a105ea3e796d7837a38b52fafe52f6c90232d9c474bc3485de4e2e790d131148626707d36fd5c4c8d5e57d0de80b368fe9b59a78bf4dee9a6cb9885d63346606f2349a66ad3106e3002cf7bec9e93a53a64f98aa0bdda77bdcf6332e777c08dd0946e27c28d6b8cb3b74e059983da0403d29b72b04bf43ac30c737c6d230e196ac14f8c15bce0fa5fec5ca2a7c15e325f835e05752aadd08bb57d6b1e85d68deb7bd8053e407956255bff8233cdda27e3aaa26fecf3097999824596580ef0ec5d8b6630f579b6708f32fb485ae2f56c24b9866e8e25ea063b3677e6a27d7d7b3f71173c713eba851c2927039d8c504815f871318aa8cefeebed2a2bedfdb15aff568093fff2eef54766a698879cd6cbfaf4bb35b5c4d2229f4505b0b743a0e7125488e245c356600a25dc00b7610024b6dbd1bf8e48c28da83ed677cc41688db8d9656ccd3f46ac0d5e514403497fcf9631f7b2c47945f34ef4e494f84516bcf63a28d55d229cbf1750cfcd95a4b8102366ec9029c01d43cb1156d12f655f45a521ecce09ede17300a9221b1092151031e4117ef6ffcd2ae8ef42f4b4b28ceedfac6188be9087018f7a26e72e2a39748061befc1d58f96279ca55f161a457205e0bfcf92f3a5f0a7a7425f9d87ff673f8968420416d782b86ff25b451e8e35e847264e1a75f51f4668e0f7c4e5cfb1e7416da2fdf661c2fd1f1d5ff62b7e605266a97a4651eda853ab032bf498e3446ff37cf825011023732ce66e0d43aa9c98c0457c5f84dc3fca637104d6c1fdeb6dd35d6f386421158240bbfa5f64b7c41f855a07c4fd0692c4ef7b908633a587f956c882d1d1d635840cb13b9de488c99e0f5d5de489cfdc02c0424937a28b2a7e023d77020206bf9a3fa375f9ec7b83e3694e3228d860caba222e13451e3ce5de0ffc978c2e7d6873f982ff94f57f385337b8a7b51076efe2cb86b2f924858c652d8370146990745d1f2ac0d5fefb80909ef88818988e5ac1ac8cfee743ca95bf2f97eac4424742217eef0931ce6986134482299dc2167d817e2a1cc75b01b42e1e277da0b5430dda9e3f92d0225eae79a4d1b187058bc428bd07308cd3cdfc9b0c9d983986e98740880468bcd397a91d16668c4fc068192692e16c1c3c9a6ce821273e5eae253ff321d1eb2cae99a1e28f571483240c72e814c0e5c32479491396a862b251ecf55197823a606159458d61600881f0c12abbee6649a56b414878e9b2b8aa21abe9d0631b4dcd71b0fc4fb68061c337681751f7ffaeec19eeb6e1a0853716b5013b4ea799aae76ba708637466b96b70893e4e690dc3243cf2689b62a2d4ff597fbbdf2114d6375a9054e017bad9424e2581f95a0bf42b218ffdb70f57fb241a7ccb0bd7099ff54d4814f7cdfc8889a269875cb3909012531f7c94545c71999aa4b4fc85ad7567f029efaee426b356a9356bf57d0cb27583c996a495949387169bb360ce0c2d5ad255d3dd4acc209bef77813e82e791e0ac4ad72275686a931743107918fe367aaa6282a40e6f31a443bd7ba8d429a6d0fc6070e34022551af4e70991f564b7113194cbbfbd10feb4a00a309054c376d343a5b948fa59850992244457a25c738d4ff7da08ce56023d8661765d4167e20fbb6d2edf9d25c8d5f45cea680de25f13a3ee0e4c3bb85a342d57c62aca381fde8cf3906f3c07389b31b60d4b0f949bb7bcf68067f8c0976ecf35827c117a5c78c2751e572d8ebceb58fdcfb19cc005e0a6b57357053180d394d526fd29fa5ebe22232624f45578a7070add70dfb33585818b72a45d0c1192007a8780833896a9ed8c9f0d32644b1ce72d827b204de2b161046a35ad2dad3c15615d6ffdbcf361157804f375358072e32199001d9c19605a226e1bb4aef63cb994c49ea335b5917c6e80a0db8c0ff6e7418819e87709c92f9ada25b501b96a96c90fb69925f18adf3e2fc84d555a759e374ac8a4cd705a7aecc2cfaf76a94571bb4ae7490e78a027bceffb3ffcb4a062c654a83f3c9480a96d5fae36b1a8ece277350f28f3a5838cfcf194e4ae7aac1112a96dacf4988137c27101cf3499396c6c71fbb15949f6f8f56f7a1aa17ac91ab905f5976f47ce29ceb4d4e79f51f453604fc7b14bbc2fcf5da723dc4c5845d4c023ce86d4d1ca553a9", 0xe81}], 0x1}, 0x0) 00:15:37 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000440)="c0", 0x1}], 0x1}, 0x40) [ 390.296163][T11497] lo speed is unknown, defaulting to 1000 00:15:37 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x3, &(0x7f0000000000)=@raw=[@func, @map_idx_val], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) [ 390.630204][ T3678] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:38 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x3, [@var={0x2}]}, {0x0, [0x0]}}, &(0x7f0000000100)=""/167, 0x2b, 0xa7, 0x1}, 0x20) 00:15:38 executing program 2: socketpair(0xa, 0x2, 0x3, &(0x7f0000000080)) 00:15:38 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000001640)=@base={0x9, 0x0, 0x0, 0x0, 0x40}, 0x48) 00:15:38 executing program 0: bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={0xffffffffffffffff, 0xd, 0x0, 0x0, 0x0}, 0x20) 00:15:38 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:38 executing program 1: syz_clone(0x44108000, &(0x7f0000000040)="caed65c228893c654e4ce7a6b14cbb512ffda8e82a1264f02387e529287f8df30905a828daba74e0cced1a8ea82ce6e9b011804ad2e2078c1c56ce5e77", 0x3d, 0x0, 0x0, &(0x7f00000001c0)="29db991fb9980af0c2d441992d4ed8a64e33f1ba3210940f9d938fddc192a491fe22d4d2dd662e306b59839bae2232f16b7fcb5627bb97111755e41a650fd38c9ae20bc0bffcfb53237a84028a4bdcc22f15b4dc2443e79465a05534d170de1157") 00:15:38 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002840)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) 00:15:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x4020940d, &(0x7f0000000080)={'ip6_vti0\x00'}) 00:15:38 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000600)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}]}}, &(0x7f0000000500)=""/219, 0x1000000, 0xdb, 0x1}, 0x20) [ 391.099863][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:38 executing program 5: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001240)) [ 391.158123][T11524] lo speed is unknown, defaulting to 1000 00:15:38 executing program 0: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0x7, [@var={0x3, 0x0, 0x0, 0xe, 0x5}, @typedef]}, {0x0, [0x0, 0x0, 0x2e, 0x30, 0x5f]}}, &(0x7f00000000c0)=""/160, 0x3b, 0xa0, 0x1}, 0x20) 00:15:38 executing program 5: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001640)={0x1a, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x6}, 0x80) 00:15:38 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) sendmsg$sock(r0, &(0x7f0000000b00)={0x0, 0x0, 0x0}, 0x0) 00:15:38 executing program 2: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000000500)={&(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{}, 0x4}}, 0x10, 0x0}, 0x0) 00:15:38 executing program 4: syz_clone(0x48010000, 0x0, 0x0, 0x0, 0x0, 0x0) 00:15:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) close(r0) [ 391.500066][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 391.670052][ T3678] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:39 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:39 executing program 0: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$tipc(r0, &(0x7f0000000400)={&(0x7f0000000080)=@id, 0x10, 0x0}, 0x0) 00:15:39 executing program 1: socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) 00:15:39 executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001640)={0x15, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 00:15:39 executing program 4: socketpair(0x11, 0x0, 0x0, &(0x7f00000001c0)) 00:15:39 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002840)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x2040) 00:15:39 executing program 5: socketpair(0x25, 0x0, 0x0, &(0x7f0000001540)) 00:15:39 executing program 1: sendmsg$unix(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x0) 00:15:39 executing program 4: shmat(0xffffffffffffffff, &(0x7f0000fec000/0x12000)=nil, 0x0) 00:15:39 executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_linger(r0, 0xffff, 0x80, &(0x7f0000001600)={0x1f}, 0x8) 00:15:39 executing program 2: clock_nanosleep(0x0, 0x0, &(0x7f0000000340)={0x0, 0xffffffffffff4f9f}, 0x0) 00:15:39 executing program 5: bind$inet(0xffffffffffffffff, &(0x7f0000001580)={0x2, 0x3}, 0xc) [ 392.719002][ T3678] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:40 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:40 executing program 1: open(&(0x7f00000006c0)='./file0\x00', 0x200, 0x0) 00:15:40 executing program 0: mknod(&(0x7f0000000200)='./file0\x00', 0x8000, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) 00:15:40 executing program 4: r0 = shmget(0x3, 0x1000, 0x0, &(0x7f0000ffc000/0x1000)=nil) r1 = shmget$private(0x0, 0x1000, 0x1b, &(0x7f0000ffe000/0x1000)=nil) shmget$private(0x0, 0x3000, 0x28, &(0x7f0000ffd000/0x3000)=nil) shmctl$IPC_RMID(r1, 0x0) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x0) shmctl$IPC_STAT(r0, 0x2, &(0x7f0000000000)=""/4096) r2 = shmget(0x3, 0x1000, 0x0, &(0x7f0000ffc000/0x1000)=nil) shmat(r2, &(0x7f0000ffe000/0x2000)=nil, 0x0) shmctl$SHM_LOCK(r2, 0x3) 00:15:40 executing program 2: lseek(0xffffffffffffff9c, 0x0, 0x0) setitimer(0x2, &(0x7f00000000c0)={{0x1}, {0x0, 0x3ff}}, &(0x7f0000000100)) 00:15:40 executing program 5: r0 = socket$inet6(0x18, 0x3, 0x0) connect$inet6(r0, &(0x7f0000000040)={0x18, 0x3}, 0xc) 00:15:40 executing program 0: fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) accept(0xffffffffffffffff, 0x0, 0x0) accept$inet(0xffffffffffffffff, 0x0, 0x0) semget(0x3, 0x0, 0x0) semctl$GETPID(0x0, 0x0, 0x4, 0x0) 00:15:40 executing program 1: pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x0) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x0) r2 = getpid() fcntl$setown(r1, 0x6, r2) fcntl$setown(r0, 0x6, r2) 00:15:40 executing program 2: socket(0x10, 0x2, 0x6cf) 00:15:40 executing program 4: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f0000000000)={0x15, 0x0, 0x9, 0xc, 0x80}) 00:15:40 executing program 5: r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000280), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, r0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFNAME={0xa, 0x4, 'wpan4\x00'}, @NL802154_ATTR_WPAN_PHY={0x8}]}, 0x28}}, 0x0) 00:15:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet6_mreq(r0, 0x29, 0x0, 0x0, 0x0) [ 393.663720][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 393.750545][ T3678] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:41 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:41 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r0, 0x8946, &(0x7f0000000900)={'sit0\x00', 0x0}) 00:15:41 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:41 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:41 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:41 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:41 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:41 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[]) chdir(0x0) [ 394.812807][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:42 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:42 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) chdir(0x0) 00:15:42 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:42 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:42 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:42 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:42 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) socket$inet_udp(0x2, 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:42 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 395.841775][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:43 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:43 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:43 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:43 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 396.699837][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:43 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) chdir(0x0) 00:15:43 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:43 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 396.876980][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:43 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:44 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:44 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:44 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:44 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:44 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:44 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:44 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:44 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 397.932389][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:45 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(0x0, 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) chdir(0x0) 00:15:45 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:45 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:45 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @rand_addr=0x64010100, 0xfffb, 0x0, 'nq\x00'}, 0x2c) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:45 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:45 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:45 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:45 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:45 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:45 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 398.780208][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 398.792537][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:45 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 398.987163][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:46 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:46 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:46 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:46 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r5 = socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x6, 'dh\x00', 0x22}, 0x2c) setsockopt$inet_msfilter(r5, 0x0, 0x29, &(0x7f0000000300)=ANY=[@ANYBLOB="00060000000000dc0a00000010ffffffffffffffff090000009a000001800077da1102e3e0ca1f70e5d01f0bcaf06b860a5d3a64b1bba17c154e5bf29acba5e56482f49847995bf54ecc09fcdef8fc3bb4c412c419ae"], 0x28) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:46 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:46 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:46 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:46 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:46 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 399.739975][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:46 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:46 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:46 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:46 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 400.079143][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:47 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x43, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:47 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:47 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:47 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:47 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) 00:15:47 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:47 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:47 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) 00:15:47 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:47 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:47 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:47 executing program 0: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:48 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socket$inet(0x2b, 0x801, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:48 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) [ 401.117466][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:48 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) 00:15:48 executing program 0: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:48 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:48 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:48 executing program 0: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:15:48 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:48 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:48 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:48 executing program 5: write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:48 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:49 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:49 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x0, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:49 executing program 5: write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:49 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 402.157497][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:49 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:49 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:49 executing program 5: write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:49 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:49 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) [ 402.779830][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:49 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:49 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:49 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:50 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) [ 403.203188][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:50 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x0, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:50 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:50 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:50 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:50 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:50 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:50 executing program 5: openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:50 executing program 5: openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:50 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 403.905002][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:50 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:51 executing program 5: openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) 00:15:51 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) [ 404.233966][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:52 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:52 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, 0x0, 0x0) 00:15:52 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x0, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:15:52 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:52 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, 0x0, 0x0) 00:15:52 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:52 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:52 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, 0x0, 0x0) 00:15:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) [ 405.312476][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:52 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) 00:15:52 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:53 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:53 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) 00:15:53 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:53 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:53 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:53 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) 00:15:53 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 406.398812][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:53 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:53 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) 00:15:53 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:53 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) 00:15:53 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 406.940363][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:54 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:54 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) 00:15:54 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:54 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:54 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0xf000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:54 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:54 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 407.428904][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:54 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:54 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:54 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:54 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:54 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_pressure(r2, &(0x7f0000000080)='cpu.pressure\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) write$cgroup_pressure(r3, 0x0, 0x0) r4 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000140), 0x12) 00:15:55 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:55 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:55 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) [ 408.380091][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:55 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:55 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:55 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 408.499004][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:55 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:55 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:55 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:55 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:55 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 409.024094][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.034226][ T45] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.043574][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 409.052438][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:56 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:56 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:56 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:56 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:56 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:56 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:56 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:56 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:56 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:56 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:56 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:56 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:15:56 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:56 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:56 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:15:57 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:57 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 410.556964][ T3681] net_ratelimit: 2 callbacks suppressed [ 410.556977][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:57 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:57 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:15:57 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:57 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:57 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:57 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:57 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:57 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:57 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:57 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:15:58 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:58 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) [ 411.605835][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:58 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:15:58 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:58 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:58 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:58 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:59 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:59 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:59 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:59 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:15:59 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:59 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:15:59 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 412.629774][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:15:59 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:59 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:59 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:15:59 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:15:59 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:15:59 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) [ 413.019969][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:00 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:00 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:00 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:00 executing program 3: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:00 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:00 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:00 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.net/syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) [ 413.683677][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:00 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:00 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:00 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:01 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:01 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:01 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:01 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:01 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:01 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:01 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:01 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0xf000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:16:01 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) [ 414.722989][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:01 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:01 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:01 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) [ 414.781883][ T4747] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.809556][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 414.819441][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:02 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:02 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:02 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:02 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:02 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:02 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:02 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:02 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:02 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 415.748320][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:02 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:02 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:02 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 416.060014][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:03 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:03 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:03 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:03 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:03 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:03 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:03 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:03 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 416.795230][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:03 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:03 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:03 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:16:04 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:04 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:04 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:04 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:04 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:04 executing program 5: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:04 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:04 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0xf000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:16:04 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:04 executing program 5: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) [ 417.828968][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:05 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:05 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:05 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:05 executing program 5: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:05 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:16:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:05 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:05 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:05 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:05 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:05 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:05 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:05 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:05 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:05 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 418.874410][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 419.099914][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:06 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:06 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:06 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:06 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:06 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:16:06 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:06 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:06 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:06 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:06 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:06 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:06 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:06 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:06 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:06 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:06 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 419.906958][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:07 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:07 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:07 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:07 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:07 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:07 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:07 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:07 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:07 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:07 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:07 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:07 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) [ 420.958218][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:08 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:08 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:08 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:08 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:08 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:08 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:08 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:08 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:08 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:08 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:08 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:08 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) [ 421.989880][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 422.140113][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:09 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:09 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:09 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:09 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:09 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:09 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:09 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:09 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:09 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:09 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:09 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:09 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) [ 423.028672][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:10 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:10 executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:10 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:10 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:10 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:10 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:10 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:10 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:10 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:10 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:10 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:10 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) [ 424.065081][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.390478][ T3633] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:11 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r0, &(0x7f0000000200), 0xf000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000140), 0x12) 00:16:11 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:11 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:11 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:11 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:11 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:11 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:11 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) sendfile(r1, r0, 0x0, 0x8000000000004) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f0000000140), 0x12) 00:16:11 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:11 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:11 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:12 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:12 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:12 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 425.140029][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:12 executing program 3: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:12 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 425.180944][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:12 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:12 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:12 executing program 3: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:12 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 3: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:12 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:12 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:12 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 2: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 426.221036][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:13 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:13 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:13 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:13 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:13 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:13 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:13 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:13 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:14 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:14 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:14 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:14 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:14 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 427.269801][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:14 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:14 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:14 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:14 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:14 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:14 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f0000000140), 0x12) 00:16:14 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:14 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:15 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 428.223784][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 428.309740][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:15 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:16:15 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:15 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:15 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:15 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:15 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:15 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, 0x0, 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000140), 0x12) 00:16:15 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:15 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:15 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:15 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:15 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:16 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:16 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:16:16 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) 00:16:16 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 429.340420][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:16 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:16 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:16 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:16 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:16:16 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 1: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, 0x0, 0x0) 00:16:16 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:16 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:16 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:17 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:17 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 430.389737][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:17 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) 00:16:17 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:17 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:17 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:17 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) 00:16:18 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:18 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000080)=""/108, 0x0}) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:18 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 431.259749][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 431.419824][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:18 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:18 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:18 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:18 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) 00:16:18 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:18 executing program 4: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:18 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:18 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:18 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:18 executing program 4: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:19 executing program 4: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:19 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:19 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:19 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:19 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) 00:16:19 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:19 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:19 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:19 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:19 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:19 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:19 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:19 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:19 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 432.609742][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:19 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:19 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:20 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:20 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:20 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 433.660597][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:20 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:20 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:20 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:20 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:20 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:20 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:20 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 433.979876][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.299796][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:21 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:21 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:21 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:21 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:21 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:21 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:21 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:21 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:21 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:21 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:21 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:21 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) [ 434.703287][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:22 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:22 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:22 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:22 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:22 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:22 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:22 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 1: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)) 00:16:22 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:22 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:22 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:22 executing program 1: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)) 00:16:22 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 435.746237][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:22 executing program 1: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)) 00:16:22 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:22 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:23 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:23 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:23 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:23 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:23 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:23 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:23 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:23 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:23 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 436.790380][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:23 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:24 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:24 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:24 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:24 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) 00:16:24 executing program 0: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:24 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:24 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:24 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:24 executing program 0: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:24 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) [ 437.339775][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:24 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:24 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:24 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:24 executing program 0: ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(r0) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:24 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 437.829673][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:25 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) 00:16:25 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:25 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:25 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:25 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:25 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:25 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) 00:16:25 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:25 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:25 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 438.918455][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:25 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:25 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:25 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:26 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:26 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:26 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) 00:16:26 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:26 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:26 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:26 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:26 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 439.748298][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.754810][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 00:16:26 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:26 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:26 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:26 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) [ 440.006313][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:27 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:27 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 440.379880][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:27 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) 00:16:27 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:27 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:27 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:27 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:28 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:28 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:28 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:28 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:28 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:28 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) [ 441.040791][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:28 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:28 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:28 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:28 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:28 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:28 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) [ 442.059818][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:29 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:29 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:29 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:29 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:29 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:29 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:29 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:29 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:29 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:29 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:29 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:29 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x0, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:30 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:30 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:30 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) [ 443.133196][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.419675][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:30 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:30 executing program 3: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:30 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)) [ 443.579750][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:30 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)) 00:16:30 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:30 executing program 2: r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:30 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:31 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x0, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:31 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) [ 444.158344][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:31 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)) 00:16:31 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:31 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:31 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:31 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:31 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:31 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:31 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 445.221143][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:32 executing program 2: r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:32 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:32 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:32 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:32 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:32 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:32 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:32 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:32 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:32 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:32 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:32 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 446.308519][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.459712][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:33 executing program 2: r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:33 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:33 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:33 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:33 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:33 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:33 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:33 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:33 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:33 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, 0x0) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:33 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:33 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:33 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:33 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:34 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) write$vhost_msg_v2(r0, &(0x7f00000001c0)={0x2, 0x0, {&(0x7f0000000180)=""/42, 0x2a, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:34 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 447.350785][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:34 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:34 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:34 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:34 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:34 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:34 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:34 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 448.421308][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:35 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:35 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, 0x0, 0x0) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:36 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:36 executing program 4: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:36 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 449.503528][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 449.511685][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:36 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:36 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:36 executing program 1: prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) syz_mount_image$msdos(&(0x7f0000000040), &(0x7f00000003c0)='./file1\x00', 0xffffffff, 0x1, &(0x7f0000000080)=[{&(0x7f00000000c0)="0400050900000000666174000404090a0200027400f801", 0x17}], 0x0, &(0x7f00000004c0)=ANY=[]) 00:16:36 executing program 4: socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) syz_mount_image$msdos(&(0x7f0000000040), &(0x7f00000003c0)='./file1\x00', 0xffffffff, 0x1, &(0x7f0000000080)=[{&(0x7f00000000c0)="0400050900000000666174000404090a0200027400f801", 0x17}], 0x0, &(0x7f00000004c0)=ANY=[]) [ 449.638566][T13638] loop1: detected capacity change from 0 to 264192 [ 449.638782][T13637] loop4: detected capacity change from 0 to 264192 00:16:36 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:36 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:36 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:37 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:37 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) [ 450.555187][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:37 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:37 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:38 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:38 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:38 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:38 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:38 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:38 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:38 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:38 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 451.683498][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:38 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:38 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:38 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:39 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:39 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:39 executing program 3: r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:39 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) [ 452.539707][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:39 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 452.708378][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:39 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:39 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:39 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:39 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:39 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:39 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:40 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r1 = dup(0xffffffffffffffff) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r1}) 00:16:40 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:40 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 453.179795][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:40 executing program 3: r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:40 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:40 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 453.748922][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:40 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:16:40 executing program 1: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0}}, 0x48) r2 = dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)={0x0, r2}) 00:16:40 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:40 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:40 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:40 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:41 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:41 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:41 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:41 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, 0x0) 00:16:41 executing program 3: r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:41 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 454.790446][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:42 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:16:42 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:42 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:42 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:42 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:42 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:42 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:42 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) 00:16:42 executing program 0: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000300)=ANY=[]) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) write$vhost_msg_v2(r0, &(0x7f0000000240)={0x2, 0x0, {&(0x7f0000000040)=""/60, 0x3c, 0x0, 0x0, 0x2}}, 0x48) dup(r1) ioctl$VHOST_NET_SET_BACKEND(r0, 0x4008af30, &(0x7f0000000000)) [ 455.581774][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.591367][ T11] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.600141][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.608919][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:42 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:42 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 455.825611][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:43 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:16:43 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:43 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:44 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 457.908632][ T3767] net_ratelimit: 1 callbacks suppressed [ 457.908651][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.700906][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.000697][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.071305][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.871121][ T45] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.897313][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.963816][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.100381][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.139787][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 462.779658][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.180650][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 463.984191][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 464.219673][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 465.271258][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 466.299832][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 467.020188][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:54 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:54 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) chdir(0x0) 00:16:54 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:54 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:54 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 467.340484][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:55 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) chdir(0x0) [ 468.389885][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:56 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:16:56 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:56 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:56 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:16:56 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 469.436156][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:16:56 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 470.059911][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 470.485362][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 471.504338][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.379888][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.539823][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.548415][ T11] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.557606][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 472.579708][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 473.660264][ T22] net_ratelimit: 1 callbacks suppressed [ 473.660282][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 474.703649][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 475.739673][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.141819][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 476.779760][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 477.829631][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.139843][ T992] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.148348][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 478.215888][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:05 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:05 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:05 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) chdir(0x0) 00:17:05 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:05 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:05 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 479.179685][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 479.269675][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 480.313477][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:07 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:07 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:07 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:07 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:07 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:07 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 481.349803][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 481.979791][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.219710][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 482.379618][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 483.419714][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 484.459723][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.259808][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 485.499702][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 486.539796][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:13 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:13 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:13 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:13 executing program 0: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:13 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:13 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:13 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:13 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:13 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:14 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:14 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:14 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 487.579855][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:14 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:14 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:14 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:14 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:14 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:14 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:15 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:15 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:15 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:15 executing program 5: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:15 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 488.299698][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:15 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 488.629927][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:16 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:16 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:16 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:16 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:16 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:16 executing program 5: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:16 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 489.669906][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:16 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:16 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:17 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 490.714412][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:17 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:17 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:18 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:18 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:18 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:18 executing program 5: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:18 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:18 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 491.340004][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:18 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:18 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:18 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 491.579853][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:18 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 491.739720][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:19 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:19 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:19 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:19 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:19 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 492.789777][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:19 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:19 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:19 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:19 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:20 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:20 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:20 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:20 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:20 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 493.819802][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:20 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:20 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:20 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 494.379700][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:21 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:21 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:21 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:21 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:21 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:21 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 494.859627][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:21 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:22 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:22 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) chdir(0x0) 00:17:22 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 495.909715][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:23 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:23 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:17:23 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:23 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:23 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) chdir(0x0) 00:17:23 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 496.941816][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 497.444187][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:24 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:24 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:17:25 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 497.979926][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:25 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:25 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) chdir(0x0) 00:17:25 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:25 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 499.019636][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:26 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:26 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:26 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:17:27 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 500.069712][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:27 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:17:27 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 500.459806][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:27 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:27 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:27 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:27 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:28 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:17:28 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) [ 501.099900][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.181111][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.189533][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.197713][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 00:17:28 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:17:28 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:28 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) 00:17:28 executing program 2: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:17:28 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:29 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, &(0x7f0000004400)="ac208ef6cb967ae9eb58342f2bb856dd53cdc4476d351b5284ba0d63353691f3e4355b0d5622b39c4fd2a56715924665c563ba62181c3a19444dd5d9c81ee42e51f63111b5ee0146193d92015601e3f35bf2e4e36edcbe4b300b07ecebd8018ed65b93ab92e002ecb048e07ce9e0494bc17e74156e0734f9ee9f1a0cb0c0baca5d7ecf9907686ede2ef456fd1894f484d25df706e5cdeaa3ff55b4a8ee5d42525f400837782af4e1d2ae051c3075ddf69172a4e0c0c2872f5425ee578472e97b85c597eb68c827962416abc1398148c8821db9f09f89f8b4233feba15691416d08ccf336fca873ec18114a1dfbd1931f9f77f0e43c3c7634ac41428059153c78c3db957c33e78a28ab28910a365877350f3ed1c659898b99e481894cff7a8310ed67f210eb07160f89bc337264ff04d5240cd74c658c7cc015c3128c54e6ab527781efa8aa7babdc15f92a88b332bbb41102c9b7f1753a3188b7c9e820ff6995402512c855c4057c7f2a82056f0e79e163f323fdc9056212eabc344ad9f29d6c814e20093f90075b8a5b9254d69177867a0f8683a194f9b1d66624344904ecf8750e33331d7ca1264801b1b2ab61ee22c2fe6126c4223c4f41af0b0757ca587170f2a7104cf6f0171f963a2321f49d7eeda3b2e876b4bfb8784531fcd168ed3d63cdadd58467912fd2a5573ad1801f42ffaf846718a8e7486c8be20dedb24ba3d5d5a6d006f28e447d0c77b03549e6ce8617f458f748100209d3eae68c2c933496767ea70196711b18e54c3358cb1bfae8a6b5d83d9b822468b53c7a3454203de24540fdb45d1f6f1e08dac584cc98c0046ae8894ce55dcfe763ee84a0680568d49ff9944d6b5f2589bde7f4a076dcbd62046c7ffe70168a368c8db83c00025d17be0179207ca1b2e58f2349dc205762d03bb139257aa94ba960345b72bac0c97dac203c71a2db12ef69687a362cf847eb59f2a10fdbc8d23150ed9c8badefc57e56aaf406c70fec98222bf5e8a11519f0e407151781f0dfb739a2eae3dcbffbfdbc3cb951e493edadcf434a90c5ecc09a5bd393a26f0b9084874e459714d27f8308e6fc910c8abaf671a81383caa9dd1579b666938d22e2696c64fc231fc46c931e035c211edf3519b5942467d5f5155250671d30fa4b955b0487a3c59a3924c6dcddb281b1879a36b3d3374cc773c0b4d22a7d392b92ccb0618834dac1455c9c99e71b70d60d08f7796d24dc179e15a7a666531dd90443a7120ae76f2487ca24551457871480a04669fff2b740d52669ee0a67069d3db775f81b77308773cfe4c0e35bb4d157be45d4e8e88d2e6ed2cc466312b2acd364cab851897aa0c2396cfd224765145847fcb4565dab048e53b9a15473f968daf9a9cc6c05e7850e976810ee47a51fdd7b3b4a8e787c5b633a0a8340de4d4a966954d1038d4e7cbd62cfce8ef11044955492363afaa78637957de42eab1fce5ccc690279ffdedb3b1acfbd89025d83a54278a48f85f0c09db11046067911e1d7577b4ab1658c541258e20026ec85c1291d3ab23e5924e4dd38d34b43f55b68faf42618c0c0ea976a49955ba33170c77010d82811be7dc18fcb7390f2de6481d917dce25ffa516f4c348b254e67ea8ff51d29f34562b28b1e7070da2d52f20938e85582e33447d87eb86baaebbfc4250c5cbf4fbda044c848783acc49304112a03f213359885192964372c5dbb17d11d15d21b1adf100575e253dd87d20b87c9f8ed48a6c925ead62a511ba1b74f09b1bc089cc1648263fe8dfd2194914c24f6b86db6fa500323d24e0e62bbfb281285c86d2bd4c3aba46c4a9bbc16f9eccd816c7a480d3c5a7974cb5eb27d935722ebaf4ee95f761a1f4f52bffd7d2a1844e635c7c1b8e7362b0bb9a6e4dff575ea4ce8526bf94412b7915adb3b693c95c9052aea589f8d66ef6636040ba48d501e622f166ce2c438a947480c34bc237bf92a9da7c3c2434dd422e23e977ec13fd44b7f2cc7007c7cf46859e85f3427f6235245021b1970afdebafe54c4d8dae047aa46e9b28ba2ffcba98338b962824ea57f2bdbd488498618924e41221e8ba074e1b98b88f58369fefa73de9d818f98b825578702b991c168721827a522f0435381ce5f8d47c24d334d3cc931c2121112d5390b8a44446d0990ecc9fb675fee5190db05bc458322fa10ff0274a3d715e548d263e2347c6db7d7f30a7dd09d5b3241f127cfbde7eca36ea0557409bd39e4c2863c15a9adfe7b08b5d3ced1f78c061ca9ea60a930bcfc6eac51dae2b4da2f50d23562a4de3bee9dbe47b42a7a40df2e5e5e4df83a05da58ce1446f6567a35eb28cf3dfce0a1fc6ae443d4d4e20bb64d4227e0cc215f47af43e69f0f1fef5d59b333d7ed6931ce29f679eabe0c8408b535f03600bbbefda2483309042e917fe6fcb875ce9a4c767042e8e2ec798eb5a67cbe5cf06025af054987504004d3ce166f77a188aa9a6ec24336238400388809f7f6cb58e4ca734f7925da8a5220e6e217267db08c3fc52ec3f777fdbe6471d8a12e07645880e18124899e9e7b61086582ee4b44ca9c5c5e481b602fcbb832fb2aed8eb15471d39a3bd0925fec15252b3f39ce98d3c2c2cdcfcbf72b48b6eb90db130d7a2c01fcf8f5e778601e1c72be8a50e4b0bc648f3a7d0f1dd61ac76fe7be0e1a265082a839297a5ebe0737c24b98966b8a42b37aa5b77091ea5d8965e52a021eb4170fe14f2ad1b0feed26e1ec1513d0c8025c5b015628b68484fa2c45ac2f2d2c0020d318f521d32753c599339f8e9fc3779b2533a653d786544cf39efd59ab4a074393be7c7795165862a9534e3080a04e34488133e0f6218fe91f3d4336881e059f02b8aa927a5b7a238add0c13003c08b37571a44e0eb56a99db2dcbd9a210b057e958577d59fa3c63d39db475b640ea61133fd246a82a3ee052c1e11be3ceaec996d03ce5acffb873dd8a822da72082bce3fbc1e10392a33fa6e37abc8190d617000f97018e194c6b9c24ac556741d735a2d9c2f15ed84e7fbd4db4369667e3a6858e4ce1a2f4fbf010325ba0428694085aab43a75afc093989c37368444376f6221afb2b7a4f14325bfc214fbbbcb282089722f9a3b88ae3339bc675bd1184fecaf763211b6b6ea45b0e7b1ed40b57febe8150b95c4d6832e3e791ed76d9c951e3e357fd5a3e009a281c6e3b468bec03ae7802514c77121eaffb8b2efcb1ff95e39c67c2f00600dd32d2611b13f15fc3c8f922955076df82e8b0dd4223cbfb0665cda4ad423d46da80c7d641984c6d36c82c314a69c378f21a404c1176167699666cb72286bcfdfd06b23982948e691d8bda066069ad28407dd5714d868beb060c6d219c6b65c38a21ce09f87d0dc0ab35d3f70eff4c7dbe443d42a3c9bfc2c8b6c763518fca3956d5303c0f8b61043004cda9ad117ebd2efb3b1fea51a7087792968bd5f737112e64c90d31f1280639b3e1d6f256c3060fd3270f2eb9e7ceaf7b0e8eab59c1d4fd91cdecbb3669861439380671072632ce9c090c9545248df027e7fbbf6763853a7e8c7dfd67c98d43f7ab63e9d7a7b7668f522e7cef6d9bdd42d949c35039ae03fab50f5bf6ff0e4a9739b51e5775002d12ef019e37141232dcbe2b05ccb44c68b6784f6d05ab57204a0c218c33a67a3a797e21718baf8ff0f544a3d660c22622455870dcb1b45abf1aaa5dbd4416961d3a49f8c1a0aa2d7bc6367c80cbd3d0a32d89f881898f4f6077a0ab2051d5ff9eb7fd97bc193d55aa039d5150f92bb0515bf8b308f4b410e5f8991e1b7bceba9c28b65c2fde3a3aab0041b3469cd9e29aa98d58c70ae463ec6364878f789a76c811df858ed2d74f16394af3651b932ea2247f7c7670911d71893dffdd73a841824b55f483232a000b927629b975f32642f0f7a95f2bd93ce8ab6b8f46bb70ad1efde1e4c230debfbf5ef2c6ee38fbea0362a091da2991ef947475c2fd7bdb1ce19fc13abc7d8bfdc941fa6ad089b6195b2b9dfdd5999f02c0c43d77774334e720404865b646defd4b0392097bba3430a256d7a9780d77a33e78f795f05d72d0d61dd0877d8ea15a3e4b726d4db344f3d8efab550cb3006de664f8dbdcf7ab56b963facc2c4d8495b52e2c5dfd6d98b070669e3f200876642dd644e7cb24722dca91980a391f6b4d8752bfbba4c879cbb15e5248f0ae3747c67516a21cf3c52a50602adaef52f5ea605984f0e2e53c1498862bc7f29c938284fa2059e2b1895162df772346264369d448fc9f8f97bcff16c287558ff4275a14d94c233b282312118e10d20af62440df7f2741768dccaf01d7fb23e5fa4708639135f52da13efbbd2a61df5bb1f8416aa2f3112ccf50d8beaf8c7c7125f3902701587b6206cc74b5642833330a279f2ab8bffcdeead86f65bcce45cd8fd412f4e6777be12361aabff4855498d59944e607b2bae629fb86db8b2d3c8e7c9cfbe1680090c4b2c36216b7e1499c10c5334aa49ffe988134141d31a367d1c7a4a4dfb15fa88193e7d339fe881fcacf887759628a1b488d4a9473131264bbfd7a2a5821a06d0fbb5e86f5fb4723f99acba30dfcf1977df0d46847ea68bc547e9256521104b552c8e4dadc861de7d12fe24d86125b81431e61daad5b927027fa4729626d57080b4e524917dd2ea733ba2ec26a568c92c0150abdcb9ee6d7ecef5a10b43406a6ba010484c0d16d8a06bd396d41be849b00b0cfd1203ca6e84ffccf79ca98a2c084c500e32414a40f9f9b360f229d2b01f1552d0f75ad1d875f1c37003a963806a85f87e76d57919076ac3f8361f7ad55b4dd0d650d60965f8e2ab53dc96bdab036c136ed169cc5e9aa0a6a664debd2e12a8adc2e9db4b5b6e32b1395f7881c1741cd686454659769aea0c4efb861cacb52c5d48a2a1197f02d4262b6f041087a68cb6e20b243aa8ff36d47b875da9eee2044bf3766a15043d709f8a21806c8ce9f19578ddc32a68509e90447847e6ef212eb8965316ac54de057941023cb0a16a5b53c2c7c3565db9f8337ce8c1228fbd0750a03977a161f556af1e5478108a986853f6b2de669c62ae2d9ca6a4934f99bf625ad0aeca950169a3fbe677208774c9a0232b0a75fed1e8356a3b2b728226831c427b5ab7a2403c6f54ad87ec0662a24674e9d868f287d736d068f51d7ae9474fe89cf688b778acdb4a324a7eccaf6e3d8ca9f7f3ff211767c2fe0bc7cf77f8799f58c9319370fad9a8167965734f7e6ff8192c5e7f8c10aba4e4eb784eaf21a3cce1122ab64e972c3b9c62fedabfec460948eaf6630d5b69758ceb30bfe94644239abdf7038fc80592920766b53a0e3b6c5ef57eafc64ac3d4346a7f5614fd32d74cf8faa884cae9de408d416f085fabeb363c97a901d78deed82ade652a3f059af4f8eaa11c919bd8ff02c7f28b72efc000edeae1faa111e0fe2392876aa6afd77458692ce34cd392beb6efe87b280c0f22328d47a8008e7c5d0b2f35b85ae74af9e531777d755bcc90109cf3360ba8adbf4d452adde22996fa16501907b34e232ed746e7c17d784213a860891af98f9bf5b2ce28234c42af661b932fd8bc6c508f736577feee0e036b8838d01cc806abe0a30a2b8c235accd2e8298588a24f6753ea04d3704f81ae4e486ce2d3a7a01aa15b2c3220128f625b1738592890c397df5250ee45b9af450c4a96332bfdb4168d671b91a3356e6a714f36795de7d12447a951ece27884234cb62bf473ea83781da56f94929018e5655d3af79b66a84e8c4fbc997d2802fcf3e8b284f1e02110be2ea1e9d8f00c2236a8f0a9f7d666662a16f227519a2c33606aaf7b78001f8d9b9fc1b9cb74914cdaa5a6111633bf6025cf876b4d214191b80dad99910c1daf0e4f42eb70b1f2438db3a059fb86ace12560ae3b818d017d0e0aa1e9815aa900019574a995ee1a1ee6a7f7fa487d53604abf48d092c647282787a208f979df985a0572366034584a2fde0a5f54380a810698454a68fc780853beef8c27cf16383fbcdd8baaa720eaa46bc2562a238f3d102912a4defc5cc1addae4e7c8661c6c8ed2517205ac7bad51d31a0e2ca49d0de0bffa8c8b7dde84e3d7c285f7cde0ea50a529ddfd8d1c690fc404da1617b7658b485bbe2cbeccb5476337fae4e26ff03882b2c9f5e69e8fe723a89ccb3604bccdb63131b2de839e2a9d5e2ab83242c45ba9c5b872156e619edfc1c478abd76b8595474684b452d2da1b14af70c21ff59dbd788842da101abc9772d7d996a611a7f9f15e7c0c89f14654a52bcceb46adce0f41a8dd936dffa1a0920c8f31321e596bc258f66980d8d5d68f7322558c7693d707f1d02043a43456bc5b63e0c3d87d8b7defacbc00e95bcbd2406bfce6c9ce4cc2232d9192721fa4d7f63f75f2451086a49e0822e9349204f5dd50b9bf85efdf5135f020acc2dd4109bca335b6ace0f44a506014b0e73689a436d632507eb0ebea87b0e64ab06d0d5c4b27463434d55479992c7e3c6ab17ca7d882b63159c0b77a7cd0bb2128cc7fbd608aa7794e428970f882a52baada7e57d39a804c9123e947d5662048f4ed6116bb1289578a6ead96a730f638bb17cad434affc23f410f42adad79c99b72f1513b0151810ab455957f5b145d704036e1b64b8faa6654049e3c94e882fc09a37fe9d01325171c3c03793430ac6cd6a511c0b0caebecdbd1b258dcc87b55a7d7ce8a5a7e2b5b2461a43541312b1fcb2e1f04d678090d227c077eda09fff8e9cfb25cdc718dd0b2a7d8743b02e0fa07dc08d5951e976f4db842f398c2341d0db8afe3d5aa41a0a4538afe3fc3849d3497f49033583cd10b1522baa84b95fdfc540e9f86ee1b45616f636538328ee9e6f5c99831a3e7f74f0b2e023414d68e0d674d2d1fc11f34283d35b58782c7dce02b16786c6a614082094fb76a5fd537c7ef48c8377378d2d501e76d35345a52ccbafe60e89f373a830978a93354d60487f1ca4ea4b6661ae3d6cb35698a351e11b670ff7928409492ef8234ddc50d5be28ab0ae79abcb6741b717a95a7d227595df862b6d044f7ad1a8979a9a8b16b64ad2b1594b6e31944630461a9421e5a9076922b5968c6d85270bea3852f232c6e9325b9c9e40d9237cb191ef3fa2a9045e34227f1b80ec5ac1b6c2664d61d2eb04110cc1c8b8307d0609ddc25a30dfb17a76afe2192e61bade14d297f043fdd7d2a06dbade4f95b4b9c2f42d86685a3baab988154f554aa83a2d81963e4159b0e424753d9f90d838ffb9450e9462a81fbe5cb51238bbb97e321d5084c7925ef5a100b6d0bbc7c53f4fc6be45c8b56e48906232a63b6c7b53e183ba526ba9df5133928fa0e54be2749fda931b71272b712c527f527a07cc02165b7e88312bacc1e61d9c8999e0bd24cd29ef1a6f207faaf3c7f7ea467e74eda5e6347e1b5f0c614bb73b4744027cf665ab031a9a0e06c832e8160c491d9d82a398ddf3846dcd68aa58a42407278711dacc7b455cb06272fdcaf8971c48a73d281aee26d7c29eb2b7ce1df28230a7f896d53ff696e9deb98015d1bd8cb4951c5eb852ba9ad596879948f10a503489961c725a13c92b63b905f1a53422e74cc830c131de377661340b6d066486cd260d5002a1cca92f4b619cecfa1a4c370015f142acedd0c88fb5c86e309abc7a5c6dc1cd1b90584c2f838da5a0ea38e8a8c054628156916eb36aac9f01b99446b1ecc354e8e284ea93c646fd3ac154cd43317fbddcd72047b538e8697f9f23894be43f4c11061b08f89cecfc85f8e40b214f3e0ce1597a3468479a3c903f5dcf5149ef8d4379a265b1c92c3a1813d67b4cffffde54467f60129eca0d36bab2bf3881597ece377dc98bdf1f1b481d4c57bc19f16cf1591a5a0c550dae796242d7bff8f43fb448a40a3834823de98af6d1bb79a12e6fda71bda0198c416f2d2bce58eb4ca4c2f6ec807e9de0bbfe8786bdb9a09206babd160be24cfb518e43750c0ac979d2a07170e08acf682ddc11e56327f7c41268ef3e8c1a4f7299bec2c28cb4062fdf15071ea07a0a2c684049c92e253a7294551be456240223eb507f29dead5283489007ceebaa5e1434b4511edeeefc0a44fb2733eeab77eacc3ada522d0642eac4cc6149d8577385ad7bb84aecf78e019fd0d89869fea99da3dd41c0a93a7105ec42ba1ed88cf8b9cce2cbabd92342cda9efaf1381b6e56bbbeafd6fc8efdcda92f9d57d9ae13ee1496fa0c28eb14edcd7f6ff532a8b61fcaba4e20e097c7943e077508989f4f02cf598cfe0c7b555df28bdcf97a07b83ebcd753d8d73c81124b44909d88885e301924db83ab940fc741a984764a9e918e694e005af0dcf946d0d5c076d888ed017e3f89a8c2c3922d467f988440f93329d86206e529d6bbedcf4190fd90d35aa6544574b77679902be7289afeca53813432d62908e42b441bcccb82e37481f29f3d92f73567696ee13c516c77e302fa5cb2a993b1e34ec4efebc1194467f403864e4d687015242f78597a29d39c99e1fd1b6383822a74ac95b1d203924c7fd7c5f3e9e162a69798ee39742d428c2433997cb8677025db5e697b69c7499b7480dd2a67d3fcaa2fa6f8aa76a2a1d22c3c99860d8833a0e72f09afdde12085bc7686e82a488ed3f48ba863549f194e1d19f3cbd34e68f4201a4e312a25025496997be03d15bb8da73c7ff890ab869fb175fe0484d0067634aaa6b32521600e088f8343ea22c5d6b27c0f16e66665179dd8c8e81564b723c153d6288a09d828c341560870127300e071cdd4cce8abd7926b1ebd4617309c042d5a7717966205b4318cf31b4f94e47f356586779ce3a19950a7b821ca48f613010b0c43687b8090f87d3974c7eae363ca051679b401060ceb2d213a79903b56862c6aa9ec14da3d3ca88120ff15657d1cd5db029048f48ca2167afbdc7e4d7cc0cc773af11cfc320676e4c1c9555f149c03b92ddd053352f32ca1d70df6cc0f5d5344718a4027496596704191360319c74807bc6668bf705550c3bc4753217b05e96c8ef68ca21ea9b6c1f78d0cfa284df5ec2c1c5e1ec3ec553a9014124a8a74e5ae95e78535b2a08994fe91f9f18b227726231b5308c5275a3d910b035c9d46bb178beeff05679fa82174137033781e4561058484e0e002fd2e5c49eab081f3bc11646a713335c3854398cac3c5accb6f03fc8de10197439bdaf4754071ddc5063a47ee756b8f9acee742ca8d0c8840478ba5c8a974b3b9d1e0405af0c19f509947a77745d560b2407296f2ef09cc816e5504a7b7675b716e7faa29e341aa99e8a05de505cae62cdfa9723143e7bb5efc1ee4b2d41ef68eb81f7872ada3230487c4d27244fa37d842790948231afc87b7ce6e4427da094681faf4c4bcaaafae791a0b4fb3e897354939a41eedebba693e5e9ad182b1d5b7256e2868b3e75892c85eb375b7d29fa117bc0e8cbf41f0821f5b5137b9b2714c26961d3231e02095d1540843a10f7f4b0f85861fdff7e745a90fb6a43c1d1e5a6b7b70dd07904dc650708708d91a7a5ce23b4417d691ec00ec4cbdeb0923a934c70a149e40f76f537f95245d9ce9901b8685fdb94cf2eeeddceca0ac0512435882e34bf9ed4e5f5f69d2957ef06db60ac242f2b45ad1326c246630524fd7407e708689c78ff33726f985ec67ad6b99e86589ce3f0e62770f20603d40879e1a8ee40173ba2756e9c66b40865f32641774c82de76256106e291b0179d47851e564fa7cf3998479a029f261ba821f6416b2c8a2f90a2a39c684897bab53433f8aadb04415236b69ab87e1784fb7cdb5b74c9ce6387ec7c8835b4bf53bb8a909c6cc42eeca0459ce9f43c790e6925e031708bc682753354ba8699d8ebb70031165d00fccccd9415afdd1b2380543475ac6d41c63097cd730de43b37c8ce5279c07cf96735056616106d1af81334220bcc332c9c69b0d90cc1ae67aa2b078656211eb5917910015ea38a90467daa0b26db2ec79f7f7bb2c666da4c16e56195ed06fb4381e8cdc64dcc5ee7e88d0a186859ac5c208504d8c3bbfa72af513cd6845ae34c359ff0eb1eb287d49674fb2ac1738e97526cb01c7b0963051100830d4e51ee8540887d824f5610870c278bea9d80325d7906fe2a350fb0f7ef70872ea7bd6853173cbdd4cd4d3af25e761b01e2a6b6a562275590b27c8a8a5c52a24d5c4446f6c1559e521ebcd0a201e6780b2e0e108464b37ed1e5556561136d50d6c684a9803b12ce4fee4fa2183a8dd6e589a46af09b4eabac4fcc33b2f4d0988f41c12ec4344cbbc6330c2a6a166f143b8c63d1e8ba4ff0f9852e4252d01b9edf49208eac8e6f8cdedb161eb3b82e65288e5ae2171df3770f8fd2fe2b9ba0c17bdd1c71e67ead4ff4c7a2dbd1448763034d82c52f07d36626e51ddb13b3b73d9c52fb962d0d6a79144fc8e3e3d4f52b0b7f96035bac0124b00a0d90469ea1455c5f06fbbcdc020b94f260fff03e68ff99d8aefe12b47bce2aa5662856ea115c796ea5773ac6157fed6db77f4956a5eb6de83633b0e00b3d940c3e3f3106228e94e38b8506bcadd9daff4ed33e82c255d89ed380d9c5478b0f69014e80b99f2e0d19845dc8539e5bb66bf7e48b8ccb8f472821a123afdbb561ec569839d2ffb21aee348f7f31fd756247083a5b47f04d63eab69afd27cc29385e78c0e9cdd1f9a4c7f927f0d55a858de3896abb6139317f10b9bc552f0392e18961afe7af6f3e963eeb5bded3db979cbf5cfe21abffe537184a6e4817066ac2f2abde03aa12e9dcd3ca7c3c540d397c475238d336f7e9495886182286be4375d5ee208e1eec7b812c9e5ba4c4bc02835394add6c448ac6c278dce9b3c57c4c1fbdcbd06e5a00eec90d3f28ffb72421be7045e10e3e439c4c31b01a7cfdaee4399583a1eaa938c7fb8cb827950e0f64c569402c5a5f15d40087222d7636cba44d46253f44f15cfa42a8d68d16242c9ca6589885ab84589cb8d5be1c6cf41c880c61cffd3fc13ea27048074c8606da072af1748e6bffdf1a4b194d9f196979e37dec18296bdfa3da9b831bd5c42c62e47e52f2ac2c045dd27b2e87d9cb4443c7ae358fa7e18b21ff803ba49e767fd4381312b79ea757644c84aa9dbf72d8f77e758f31ff302348f2708470e9284c2dcadcf2d15f472be4e7640a5b3367c5506ce9a89a508eec5d72269d732a682138d2e9bf4a1e8bc7404f9dc0ea569a84bcb926651b0398795b48978a9644d387c4c8c74d7be019e58a34c7f65f2fa6351a92729c22801d821708cb069380f0238ef3e1c8d4c0f03c59f0c05cc272e7a75a10059e6eaa176eb5dbc46f43f0ee97ef1bcb5d462826d4eaf985328901d4d306d7f209de0626c04cee8610486b7ec4f2f364835664689e771c26d483164c39e01bca0ee485f193e92e52036ab869f70728d76b200155903c2dc7d490b8293cdc5875933bfe461fe42f6ac00a0d12b000aa872d7e47749a8093819a4edf9b31d6f2fd7c9655cda379122fcca191df492f1ceef934e57e34fa879ed9344365ebe0b2b268006d3c66c63066f78a6889101e2ea47f53516421044e7ec162c51aa24f506803", 0x2000, 0x0) [ 502.152000][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:29 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:29 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, &(0x7f0000004400)="ac208ef6cb967ae9eb58342f2bb856dd53cdc4476d351b5284ba0d63353691f3e4355b0d5622b39c4fd2a56715924665c563ba62181c3a19444dd5d9c81ee42e51f63111b5ee0146193d92015601e3f35bf2e4e36edcbe4b300b07ecebd8018ed65b93ab92e002ecb048e07ce9e0494bc17e74156e0734f9ee9f1a0cb0c0baca5d7ecf9907686ede2ef456fd1894f484d25df706e5cdeaa3ff55b4a8ee5d42525f400837782af4e1d2ae051c3075ddf69172a4e0c0c2872f5425ee578472e97b85c597eb68c827962416abc1398148c8821db9f09f89f8b4233feba15691416d08ccf336fca873ec18114a1dfbd1931f9f77f0e43c3c7634ac41428059153c78c3db957c33e78a28ab28910a365877350f3ed1c659898b99e481894cff7a8310ed67f210eb07160f89bc337264ff04d5240cd74c658c7cc015c3128c54e6ab527781efa8aa7babdc15f92a88b332bbb41102c9b7f1753a3188b7c9e820ff6995402512c855c4057c7f2a82056f0e79e163f323fdc9056212eabc344ad9f29d6c814e20093f90075b8a5b9254d69177867a0f8683a194f9b1d66624344904ecf8750e33331d7ca1264801b1b2ab61ee22c2fe6126c4223c4f41af0b0757ca587170f2a7104cf6f0171f963a2321f49d7eeda3b2e876b4bfb8784531fcd168ed3d63cdadd58467912fd2a5573ad1801f42ffaf846718a8e7486c8be20dedb24ba3d5d5a6d006f28e447d0c77b03549e6ce8617f458f748100209d3eae68c2c933496767ea70196711b18e54c3358cb1bfae8a6b5d83d9b822468b53c7a3454203de24540fdb45d1f6f1e08dac584cc98c0046ae8894ce55dcfe763ee84a0680568d49ff9944d6b5f2589bde7f4a076dcbd62046c7ffe70168a368c8db83c00025d17be0179207ca1b2e58f2349dc205762d03bb139257aa94ba960345b72bac0c97dac203c71a2db12ef69687a362cf847eb59f2a10fdbc8d23150ed9c8badefc57e56aaf406c70fec98222bf5e8a11519f0e407151781f0dfb739a2eae3dcbffbfdbc3cb951e493edadcf434a90c5ecc09a5bd393a26f0b9084874e459714d27f8308e6fc910c8abaf671a81383caa9dd1579b666938d22e2696c64fc231fc46c931e035c211edf3519b5942467d5f5155250671d30fa4b955b0487a3c59a3924c6dcddb281b1879a36b3d3374cc773c0b4d22a7d392b92ccb0618834dac1455c9c99e71b70d60d08f7796d24dc179e15a7a666531dd90443a7120ae76f2487ca24551457871480a04669fff2b740d52669ee0a67069d3db775f81b77308773cfe4c0e35bb4d157be45d4e8e88d2e6ed2cc466312b2acd364cab851897aa0c2396cfd224765145847fcb4565dab048e53b9a15473f968daf9a9cc6c05e7850e976810ee47a51fdd7b3b4a8e787c5b633a0a8340de4d4a966954d1038d4e7cbd62cfce8ef11044955492363afaa78637957de42eab1fce5ccc690279ffdedb3b1acfbd89025d83a54278a48f85f0c09db11046067911e1d7577b4ab1658c541258e20026ec85c1291d3ab23e5924e4dd38d34b43f55b68faf42618c0c0ea976a49955ba33170c77010d82811be7dc18fcb7390f2de6481d917dce25ffa516f4c348b254e67ea8ff51d29f34562b28b1e7070da2d52f20938e85582e33447d87eb86baaebbfc4250c5cbf4fbda044c848783acc49304112a03f213359885192964372c5dbb17d11d15d21b1adf100575e253dd87d20b87c9f8ed48a6c925ead62a511ba1b74f09b1bc089cc1648263fe8dfd2194914c24f6b86db6fa500323d24e0e62bbfb281285c86d2bd4c3aba46c4a9bbc16f9eccd816c7a480d3c5a7974cb5eb27d935722ebaf4ee95f761a1f4f52bffd7d2a1844e635c7c1b8e7362b0bb9a6e4dff575ea4ce8526bf94412b7915adb3b693c95c9052aea589f8d66ef6636040ba48d501e622f166ce2c438a947480c34bc237bf92a9da7c3c2434dd422e23e977ec13fd44b7f2cc7007c7cf46859e85f3427f6235245021b1970afdebafe54c4d8dae047aa46e9b28ba2ffcba98338b962824ea57f2bdbd488498618924e41221e8ba074e1b98b88f58369fefa73de9d818f98b825578702b991c168721827a522f0435381ce5f8d47c24d334d3cc931c2121112d5390b8a44446d0990ecc9fb675fee5190db05bc458322fa10ff0274a3d715e548d263e2347c6db7d7f30a7dd09d5b3241f127cfbde7eca36ea0557409bd39e4c2863c15a9adfe7b08b5d3ced1f78c061ca9ea60a930bcfc6eac51dae2b4da2f50d23562a4de3bee9dbe47b42a7a40df2e5e5e4df83a05da58ce1446f6567a35eb28cf3dfce0a1fc6ae443d4d4e20bb64d4227e0cc215f47af43e69f0f1fef5d59b333d7ed6931ce29f679eabe0c8408b535f03600bbbefda2483309042e917fe6fcb875ce9a4c767042e8e2ec798eb5a67cbe5cf06025af054987504004d3ce166f77a188aa9a6ec24336238400388809f7f6cb58e4ca734f7925da8a5220e6e217267db08c3fc52ec3f777fdbe6471d8a12e07645880e18124899e9e7b61086582ee4b44ca9c5c5e481b602fcbb832fb2aed8eb15471d39a3bd0925fec15252b3f39ce98d3c2c2cdcfcbf72b48b6eb90db130d7a2c01fcf8f5e778601e1c72be8a50e4b0bc648f3a7d0f1dd61ac76fe7be0e1a265082a839297a5ebe0737c24b98966b8a42b37aa5b77091ea5d8965e52a021eb4170fe14f2ad1b0feed26e1ec1513d0c8025c5b015628b68484fa2c45ac2f2d2c0020d318f521d32753c599339f8e9fc3779b2533a653d786544cf39efd59ab4a074393be7c7795165862a9534e3080a04e34488133e0f6218fe91f3d4336881e059f02b8aa927a5b7a238add0c13003c08b37571a44e0eb56a99db2dcbd9a210b057e958577d59fa3c63d39db475b640ea61133fd246a82a3ee052c1e11be3ceaec996d03ce5acffb873dd8a822da72082bce3fbc1e10392a33fa6e37abc8190d617000f97018e194c6b9c24ac556741d735a2d9c2f15ed84e7fbd4db4369667e3a6858e4ce1a2f4fbf010325ba0428694085aab43a75afc093989c37368444376f6221afb2b7a4f14325bfc214fbbbcb282089722f9a3b88ae3339bc675bd1184fecaf763211b6b6ea45b0e7b1ed40b57febe8150b95c4d6832e3e791ed76d9c951e3e357fd5a3e009a281c6e3b468bec03ae7802514c77121eaffb8b2efcb1ff95e39c67c2f00600dd32d2611b13f15fc3c8f922955076df82e8b0dd4223cbfb0665cda4ad423d46da80c7d641984c6d36c82c314a69c378f21a404c1176167699666cb72286bcfdfd06b23982948e691d8bda066069ad28407dd5714d868beb060c6d219c6b65c38a21ce09f87d0dc0ab35d3f70eff4c7dbe443d42a3c9bfc2c8b6c763518fca3956d5303c0f8b61043004cda9ad117ebd2efb3b1fea51a7087792968bd5f737112e64c90d31f1280639b3e1d6f256c3060fd3270f2eb9e7ceaf7b0e8eab59c1d4fd91cdecbb3669861439380671072632ce9c090c9545248df027e7fbbf6763853a7e8c7dfd67c98d43f7ab63e9d7a7b7668f522e7cef6d9bdd42d949c35039ae03fab50f5bf6ff0e4a9739b51e5775002d12ef019e37141232dcbe2b05ccb44c68b6784f6d05ab57204a0c218c33a67a3a797e21718baf8ff0f544a3d660c22622455870dcb1b45abf1aaa5dbd4416961d3a49f8c1a0aa2d7bc6367c80cbd3d0a32d89f881898f4f6077a0ab2051d5ff9eb7fd97bc193d55aa039d5150f92bb0515bf8b308f4b410e5f8991e1b7bceba9c28b65c2fde3a3aab0041b3469cd9e29aa98d58c70ae463ec6364878f789a76c811df858ed2d74f16394af3651b932ea2247f7c7670911d71893dffdd73a841824b55f483232a000b927629b975f32642f0f7a95f2bd93ce8ab6b8f46bb70ad1efde1e4c230debfbf5ef2c6ee38fbea0362a091da2991ef947475c2fd7bdb1ce19fc13abc7d8bfdc941fa6ad089b6195b2b9dfdd5999f02c0c43d77774334e720404865b646defd4b0392097bba3430a256d7a9780d77a33e78f795f05d72d0d61dd0877d8ea15a3e4b726d4db344f3d8efab550cb3006de664f8dbdcf7ab56b963facc2c4d8495b52e2c5dfd6d98b070669e3f200876642dd644e7cb24722dca91980a391f6b4d8752bfbba4c879cbb15e5248f0ae3747c67516a21cf3c52a50602adaef52f5ea605984f0e2e53c1498862bc7f29c938284fa2059e2b1895162df772346264369d448fc9f8f97bcff16c287558ff4275a14d94c233b282312118e10d20af62440df7f2741768dccaf01d7fb23e5fa4708639135f52da13efbbd2a61df5bb1f8416aa2f3112ccf50d8beaf8c7c7125f3902701587b6206cc74b5642833330a279f2ab8bffcdeead86f65bcce45cd8fd412f4e6777be12361aabff4855498d59944e607b2bae629fb86db8b2d3c8e7c9cfbe1680090c4b2c36216b7e1499c10c5334aa49ffe988134141d31a367d1c7a4a4dfb15fa88193e7d339fe881fcacf887759628a1b488d4a9473131264bbfd7a2a5821a06d0fbb5e86f5fb4723f99acba30dfcf1977df0d46847ea68bc547e9256521104b552c8e4dadc861de7d12fe24d86125b81431e61daad5b927027fa4729626d57080b4e524917dd2ea733ba2ec26a568c92c0150abdcb9ee6d7ecef5a10b43406a6ba010484c0d16d8a06bd396d41be849b00b0cfd1203ca6e84ffccf79ca98a2c084c500e32414a40f9f9b360f229d2b01f1552d0f75ad1d875f1c37003a963806a85f87e76d57919076ac3f8361f7ad55b4dd0d650d60965f8e2ab53dc96bdab036c136ed169cc5e9aa0a6a664debd2e12a8adc2e9db4b5b6e32b1395f7881c1741cd686454659769aea0c4efb861cacb52c5d48a2a1197f02d4262b6f041087a68cb6e20b243aa8ff36d47b875da9eee2044bf3766a15043d709f8a21806c8ce9f19578ddc32a68509e90447847e6ef212eb8965316ac54de057941023cb0a16a5b53c2c7c3565db9f8337ce8c1228fbd0750a03977a161f556af1e5478108a986853f6b2de669c62ae2d9ca6a4934f99bf625ad0aeca950169a3fbe677208774c9a0232b0a75fed1e8356a3b2b728226831c427b5ab7a2403c6f54ad87ec0662a24674e9d868f287d736d068f51d7ae9474fe89cf688b778acdb4a324a7eccaf6e3d8ca9f7f3ff211767c2fe0bc7cf77f8799f58c9319370fad9a8167965734f7e6ff8192c5e7f8c10aba4e4eb784eaf21a3cce1122ab64e972c3b9c62fedabfec460948eaf6630d5b69758ceb30bfe94644239abdf7038fc80592920766b53a0e3b6c5ef57eafc64ac3d4346a7f5614fd32d74cf8faa884cae9de408d416f085fabeb363c97a901d78deed82ade652a3f059af4f8eaa11c919bd8ff02c7f28b72efc000edeae1faa111e0fe2392876aa6afd77458692ce34cd392beb6efe87b280c0f22328d47a8008e7c5d0b2f35b85ae74af9e531777d755bcc90109cf3360ba8adbf4d452adde22996fa16501907b34e232ed746e7c17d784213a860891af98f9bf5b2ce28234c42af661b932fd8bc6c508f736577feee0e036b8838d01cc806abe0a30a2b8c235accd2e8298588a24f6753ea04d3704f81ae4e486ce2d3a7a01aa15b2c3220128f625b1738592890c397df5250ee45b9af450c4a96332bfdb4168d671b91a3356e6a714f36795de7d12447a951ece27884234cb62bf473ea83781da56f94929018e5655d3af79b66a84e8c4fbc997d2802fcf3e8b284f1e02110be2ea1e9d8f00c2236a8f0a9f7d666662a16f227519a2c33606aaf7b78001f8d9b9fc1b9cb74914cdaa5a6111633bf6025cf876b4d214191b80dad99910c1daf0e4f42eb70b1f2438db3a059fb86ace12560ae3b818d017d0e0aa1e9815aa900019574a995ee1a1ee6a7f7fa487d53604abf48d092c647282787a208f979df985a0572366034584a2fde0a5f54380a810698454a68fc780853beef8c27cf16383fbcdd8baaa720eaa46bc2562a238f3d102912a4defc5cc1addae4e7c8661c6c8ed2517205ac7bad51d31a0e2ca49d0de0bffa8c8b7dde84e3d7c285f7cde0ea50a529ddfd8d1c690fc404da1617b7658b485bbe2cbeccb5476337fae4e26ff03882b2c9f5e69e8fe723a89ccb3604bccdb63131b2de839e2a9d5e2ab83242c45ba9c5b872156e619edfc1c478abd76b8595474684b452d2da1b14af70c21ff59dbd788842da101abc9772d7d996a611a7f9f15e7c0c89f14654a52bcceb46adce0f41a8dd936dffa1a0920c8f31321e596bc258f66980d8d5d68f7322558c7693d707f1d02043a43456bc5b63e0c3d87d8b7defacbc00e95bcbd2406bfce6c9ce4cc2232d9192721fa4d7f63f75f2451086a49e0822e9349204f5dd50b9bf85efdf5135f020acc2dd4109bca335b6ace0f44a506014b0e73689a436d632507eb0ebea87b0e64ab06d0d5c4b27463434d55479992c7e3c6ab17ca7d882b63159c0b77a7cd0bb2128cc7fbd608aa7794e428970f882a52baada7e57d39a804c9123e947d5662048f4ed6116bb1289578a6ead96a730f638bb17cad434affc23f410f42adad79c99b72f1513b0151810ab455957f5b145d704036e1b64b8faa6654049e3c94e882fc09a37fe9d01325171c3c03793430ac6cd6a511c0b0caebecdbd1b258dcc87b55a7d7ce8a5a7e2b5b2461a43541312b1fcb2e1f04d678090d227c077eda09fff8e9cfb25cdc718dd0b2a7d8743b02e0fa07dc08d5951e976f4db842f398c2341d0db8afe3d5aa41a0a4538afe3fc3849d3497f49033583cd10b1522baa84b95fdfc540e9f86ee1b45616f636538328ee9e6f5c99831a3e7f74f0b2e023414d68e0d674d2d1fc11f34283d35b58782c7dce02b16786c6a614082094fb76a5fd537c7ef48c8377378d2d501e76d35345a52ccbafe60e89f373a830978a93354d60487f1ca4ea4b6661ae3d6cb35698a351e11b670ff7928409492ef8234ddc50d5be28ab0ae79abcb6741b717a95a7d227595df862b6d044f7ad1a8979a9a8b16b64ad2b1594b6e31944630461a9421e5a9076922b5968c6d85270bea3852f232c6e9325b9c9e40d9237cb191ef3fa2a9045e34227f1b80ec5ac1b6c2664d61d2eb04110cc1c8b8307d0609ddc25a30dfb17a76afe2192e61bade14d297f043fdd7d2a06dbade4f95b4b9c2f42d86685a3baab988154f554aa83a2d81963e4159b0e424753d9f90d838ffb9450e9462a81fbe5cb51238bbb97e321d5084c7925ef5a100b6d0bbc7c53f4fc6be45c8b56e48906232a63b6c7b53e183ba526ba9df5133928fa0e54be2749fda931b71272b712c527f527a07cc02165b7e88312bacc1e61d9c8999e0bd24cd29ef1a6f207faaf3c7f7ea467e74eda5e6347e1b5f0c614bb73b4744027cf665ab031a9a0e06c832e8160c491d9d82a398ddf3846dcd68aa58a42407278711dacc7b455cb06272fdcaf8971c48a73d281aee26d7c29eb2b7ce1df28230a7f896d53ff696e9deb98015d1bd8cb4951c5eb852ba9ad596879948f10a503489961c725a13c92b63b905f1a53422e74cc830c131de377661340b6d066486cd260d5002a1cca92f4b619cecfa1a4c370015f142acedd0c88fb5c86e309abc7a5c6dc1cd1b90584c2f838da5a0ea38e8a8c054628156916eb36aac9f01b99446b1ecc354e8e284ea93c646fd3ac154cd43317fbddcd72047b538e8697f9f23894be43f4c11061b08f89cecfc85f8e40b214f3e0ce1597a3468479a3c903f5dcf5149ef8d4379a265b1c92c3a1813d67b4cffffde54467f60129eca0d36bab2bf3881597ece377dc98bdf1f1b481d4c57bc19f16cf1591a5a0c550dae796242d7bff8f43fb448a40a3834823de98af6d1bb79a12e6fda71bda0198c416f2d2bce58eb4ca4c2f6ec807e9de0bbfe8786bdb9a09206babd160be24cfb518e43750c0ac979d2a07170e08acf682ddc11e56327f7c41268ef3e8c1a4f7299bec2c28cb4062fdf15071ea07a0a2c684049c92e253a7294551be456240223eb507f29dead5283489007ceebaa5e1434b4511edeeefc0a44fb2733eeab77eacc3ada522d0642eac4cc6149d8577385ad7bb84aecf78e019fd0d89869fea99da3dd41c0a93a7105ec42ba1ed88cf8b9cce2cbabd92342cda9efaf1381b6e56bbbeafd6fc8efdcda92f9d57d9ae13ee1496fa0c28eb14edcd7f6ff532a8b61fcaba4e20e097c7943e077508989f4f02cf598cfe0c7b555df28bdcf97a07b83ebcd753d8d73c81124b44909d88885e301924db83ab940fc741a984764a9e918e694e005af0dcf946d0d5c076d888ed017e3f89a8c2c3922d467f988440f93329d86206e529d6bbedcf4190fd90d35aa6544574b77679902be7289afeca53813432d62908e42b441bcccb82e37481f29f3d92f73567696ee13c516c77e302fa5cb2a993b1e34ec4efebc1194467f403864e4d687015242f78597a29d39c99e1fd1b6383822a74ac95b1d203924c7fd7c5f3e9e162a69798ee39742d428c2433997cb8677025db5e697b69c7499b7480dd2a67d3fcaa2fa6f8aa76a2a1d22c3c99860d8833a0e72f09afdde12085bc7686e82a488ed3f48ba863549f194e1d19f3cbd34e68f4201a4e312a25025496997be03d15bb8da73c7ff890ab869fb175fe0484d0067634aaa6b32521600e088f8343ea22c5d6b27c0f16e66665179dd8c8e81564b723c153d6288a09d828c341560870127300e071cdd4cce8abd7926b1ebd4617309c042d5a7717966205b4318cf31b4f94e47f356586779ce3a19950a7b821ca48f613010b0c43687b8090f87d3974c7eae363ca051679b401060ceb2d213a79903b56862c6aa9ec14da3d3ca88120ff15657d1cd5db029048f48ca2167afbdc7e4d7cc0cc773af11cfc320676e4c1c9555f149c03b92ddd053352f32ca1d70df6cc0f5d5344718a4027496596704191360319c74807bc6668bf705550c3bc4753217b05e96c8ef68ca21ea9b6c1f78d0cfa284df5ec2c1c5e1ec3ec553a9014124a8a74e5ae95e78535b2a08994fe91f9f18b227726231b5308c5275a3d910b035c9d46bb178beeff05679fa82174137033781e4561058484e0e002fd2e5c49eab081f3bc11646a713335c3854398cac3c5accb6f03fc8de10197439bdaf4754071ddc5063a47ee756b8f9acee742ca8d0c8840478ba5c8a974b3b9d1e0405af0c19f509947a77745d560b2407296f2ef09cc816e5504a7b7675b716e7faa29e341aa99e8a05de505cae62cdfa9723143e7bb5efc1ee4b2d41ef68eb81f7872ada3230487c4d27244fa37d842790948231afc87b7ce6e4427da094681faf4c4bcaaafae791a0b4fb3e897354939a41eedebba693e5e9ad182b1d5b7256e2868b3e75892c85eb375b7d29fa117bc0e8cbf41f0821f5b5137b9b2714c26961d3231e02095d1540843a10f7f4b0f85861fdff7e745a90fb6a43c1d1e5a6b7b70dd07904dc650708708d91a7a5ce23b4417d691ec00ec4cbdeb0923a934c70a149e40f76f537f95245d9ce9901b8685fdb94cf2eeeddceca0ac0512435882e34bf9ed4e5f5f69d2957ef06db60ac242f2b45ad1326c246630524fd7407e708689c78ff33726f985ec67ad6b99e86589ce3f0e62770f20603d40879e1a8ee40173ba2756e9c66b40865f32641774c82de76256106e291b0179d47851e564fa7cf3998479a029f261ba821f6416b2c8a2f90a2a39c684897bab53433f8aadb04415236b69ab87e1784fb7cdb5b74c9ce6387ec7c8835b4bf53bb8a909c6cc42eeca0459ce9f43c790e6925e031708bc682753354ba8699d8ebb70031165d00fccccd9415afdd1b2380543475ac6d41c63097cd730de43b37c8ce5279c07cf96735056616106d1af81334220bcc332c9c69b0d90cc1ae67aa2b078656211eb5917910015ea38a90467daa0b26db2ec79f7f7bb2c666da4c16e56195ed06fb4381e8cdc64dcc5ee7e88d0a186859ac5c208504d8c3bbfa72af513cd6845ae34c359ff0eb1eb287d49674fb2ac1738e97526cb01c7b0963051100830d4e51ee8540887d824f5610870c278bea9d80325d7906fe2a350fb0f7ef70872ea7bd6853173cbdd4cd4d3af25e761b01e2a6b6a562275590b27c8a8a5c52a24d5c4446f6c1559e521ebcd0a201e6780b2e0e108464b37ed1e5556561136d50d6c684a9803b12ce4fee4fa2183a8dd6e589a46af09b4eabac4fcc33b2f4d0988f41c12ec4344cbbc6330c2a6a166f143b8c63d1e8ba4ff0f9852e4252d01b9edf49208eac8e6f8cdedb161eb3b82e65288e5ae2171df3770f8fd2fe2b9ba0c17bdd1c71e67ead4ff4c7a2dbd1448763034d82c52f07d36626e51ddb13b3b73d9c52fb962d0d6a79144fc8e3e3d4f52b0b7f96035bac0124b00a0d90469ea1455c5f06fbbcdc020b94f260fff03e68ff99d8aefe12b47bce2aa5662856ea115c796ea5773ac6157fed6db77f4956a5eb6de83633b0e00b3d940c3e3f3106228e94e38b8506bcadd9daff4ed33e82c255d89ed380d9c5478b0f69014e80b99f2e0d19845dc8539e5bb66bf7e48b8ccb8f472821a123afdbb561ec569839d2ffb21aee348f7f31fd756247083a5b47f04d63eab69afd27cc29385e78c0e9cdd1f9a4c7f927f0d55a858de3896abb6139317f10b9bc552f0392e18961afe7af6f3e963eeb5bded3db979cbf5cfe21abffe537184a6e4817066ac2f2abde03aa12e9dcd3ca7c3c540d397c475238d336f7e9495886182286be4375d5ee208e1eec7b812c9e5ba4c4bc02835394add6c448ac6c278dce9b3c57c4c1fbdcbd06e5a00eec90d3f28ffb72421be7045e10e3e439c4c31b01a7cfdaee4399583a1eaa938c7fb8cb827950e0f64c569402c5a5f15d40087222d7636cba44d46253f44f15cfa42a8d68d16242c9ca6589885ab84589cb8d5be1c6cf41c880c61cffd3fc13ea27048074c8606da072af1748e6bffdf1a4b194d9f196979e37dec18296bdfa3da9b831bd5c42c62e47e52f2ac2c045dd27b2e87d9cb4443c7ae358fa7e18b21ff803ba49e767fd4381312b79ea757644c84aa9dbf72d8f77e758f31ff302348f2708470e9284c2dcadcf2d15f472be4e7640a5b3367c5506ce9a89a508eec5d72269d732a682138d2e9bf4a1e8bc7404f9dc0ea569a84bcb926651b0398795b48978a9644d387c4c8c74d7be019e58a34c7f65f2fa6351a92729c22801d821708cb069380f0238ef3e1c8d4c0f03c59f0c05cc272e7a75a10059e6eaa176eb5dbc46f43f0ee97ef1bcb5d462826d4eaf985328901d4d306d7f209de0626c04cee8610486b7ec4f2f364835664689e771c26d483164c39e01bca0ee485f193e92e52036ab869f70728d76b200155903c2dc7d490b8293cdc5875933bfe461fe42f6ac00a0d12b000aa872d7e47749a8093819a4edf9b31d6f2fd7c9655cda379122fcca191df492f1ceef934e57e34fa879ed9344365ebe0b2b268006d3c66c63066f78a6889101e2ea47f53516421044e7ec162c51aa24f506803", 0x2000, 0x0) 00:17:29 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:29 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:30 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000008fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:17:30 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:30 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$peeksig(0x4209, 0x0, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) creat(&(0x7f0000000280)='./bus\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) [ 503.182070][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:30 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000008fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:17:30 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 503.500481][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:30 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, &(0x7f0000004400)="ac208ef6cb967ae9eb58342f2bb856dd53cdc4476d351b5284ba0d63353691f3e4355b0d5622b39c4fd2a56715924665c563ba62181c3a19444dd5d9c81ee42e51f63111b5ee0146193d92015601e3f35bf2e4e36edcbe4b300b07ecebd8018ed65b93ab92e002ecb048e07ce9e0494bc17e74156e0734f9ee9f1a0cb0c0baca5d7ecf9907686ede2ef456fd1894f484d25df706e5cdeaa3ff55b4a8ee5d42525f400837782af4e1d2ae051c3075ddf69172a4e0c0c2872f5425ee578472e97b85c597eb68c827962416abc1398148c8821db9f09f89f8b4233feba15691416d08ccf336fca873ec18114a1dfbd1931f9f77f0e43c3c7634ac41428059153c78c3db957c33e78a28ab28910a365877350f3ed1c659898b99e481894cff7a8310ed67f210eb07160f89bc337264ff04d5240cd74c658c7cc015c3128c54e6ab527781efa8aa7babdc15f92a88b332bbb41102c9b7f1753a3188b7c9e820ff6995402512c855c4057c7f2a82056f0e79e163f323fdc9056212eabc344ad9f29d6c814e20093f90075b8a5b9254d69177867a0f8683a194f9b1d66624344904ecf8750e33331d7ca1264801b1b2ab61ee22c2fe6126c4223c4f41af0b0757ca587170f2a7104cf6f0171f963a2321f49d7eeda3b2e876b4bfb8784531fcd168ed3d63cdadd58467912fd2a5573ad1801f42ffaf846718a8e7486c8be20dedb24ba3d5d5a6d006f28e447d0c77b03549e6ce8617f458f748100209d3eae68c2c933496767ea70196711b18e54c3358cb1bfae8a6b5d83d9b822468b53c7a3454203de24540fdb45d1f6f1e08dac584cc98c0046ae8894ce55dcfe763ee84a0680568d49ff9944d6b5f2589bde7f4a076dcbd62046c7ffe70168a368c8db83c00025d17be0179207ca1b2e58f2349dc205762d03bb139257aa94ba960345b72bac0c97dac203c71a2db12ef69687a362cf847eb59f2a10fdbc8d23150ed9c8badefc57e56aaf406c70fec98222bf5e8a11519f0e407151781f0dfb739a2eae3dcbffbfdbc3cb951e493edadcf434a90c5ecc09a5bd393a26f0b9084874e459714d27f8308e6fc910c8abaf671a81383caa9dd1579b666938d22e2696c64fc231fc46c931e035c211edf3519b5942467d5f5155250671d30fa4b955b0487a3c59a3924c6dcddb281b1879a36b3d3374cc773c0b4d22a7d392b92ccb0618834dac1455c9c99e71b70d60d08f7796d24dc179e15a7a666531dd90443a7120ae76f2487ca24551457871480a04669fff2b740d52669ee0a67069d3db775f81b77308773cfe4c0e35bb4d157be45d4e8e88d2e6ed2cc466312b2acd364cab851897aa0c2396cfd224765145847fcb4565dab048e53b9a15473f968daf9a9cc6c05e7850e976810ee47a51fdd7b3b4a8e787c5b633a0a8340de4d4a966954d1038d4e7cbd62cfce8ef11044955492363afaa78637957de42eab1fce5ccc690279ffdedb3b1acfbd89025d83a54278a48f85f0c09db11046067911e1d7577b4ab1658c541258e20026ec85c1291d3ab23e5924e4dd38d34b43f55b68faf42618c0c0ea976a49955ba33170c77010d82811be7dc18fcb7390f2de6481d917dce25ffa516f4c348b254e67ea8ff51d29f34562b28b1e7070da2d52f20938e85582e33447d87eb86baaebbfc4250c5cbf4fbda044c848783acc49304112a03f213359885192964372c5dbb17d11d15d21b1adf100575e253dd87d20b87c9f8ed48a6c925ead62a511ba1b74f09b1bc089cc1648263fe8dfd2194914c24f6b86db6fa500323d24e0e62bbfb281285c86d2bd4c3aba46c4a9bbc16f9eccd816c7a480d3c5a7974cb5eb27d935722ebaf4ee95f761a1f4f52bffd7d2a1844e635c7c1b8e7362b0bb9a6e4dff575ea4ce8526bf94412b7915adb3b693c95c9052aea589f8d66ef6636040ba48d501e622f166ce2c438a947480c34bc237bf92a9da7c3c2434dd422e23e977ec13fd44b7f2cc7007c7cf46859e85f3427f6235245021b1970afdebafe54c4d8dae047aa46e9b28ba2ffcba98338b962824ea57f2bdbd488498618924e41221e8ba074e1b98b88f58369fefa73de9d818f98b825578702b991c168721827a522f0435381ce5f8d47c24d334d3cc931c2121112d5390b8a44446d0990ecc9fb675fee5190db05bc458322fa10ff0274a3d715e548d263e2347c6db7d7f30a7dd09d5b3241f127cfbde7eca36ea0557409bd39e4c2863c15a9adfe7b08b5d3ced1f78c061ca9ea60a930bcfc6eac51dae2b4da2f50d23562a4de3bee9dbe47b42a7a40df2e5e5e4df83a05da58ce1446f6567a35eb28cf3dfce0a1fc6ae443d4d4e20bb64d4227e0cc215f47af43e69f0f1fef5d59b333d7ed6931ce29f679eabe0c8408b535f03600bbbefda2483309042e917fe6fcb875ce9a4c767042e8e2ec798eb5a67cbe5cf06025af054987504004d3ce166f77a188aa9a6ec24336238400388809f7f6cb58e4ca734f7925da8a5220e6e217267db08c3fc52ec3f777fdbe6471d8a12e07645880e18124899e9e7b61086582ee4b44ca9c5c5e481b602fcbb832fb2aed8eb15471d39a3bd0925fec15252b3f39ce98d3c2c2cdcfcbf72b48b6eb90db130d7a2c01fcf8f5e778601e1c72be8a50e4b0bc648f3a7d0f1dd61ac76fe7be0e1a265082a839297a5ebe0737c24b98966b8a42b37aa5b77091ea5d8965e52a021eb4170fe14f2ad1b0feed26e1ec1513d0c8025c5b015628b68484fa2c45ac2f2d2c0020d318f521d32753c599339f8e9fc3779b2533a653d786544cf39efd59ab4a074393be7c7795165862a9534e3080a04e34488133e0f6218fe91f3d4336881e059f02b8aa927a5b7a238add0c13003c08b37571a44e0eb56a99db2dcbd9a210b057e958577d59fa3c63d39db475b640ea61133fd246a82a3ee052c1e11be3ceaec996d03ce5acffb873dd8a822da72082bce3fbc1e10392a33fa6e37abc8190d617000f97018e194c6b9c24ac556741d735a2d9c2f15ed84e7fbd4db4369667e3a6858e4ce1a2f4fbf010325ba0428694085aab43a75afc093989c37368444376f6221afb2b7a4f14325bfc214fbbbcb282089722f9a3b88ae3339bc675bd1184fecaf763211b6b6ea45b0e7b1ed40b57febe8150b95c4d6832e3e791ed76d9c951e3e357fd5a3e009a281c6e3b468bec03ae7802514c77121eaffb8b2efcb1ff95e39c67c2f00600dd32d2611b13f15fc3c8f922955076df82e8b0dd4223cbfb0665cda4ad423d46da80c7d641984c6d36c82c314a69c378f21a404c1176167699666cb72286bcfdfd06b23982948e691d8bda066069ad28407dd5714d868beb060c6d219c6b65c38a21ce09f87d0dc0ab35d3f70eff4c7dbe443d42a3c9bfc2c8b6c763518fca3956d5303c0f8b61043004cda9ad117ebd2efb3b1fea51a7087792968bd5f737112e64c90d31f1280639b3e1d6f256c3060fd3270f2eb9e7ceaf7b0e8eab59c1d4fd91cdecbb3669861439380671072632ce9c090c9545248df027e7fbbf6763853a7e8c7dfd67c98d43f7ab63e9d7a7b7668f522e7cef6d9bdd42d949c35039ae03fab50f5bf6ff0e4a9739b51e5775002d12ef019e37141232dcbe2b05ccb44c68b6784f6d05ab57204a0c218c33a67a3a797e21718baf8ff0f544a3d660c22622455870dcb1b45abf1aaa5dbd4416961d3a49f8c1a0aa2d7bc6367c80cbd3d0a32d89f881898f4f6077a0ab2051d5ff9eb7fd97bc193d55aa039d5150f92bb0515bf8b308f4b410e5f8991e1b7bceba9c28b65c2fde3a3aab0041b3469cd9e29aa98d58c70ae463ec6364878f789a76c811df858ed2d74f16394af3651b932ea2247f7c7670911d71893dffdd73a841824b55f483232a000b927629b975f32642f0f7a95f2bd93ce8ab6b8f46bb70ad1efde1e4c230debfbf5ef2c6ee38fbea0362a091da2991ef947475c2fd7bdb1ce19fc13abc7d8bfdc941fa6ad089b6195b2b9dfdd5999f02c0c43d77774334e720404865b646defd4b0392097bba3430a256d7a9780d77a33e78f795f05d72d0d61dd0877d8ea15a3e4b726d4db344f3d8efab550cb3006de664f8dbdcf7ab56b963facc2c4d8495b52e2c5dfd6d98b070669e3f200876642dd644e7cb24722dca91980a391f6b4d8752bfbba4c879cbb15e5248f0ae3747c67516a21cf3c52a50602adaef52f5ea605984f0e2e53c1498862bc7f29c938284fa2059e2b1895162df772346264369d448fc9f8f97bcff16c287558ff4275a14d94c233b282312118e10d20af62440df7f2741768dccaf01d7fb23e5fa4708639135f52da13efbbd2a61df5bb1f8416aa2f3112ccf50d8beaf8c7c7125f3902701587b6206cc74b5642833330a279f2ab8bffcdeead86f65bcce45cd8fd412f4e6777be12361aabff4855498d59944e607b2bae629fb86db8b2d3c8e7c9cfbe1680090c4b2c36216b7e1499c10c5334aa49ffe988134141d31a367d1c7a4a4dfb15fa88193e7d339fe881fcacf887759628a1b488d4a9473131264bbfd7a2a5821a06d0fbb5e86f5fb4723f99acba30dfcf1977df0d46847ea68bc547e9256521104b552c8e4dadc861de7d12fe24d86125b81431e61daad5b927027fa4729626d57080b4e524917dd2ea733ba2ec26a568c92c0150abdcb9ee6d7ecef5a10b43406a6ba010484c0d16d8a06bd396d41be849b00b0cfd1203ca6e84ffccf79ca98a2c084c500e32414a40f9f9b360f229d2b01f1552d0f75ad1d875f1c37003a963806a85f87e76d57919076ac3f8361f7ad55b4dd0d650d60965f8e2ab53dc96bdab036c136ed169cc5e9aa0a6a664debd2e12a8adc2e9db4b5b6e32b1395f7881c1741cd686454659769aea0c4efb861cacb52c5d48a2a1197f02d4262b6f041087a68cb6e20b243aa8ff36d47b875da9eee2044bf3766a15043d709f8a21806c8ce9f19578ddc32a68509e90447847e6ef212eb8965316ac54de057941023cb0a16a5b53c2c7c3565db9f8337ce8c1228fbd0750a03977a161f556af1e5478108a986853f6b2de669c62ae2d9ca6a4934f99bf625ad0aeca950169a3fbe677208774c9a0232b0a75fed1e8356a3b2b728226831c427b5ab7a2403c6f54ad87ec0662a24674e9d868f287d736d068f51d7ae9474fe89cf688b778acdb4a324a7eccaf6e3d8ca9f7f3ff211767c2fe0bc7cf77f8799f58c9319370fad9a8167965734f7e6ff8192c5e7f8c10aba4e4eb784eaf21a3cce1122ab64e972c3b9c62fedabfec460948eaf6630d5b69758ceb30bfe94644239abdf7038fc80592920766b53a0e3b6c5ef57eafc64ac3d4346a7f5614fd32d74cf8faa884cae9de408d416f085fabeb363c97a901d78deed82ade652a3f059af4f8eaa11c919bd8ff02c7f28b72efc000edeae1faa111e0fe2392876aa6afd77458692ce34cd392beb6efe87b280c0f22328d47a8008e7c5d0b2f35b85ae74af9e531777d755bcc90109cf3360ba8adbf4d452adde22996fa16501907b34e232ed746e7c17d784213a860891af98f9bf5b2ce28234c42af661b932fd8bc6c508f736577feee0e036b8838d01cc806abe0a30a2b8c235accd2e8298588a24f6753ea04d3704f81ae4e486ce2d3a7a01aa15b2c3220128f625b1738592890c397df5250ee45b9af450c4a96332bfdb4168d671b91a3356e6a714f36795de7d12447a951ece27884234cb62bf473ea83781da56f94929018e5655d3af79b66a84e8c4fbc997d2802fcf3e8b284f1e02110be2ea1e9d8f00c2236a8f0a9f7d666662a16f227519a2c33606aaf7b78001f8d9b9fc1b9cb74914cdaa5a6111633bf6025cf876b4d214191b80dad99910c1daf0e4f42eb70b1f2438db3a059fb86ace12560ae3b818d017d0e0aa1e9815aa900019574a995ee1a1ee6a7f7fa487d53604abf48d092c647282787a208f979df985a0572366034584a2fde0a5f54380a810698454a68fc780853beef8c27cf16383fbcdd8baaa720eaa46bc2562a238f3d102912a4defc5cc1addae4e7c8661c6c8ed2517205ac7bad51d31a0e2ca49d0de0bffa8c8b7dde84e3d7c285f7cde0ea50a529ddfd8d1c690fc404da1617b7658b485bbe2cbeccb5476337fae4e26ff03882b2c9f5e69e8fe723a89ccb3604bccdb63131b2de839e2a9d5e2ab83242c45ba9c5b872156e619edfc1c478abd76b8595474684b452d2da1b14af70c21ff59dbd788842da101abc9772d7d996a611a7f9f15e7c0c89f14654a52bcceb46adce0f41a8dd936dffa1a0920c8f31321e596bc258f66980d8d5d68f7322558c7693d707f1d02043a43456bc5b63e0c3d87d8b7defacbc00e95bcbd2406bfce6c9ce4cc2232d9192721fa4d7f63f75f2451086a49e0822e9349204f5dd50b9bf85efdf5135f020acc2dd4109bca335b6ace0f44a506014b0e73689a436d632507eb0ebea87b0e64ab06d0d5c4b27463434d55479992c7e3c6ab17ca7d882b63159c0b77a7cd0bb2128cc7fbd608aa7794e428970f882a52baada7e57d39a804c9123e947d5662048f4ed6116bb1289578a6ead96a730f638bb17cad434affc23f410f42adad79c99b72f1513b0151810ab455957f5b145d704036e1b64b8faa6654049e3c94e882fc09a37fe9d01325171c3c03793430ac6cd6a511c0b0caebecdbd1b258dcc87b55a7d7ce8a5a7e2b5b2461a43541312b1fcb2e1f04d678090d227c077eda09fff8e9cfb25cdc718dd0b2a7d8743b02e0fa07dc08d5951e976f4db842f398c2341d0db8afe3d5aa41a0a4538afe3fc3849d3497f49033583cd10b1522baa84b95fdfc540e9f86ee1b45616f636538328ee9e6f5c99831a3e7f74f0b2e023414d68e0d674d2d1fc11f34283d35b58782c7dce02b16786c6a614082094fb76a5fd537c7ef48c8377378d2d501e76d35345a52ccbafe60e89f373a830978a93354d60487f1ca4ea4b6661ae3d6cb35698a351e11b670ff7928409492ef8234ddc50d5be28ab0ae79abcb6741b717a95a7d227595df862b6d044f7ad1a8979a9a8b16b64ad2b1594b6e31944630461a9421e5a9076922b5968c6d85270bea3852f232c6e9325b9c9e40d9237cb191ef3fa2a9045e34227f1b80ec5ac1b6c2664d61d2eb04110cc1c8b8307d0609ddc25a30dfb17a76afe2192e61bade14d297f043fdd7d2a06dbade4f95b4b9c2f42d86685a3baab988154f554aa83a2d81963e4159b0e424753d9f90d838ffb9450e9462a81fbe5cb51238bbb97e321d5084c7925ef5a100b6d0bbc7c53f4fc6be45c8b56e48906232a63b6c7b53e183ba526ba9df5133928fa0e54be2749fda931b71272b712c527f527a07cc02165b7e88312bacc1e61d9c8999e0bd24cd29ef1a6f207faaf3c7f7ea467e74eda5e6347e1b5f0c614bb73b4744027cf665ab031a9a0e06c832e8160c491d9d82a398ddf3846dcd68aa58a42407278711dacc7b455cb06272fdcaf8971c48a73d281aee26d7c29eb2b7ce1df28230a7f896d53ff696e9deb98015d1bd8cb4951c5eb852ba9ad596879948f10a503489961c725a13c92b63b905f1a53422e74cc830c131de377661340b6d066486cd260d5002a1cca92f4b619cecfa1a4c370015f142acedd0c88fb5c86e309abc7a5c6dc1cd1b90584c2f838da5a0ea38e8a8c054628156916eb36aac9f01b99446b1ecc354e8e284ea93c646fd3ac154cd43317fbddcd72047b538e8697f9f23894be43f4c11061b08f89cecfc85f8e40b214f3e0ce1597a3468479a3c903f5dcf5149ef8d4379a265b1c92c3a1813d67b4cffffde54467f60129eca0d36bab2bf3881597ece377dc98bdf1f1b481d4c57bc19f16cf1591a5a0c550dae796242d7bff8f43fb448a40a3834823de98af6d1bb79a12e6fda71bda0198c416f2d2bce58eb4ca4c2f6ec807e9de0bbfe8786bdb9a09206babd160be24cfb518e43750c0ac979d2a07170e08acf682ddc11e56327f7c41268ef3e8c1a4f7299bec2c28cb4062fdf15071ea07a0a2c684049c92e253a7294551be456240223eb507f29dead5283489007ceebaa5e1434b4511edeeefc0a44fb2733eeab77eacc3ada522d0642eac4cc6149d8577385ad7bb84aecf78e019fd0d89869fea99da3dd41c0a93a7105ec42ba1ed88cf8b9cce2cbabd92342cda9efaf1381b6e56bbbeafd6fc8efdcda92f9d57d9ae13ee1496fa0c28eb14edcd7f6ff532a8b61fcaba4e20e097c7943e077508989f4f02cf598cfe0c7b555df28bdcf97a07b83ebcd753d8d73c81124b44909d88885e301924db83ab940fc741a984764a9e918e694e005af0dcf946d0d5c076d888ed017e3f89a8c2c3922d467f988440f93329d86206e529d6bbedcf4190fd90d35aa6544574b77679902be7289afeca53813432d62908e42b441bcccb82e37481f29f3d92f73567696ee13c516c77e302fa5cb2a993b1e34ec4efebc1194467f403864e4d687015242f78597a29d39c99e1fd1b6383822a74ac95b1d203924c7fd7c5f3e9e162a69798ee39742d428c2433997cb8677025db5e697b69c7499b7480dd2a67d3fcaa2fa6f8aa76a2a1d22c3c99860d8833a0e72f09afdde12085bc7686e82a488ed3f48ba863549f194e1d19f3cbd34e68f4201a4e312a25025496997be03d15bb8da73c7ff890ab869fb175fe0484d0067634aaa6b32521600e088f8343ea22c5d6b27c0f16e66665179dd8c8e81564b723c153d6288a09d828c341560870127300e071cdd4cce8abd7926b1ebd4617309c042d5a7717966205b4318cf31b4f94e47f356586779ce3a19950a7b821ca48f613010b0c43687b8090f87d3974c7eae363ca051679b401060ceb2d213a79903b56862c6aa9ec14da3d3ca88120ff15657d1cd5db029048f48ca2167afbdc7e4d7cc0cc773af11cfc320676e4c1c9555f149c03b92ddd053352f32ca1d70df6cc0f5d5344718a4027496596704191360319c74807bc6668bf705550c3bc4753217b05e96c8ef68ca21ea9b6c1f78d0cfa284df5ec2c1c5e1ec3ec553a9014124a8a74e5ae95e78535b2a08994fe91f9f18b227726231b5308c5275a3d910b035c9d46bb178beeff05679fa82174137033781e4561058484e0e002fd2e5c49eab081f3bc11646a713335c3854398cac3c5accb6f03fc8de10197439bdaf4754071ddc5063a47ee756b8f9acee742ca8d0c8840478ba5c8a974b3b9d1e0405af0c19f509947a77745d560b2407296f2ef09cc816e5504a7b7675b716e7faa29e341aa99e8a05de505cae62cdfa9723143e7bb5efc1ee4b2d41ef68eb81f7872ada3230487c4d27244fa37d842790948231afc87b7ce6e4427da094681faf4c4bcaaafae791a0b4fb3e897354939a41eedebba693e5e9ad182b1d5b7256e2868b3e75892c85eb375b7d29fa117bc0e8cbf41f0821f5b5137b9b2714c26961d3231e02095d1540843a10f7f4b0f85861fdff7e745a90fb6a43c1d1e5a6b7b70dd07904dc650708708d91a7a5ce23b4417d691ec00ec4cbdeb0923a934c70a149e40f76f537f95245d9ce9901b8685fdb94cf2eeeddceca0ac0512435882e34bf9ed4e5f5f69d2957ef06db60ac242f2b45ad1326c246630524fd7407e708689c78ff33726f985ec67ad6b99e86589ce3f0e62770f20603d40879e1a8ee40173ba2756e9c66b40865f32641774c82de76256106e291b0179d47851e564fa7cf3998479a029f261ba821f6416b2c8a2f90a2a39c684897bab53433f8aadb04415236b69ab87e1784fb7cdb5b74c9ce6387ec7c8835b4bf53bb8a909c6cc42eeca0459ce9f43c790e6925e031708bc682753354ba8699d8ebb70031165d00fccccd9415afdd1b2380543475ac6d41c63097cd730de43b37c8ce5279c07cf96735056616106d1af81334220bcc332c9c69b0d90cc1ae67aa2b078656211eb5917910015ea38a90467daa0b26db2ec79f7f7bb2c666da4c16e56195ed06fb4381e8cdc64dcc5ee7e88d0a186859ac5c208504d8c3bbfa72af513cd6845ae34c359ff0eb1eb287d49674fb2ac1738e97526cb01c7b0963051100830d4e51ee8540887d824f5610870c278bea9d80325d7906fe2a350fb0f7ef70872ea7bd6853173cbdd4cd4d3af25e761b01e2a6b6a562275590b27c8a8a5c52a24d5c4446f6c1559e521ebcd0a201e6780b2e0e108464b37ed1e5556561136d50d6c684a9803b12ce4fee4fa2183a8dd6e589a46af09b4eabac4fcc33b2f4d0988f41c12ec4344cbbc6330c2a6a166f143b8c63d1e8ba4ff0f9852e4252d01b9edf49208eac8e6f8cdedb161eb3b82e65288e5ae2171df3770f8fd2fe2b9ba0c17bdd1c71e67ead4ff4c7a2dbd1448763034d82c52f07d36626e51ddb13b3b73d9c52fb962d0d6a79144fc8e3e3d4f52b0b7f96035bac0124b00a0d90469ea1455c5f06fbbcdc020b94f260fff03e68ff99d8aefe12b47bce2aa5662856ea115c796ea5773ac6157fed6db77f4956a5eb6de83633b0e00b3d940c3e3f3106228e94e38b8506bcadd9daff4ed33e82c255d89ed380d9c5478b0f69014e80b99f2e0d19845dc8539e5bb66bf7e48b8ccb8f472821a123afdbb561ec569839d2ffb21aee348f7f31fd756247083a5b47f04d63eab69afd27cc29385e78c0e9cdd1f9a4c7f927f0d55a858de3896abb6139317f10b9bc552f0392e18961afe7af6f3e963eeb5bded3db979cbf5cfe21abffe537184a6e4817066ac2f2abde03aa12e9dcd3ca7c3c540d397c475238d336f7e9495886182286be4375d5ee208e1eec7b812c9e5ba4c4bc02835394add6c448ac6c278dce9b3c57c4c1fbdcbd06e5a00eec90d3f28ffb72421be7045e10e3e439c4c31b01a7cfdaee4399583a1eaa938c7fb8cb827950e0f64c569402c5a5f15d40087222d7636cba44d46253f44f15cfa42a8d68d16242c9ca6589885ab84589cb8d5be1c6cf41c880c61cffd3fc13ea27048074c8606da072af1748e6bffdf1a4b194d9f196979e37dec18296bdfa3da9b831bd5c42c62e47e52f2ac2c045dd27b2e87d9cb4443c7ae358fa7e18b21ff803ba49e767fd4381312b79ea757644c84aa9dbf72d8f77e758f31ff302348f2708470e9284c2dcadcf2d15f472be4e7640a5b3367c5506ce9a89a508eec5d72269d732a682138d2e9bf4a1e8bc7404f9dc0ea569a84bcb926651b0398795b48978a9644d387c4c8c74d7be019e58a34c7f65f2fa6351a92729c22801d821708cb069380f0238ef3e1c8d4c0f03c59f0c05cc272e7a75a10059e6eaa176eb5dbc46f43f0ee97ef1bcb5d462826d4eaf985328901d4d306d7f209de0626c04cee8610486b7ec4f2f364835664689e771c26d483164c39e01bca0ee485f193e92e52036ab869f70728d76b200155903c2dc7d490b8293cdc5875933bfe461fe42f6ac00a0d12b000aa872d7e47749a8093819a4edf9b31d6f2fd7c9655cda379122fcca191df492f1ceef934e57e34fa879ed9344365ebe0b2b268006d3c66c63066f78a6889101e2ea47f53516421044e7ec162c51aa24f506803", 0x2000, &(0x7f0000008fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:17:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000002c0)=[{0x0}], 0x1) 00:17:31 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000008fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 504.221648][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:31 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:31 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:31 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:31 executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, 0x1c) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r3, 0x84, 0x6c, &(0x7f0000000080)={r2}, 0x0) 00:17:31 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:31 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:31 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, 0x0, 0x0, &(0x7f0000008fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:17:31 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 505.269784][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:32 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:32 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/207, 0xcf}], 0x1) 00:17:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:33 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:33 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:33 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:33 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 506.300152][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:33 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:33 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:33 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 506.539726][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:33 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:17:33 executing program 1: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) syz_fuse_handle_req(r2, &(0x7f0000004400)="ac208ef6cb967ae9eb58342f2bb856dd53cdc4476d351b5284ba0d63353691f3e4355b0d5622b39c4fd2a56715924665c563ba62181c3a19444dd5d9c81ee42e51f63111b5ee0146193d92015601e3f35bf2e4e36edcbe4b300b07ecebd8018ed65b93ab92e002ecb048e07ce9e0494bc17e74156e0734f9ee9f1a0cb0c0baca5d7ecf9907686ede2ef456fd1894f484d25df706e5cdeaa3ff55b4a8ee5d42525f400837782af4e1d2ae051c3075ddf69172a4e0c0c2872f5425ee578472e97b85c597eb68c827962416abc1398148c8821db9f09f89f8b4233feba15691416d08ccf336fca873ec18114a1dfbd1931f9f77f0e43c3c7634ac41428059153c78c3db957c33e78a28ab28910a365877350f3ed1c659898b99e481894cff7a8310ed67f210eb07160f89bc337264ff04d5240cd74c658c7cc015c3128c54e6ab527781efa8aa7babdc15f92a88b332bbb41102c9b7f1753a3188b7c9e820ff6995402512c855c4057c7f2a82056f0e79e163f323fdc9056212eabc344ad9f29d6c814e20093f90075b8a5b9254d69177867a0f8683a194f9b1d66624344904ecf8750e33331d7ca1264801b1b2ab61ee22c2fe6126c4223c4f41af0b0757ca587170f2a7104cf6f0171f963a2321f49d7eeda3b2e876b4bfb8784531fcd168ed3d63cdadd58467912fd2a5573ad1801f42ffaf846718a8e7486c8be20dedb24ba3d5d5a6d006f28e447d0c77b03549e6ce8617f458f748100209d3eae68c2c933496767ea70196711b18e54c3358cb1bfae8a6b5d83d9b822468b53c7a3454203de24540fdb45d1f6f1e08dac584cc98c0046ae8894ce55dcfe763ee84a0680568d49ff9944d6b5f2589bde7f4a076dcbd62046c7ffe70168a368c8db83c00025d17be0179207ca1b2e58f2349dc205762d03bb139257aa94ba960345b72bac0c97dac203c71a2db12ef69687a362cf847eb59f2a10fdbc8d23150ed9c8badefc57e56aaf406c70fec98222bf5e8a11519f0e407151781f0dfb739a2eae3dcbffbfdbc3cb951e493edadcf434a90c5ecc09a5bd393a26f0b9084874e459714d27f8308e6fc910c8abaf671a81383caa9dd1579b666938d22e2696c64fc231fc46c931e035c211edf3519b5942467d5f5155250671d30fa4b955b0487a3c59a3924c6dcddb281b1879a36b3d3374cc773c0b4d22a7d392b92ccb0618834dac1455c9c99e71b70d60d08f7796d24dc179e15a7a666531dd90443a7120ae76f2487ca24551457871480a04669fff2b740d52669ee0a67069d3db775f81b77308773cfe4c0e35bb4d157be45d4e8e88d2e6ed2cc466312b2acd364cab851897aa0c2396cfd224765145847fcb4565dab048e53b9a15473f968daf9a9cc6c05e7850e976810ee47a51fdd7b3b4a8e787c5b633a0a8340de4d4a966954d1038d4e7cbd62cfce8ef11044955492363afaa78637957de42eab1fce5ccc690279ffdedb3b1acfbd89025d83a54278a48f85f0c09db11046067911e1d7577b4ab1658c541258e20026ec85c1291d3ab23e5924e4dd38d34b43f55b68faf42618c0c0ea976a49955ba33170c77010d82811be7dc18fcb7390f2de6481d917dce25ffa516f4c348b254e67ea8ff51d29f34562b28b1e7070da2d52f20938e85582e33447d87eb86baaebbfc4250c5cbf4fbda044c848783acc49304112a03f213359885192964372c5dbb17d11d15d21b1adf100575e253dd87d20b87c9f8ed48a6c925ead62a511ba1b74f09b1bc089cc1648263fe8dfd2194914c24f6b86db6fa500323d24e0e62bbfb281285c86d2bd4c3aba46c4a9bbc16f9eccd816c7a480d3c5a7974cb5eb27d935722ebaf4ee95f761a1f4f52bffd7d2a1844e635c7c1b8e7362b0bb9a6e4dff575ea4ce8526bf94412b7915adb3b693c95c9052aea589f8d66ef6636040ba48d501e622f166ce2c438a947480c34bc237bf92a9da7c3c2434dd422e23e977ec13fd44b7f2cc7007c7cf46859e85f3427f6235245021b1970afdebafe54c4d8dae047aa46e9b28ba2ffcba98338b962824ea57f2bdbd488498618924e41221e8ba074e1b98b88f58369fefa73de9d818f98b825578702b991c168721827a522f0435381ce5f8d47c24d334d3cc931c2121112d5390b8a44446d0990ecc9fb675fee5190db05bc458322fa10ff0274a3d715e548d263e2347c6db7d7f30a7dd09d5b3241f127cfbde7eca36ea0557409bd39e4c2863c15a9adfe7b08b5d3ced1f78c061ca9ea60a930bcfc6eac51dae2b4da2f50d23562a4de3bee9dbe47b42a7a40df2e5e5e4df83a05da58ce1446f6567a35eb28cf3dfce0a1fc6ae443d4d4e20bb64d4227e0cc215f47af43e69f0f1fef5d59b333d7ed6931ce29f679eabe0c8408b535f03600bbbefda2483309042e917fe6fcb875ce9a4c767042e8e2ec798eb5a67cbe5cf06025af054987504004d3ce166f77a188aa9a6ec24336238400388809f7f6cb58e4ca734f7925da8a5220e6e217267db08c3fc52ec3f777fdbe6471d8a12e07645880e18124899e9e7b61086582ee4b44ca9c5c5e481b602fcbb832fb2aed8eb15471d39a3bd0925fec15252b3f39ce98d3c2c2cdcfcbf72b48b6eb90db130d7a2c01fcf8f5e778601e1c72be8a50e4b0bc648f3a7d0f1dd61ac76fe7be0e1a265082a839297a5ebe0737c24b98966b8a42b37aa5b77091ea5d8965e52a021eb4170fe14f2ad1b0feed26e1ec1513d0c8025c5b015628b68484fa2c45ac2f2d2c0020d318f521d32753c599339f8e9fc3779b2533a653d786544cf39efd59ab4a074393be7c7795165862a9534e3080a04e34488133e0f6218fe91f3d4336881e059f02b8aa927a5b7a238add0c13003c08b37571a44e0eb56a99db2dcbd9a210b057e958577d59fa3c63d39db475b640ea61133fd246a82a3ee052c1e11be3ceaec996d03ce5acffb873dd8a822da72082bce3fbc1e10392a33fa6e37abc8190d617000f97018e194c6b9c24ac556741d735a2d9c2f15ed84e7fbd4db4369667e3a6858e4ce1a2f4fbf010325ba0428694085aab43a75afc093989c37368444376f6221afb2b7a4f14325bfc214fbbbcb282089722f9a3b88ae3339bc675bd1184fecaf763211b6b6ea45b0e7b1ed40b57febe8150b95c4d6832e3e791ed76d9c951e3e357fd5a3e009a281c6e3b468bec03ae7802514c77121eaffb8b2efcb1ff95e39c67c2f00600dd32d2611b13f15fc3c8f922955076df82e8b0dd4223cbfb0665cda4ad423d46da80c7d641984c6d36c82c314a69c378f21a404c1176167699666cb72286bcfdfd06b23982948e691d8bda066069ad28407dd5714d868beb060c6d219c6b65c38a21ce09f87d0dc0ab35d3f70eff4c7dbe443d42a3c9bfc2c8b6c763518fca3956d5303c0f8b61043004cda9ad117ebd2efb3b1fea51a7087792968bd5f737112e64c90d31f1280639b3e1d6f256c3060fd3270f2eb9e7ceaf7b0e8eab59c1d4fd91cdecbb3669861439380671072632ce9c090c9545248df027e7fbbf6763853a7e8c7dfd67c98d43f7ab63e9d7a7b7668f522e7cef6d9bdd42d949c35039ae03fab50f5bf6ff0e4a9739b51e5775002d12ef019e37141232dcbe2b05ccb44c68b6784f6d05ab57204a0c218c33a67a3a797e21718baf8ff0f544a3d660c22622455870dcb1b45abf1aaa5dbd4416961d3a49f8c1a0aa2d7bc6367c80cbd3d0a32d89f881898f4f6077a0ab2051d5ff9eb7fd97bc193d55aa039d5150f92bb0515bf8b308f4b410e5f8991e1b7bceba9c28b65c2fde3a3aab0041b3469cd9e29aa98d58c70ae463ec6364878f789a76c811df858ed2d74f16394af3651b932ea2247f7c7670911d71893dffdd73a841824b55f483232a000b927629b975f32642f0f7a95f2bd93ce8ab6b8f46bb70ad1efde1e4c230debfbf5ef2c6ee38fbea0362a091da2991ef947475c2fd7bdb1ce19fc13abc7d8bfdc941fa6ad089b6195b2b9dfdd5999f02c0c43d77774334e720404865b646defd4b0392097bba3430a256d7a9780d77a33e78f795f05d72d0d61dd0877d8ea15a3e4b726d4db344f3d8efab550cb3006de664f8dbdcf7ab56b963facc2c4d8495b52e2c5dfd6d98b070669e3f200876642dd644e7cb24722dca91980a391f6b4d8752bfbba4c879cbb15e5248f0ae3747c67516a21cf3c52a50602adaef52f5ea605984f0e2e53c1498862bc7f29c938284fa2059e2b1895162df772346264369d448fc9f8f97bcff16c287558ff4275a14d94c233b282312118e10d20af62440df7f2741768dccaf01d7fb23e5fa4708639135f52da13efbbd2a61df5bb1f8416aa2f3112ccf50d8beaf8c7c7125f3902701587b6206cc74b5642833330a279f2ab8bffcdeead86f65bcce45cd8fd412f4e6777be12361aabff4855498d59944e607b2bae629fb86db8b2d3c8e7c9cfbe1680090c4b2c36216b7e1499c10c5334aa49ffe988134141d31a367d1c7a4a4dfb15fa88193e7d339fe881fcacf887759628a1b488d4a9473131264bbfd7a2a5821a06d0fbb5e86f5fb4723f99acba30dfcf1977df0d46847ea68bc547e9256521104b552c8e4dadc861de7d12fe24d86125b81431e61daad5b927027fa4729626d57080b4e524917dd2ea733ba2ec26a568c92c0150abdcb9ee6d7ecef5a10b43406a6ba010484c0d16d8a06bd396d41be849b00b0cfd1203ca6e84ffccf79ca98a2c084c500e32414a40f9f9b360f229d2b01f1552d0f75ad1d875f1c37003a963806a85f87e76d57919076ac3f8361f7ad55b4dd0d650d60965f8e2ab53dc96bdab036c136ed169cc5e9aa0a6a664debd2e12a8adc2e9db4b5b6e32b1395f7881c1741cd686454659769aea0c4efb861cacb52c5d48a2a1197f02d4262b6f041087a68cb6e20b243aa8ff36d47b875da9eee2044bf3766a15043d709f8a21806c8ce9f19578ddc32a68509e90447847e6ef212eb8965316ac54de057941023cb0a16a5b53c2c7c3565db9f8337ce8c1228fbd0750a03977a161f556af1e5478108a986853f6b2de669c62ae2d9ca6a4934f99bf625ad0aeca950169a3fbe677208774c9a0232b0a75fed1e8356a3b2b728226831c427b5ab7a2403c6f54ad87ec0662a24674e9d868f287d736d068f51d7ae9474fe89cf688b778acdb4a324a7eccaf6e3d8ca9f7f3ff211767c2fe0bc7cf77f8799f58c9319370fad9a8167965734f7e6ff8192c5e7f8c10aba4e4eb784eaf21a3cce1122ab64e972c3b9c62fedabfec460948eaf6630d5b69758ceb30bfe94644239abdf7038fc80592920766b53a0e3b6c5ef57eafc64ac3d4346a7f5614fd32d74cf8faa884cae9de408d416f085fabeb363c97a901d78deed82ade652a3f059af4f8eaa11c919bd8ff02c7f28b72efc000edeae1faa111e0fe2392876aa6afd77458692ce34cd392beb6efe87b280c0f22328d47a8008e7c5d0b2f35b85ae74af9e531777d755bcc90109cf3360ba8adbf4d452adde22996fa16501907b34e232ed746e7c17d784213a860891af98f9bf5b2ce28234c42af661b932fd8bc6c508f736577feee0e036b8838d01cc806abe0a30a2b8c235accd2e8298588a24f6753ea04d3704f81ae4e486ce2d3a7a01aa15b2c3220128f625b1738592890c397df5250ee45b9af450c4a96332bfdb4168d671b91a3356e6a714f36795de7d12447a951ece27884234cb62bf473ea83781da56f94929018e5655d3af79b66a84e8c4fbc997d2802fcf3e8b284f1e02110be2ea1e9d8f00c2236a8f0a9f7d666662a16f227519a2c33606aaf7b78001f8d9b9fc1b9cb74914cdaa5a6111633bf6025cf876b4d214191b80dad99910c1daf0e4f42eb70b1f2438db3a059fb86ace12560ae3b818d017d0e0aa1e9815aa900019574a995ee1a1ee6a7f7fa487d53604abf48d092c647282787a208f979df985a0572366034584a2fde0a5f54380a810698454a68fc780853beef8c27cf16383fbcdd8baaa720eaa46bc2562a238f3d102912a4defc5cc1addae4e7c8661c6c8ed2517205ac7bad51d31a0e2ca49d0de0bffa8c8b7dde84e3d7c285f7cde0ea50a529ddfd8d1c690fc404da1617b7658b485bbe2cbeccb5476337fae4e26ff03882b2c9f5e69e8fe723a89ccb3604bccdb63131b2de839e2a9d5e2ab83242c45ba9c5b872156e619edfc1c478abd76b8595474684b452d2da1b14af70c21ff59dbd788842da101abc9772d7d996a611a7f9f15e7c0c89f14654a52bcceb46adce0f41a8dd936dffa1a0920c8f31321e596bc258f66980d8d5d68f7322558c7693d707f1d02043a43456bc5b63e0c3d87d8b7defacbc00e95bcbd2406bfce6c9ce4cc2232d9192721fa4d7f63f75f2451086a49e0822e9349204f5dd50b9bf85efdf5135f020acc2dd4109bca335b6ace0f44a506014b0e73689a436d632507eb0ebea87b0e64ab06d0d5c4b27463434d55479992c7e3c6ab17ca7d882b63159c0b77a7cd0bb2128cc7fbd608aa7794e428970f882a52baada7e57d39a804c9123e947d5662048f4ed6116bb1289578a6ead96a730f638bb17cad434affc23f410f42adad79c99b72f1513b0151810ab455957f5b145d704036e1b64b8faa6654049e3c94e882fc09a37fe9d01325171c3c03793430ac6cd6a511c0b0caebecdbd1b258dcc87b55a7d7ce8a5a7e2b5b2461a43541312b1fcb2e1f04d678090d227c077eda09fff8e9cfb25cdc718dd0b2a7d8743b02e0fa07dc08d5951e976f4db842f398c2341d0db8afe3d5aa41a0a4538afe3fc3849d3497f49033583cd10b1522baa84b95fdfc540e9f86ee1b45616f636538328ee9e6f5c99831a3e7f74f0b2e023414d68e0d674d2d1fc11f34283d35b58782c7dce02b16786c6a614082094fb76a5fd537c7ef48c8377378d2d501e76d35345a52ccbafe60e89f373a830978a93354d60487f1ca4ea4b6661ae3d6cb35698a351e11b670ff7928409492ef8234ddc50d5be28ab0ae79abcb6741b717a95a7d227595df862b6d044f7ad1a8979a9a8b16b64ad2b1594b6e31944630461a9421e5a9076922b5968c6d85270bea3852f232c6e9325b9c9e40d9237cb191ef3fa2a9045e34227f1b80ec5ac1b6c2664d61d2eb04110cc1c8b8307d0609ddc25a30dfb17a76afe2192e61bade14d297f043fdd7d2a06dbade4f95b4b9c2f42d86685a3baab988154f554aa83a2d81963e4159b0e424753d9f90d838ffb9450e9462a81fbe5cb51238bbb97e321d5084c7925ef5a100b6d0bbc7c53f4fc6be45c8b56e48906232a63b6c7b53e183ba526ba9df5133928fa0e54be2749fda931b71272b712c527f527a07cc02165b7e88312bacc1e61d9c8999e0bd24cd29ef1a6f207faaf3c7f7ea467e74eda5e6347e1b5f0c614bb73b4744027cf665ab031a9a0e06c832e8160c491d9d82a398ddf3846dcd68aa58a42407278711dacc7b455cb06272fdcaf8971c48a73d281aee26d7c29eb2b7ce1df28230a7f896d53ff696e9deb98015d1bd8cb4951c5eb852ba9ad596879948f10a503489961c725a13c92b63b905f1a53422e74cc830c131de377661340b6d066486cd260d5002a1cca92f4b619cecfa1a4c370015f142acedd0c88fb5c86e309abc7a5c6dc1cd1b90584c2f838da5a0ea38e8a8c054628156916eb36aac9f01b99446b1ecc354e8e284ea93c646fd3ac154cd43317fbddcd72047b538e8697f9f23894be43f4c11061b08f89cecfc85f8e40b214f3e0ce1597a3468479a3c903f5dcf5149ef8d4379a265b1c92c3a1813d67b4cffffde54467f60129eca0d36bab2bf3881597ece377dc98bdf1f1b481d4c57bc19f16cf1591a5a0c550dae796242d7bff8f43fb448a40a3834823de98af6d1bb79a12e6fda71bda0198c416f2d2bce58eb4ca4c2f6ec807e9de0bbfe8786bdb9a09206babd160be24cfb518e43750c0ac979d2a07170e08acf682ddc11e56327f7c41268ef3e8c1a4f7299bec2c28cb4062fdf15071ea07a0a2c684049c92e253a7294551be456240223eb507f29dead5283489007ceebaa5e1434b4511edeeefc0a44fb2733eeab77eacc3ada522d0642eac4cc6149d8577385ad7bb84aecf78e019fd0d89869fea99da3dd41c0a93a7105ec42ba1ed88cf8b9cce2cbabd92342cda9efaf1381b6e56bbbeafd6fc8efdcda92f9d57d9ae13ee1496fa0c28eb14edcd7f6ff532a8b61fcaba4e20e097c7943e077508989f4f02cf598cfe0c7b555df28bdcf97a07b83ebcd753d8d73c81124b44909d88885e301924db83ab940fc741a984764a9e918e694e005af0dcf946d0d5c076d888ed017e3f89a8c2c3922d467f988440f93329d86206e529d6bbedcf4190fd90d35aa6544574b77679902be7289afeca53813432d62908e42b441bcccb82e37481f29f3d92f73567696ee13c516c77e302fa5cb2a993b1e34ec4efebc1194467f403864e4d687015242f78597a29d39c99e1fd1b6383822a74ac95b1d203924c7fd7c5f3e9e162a69798ee39742d428c2433997cb8677025db5e697b69c7499b7480dd2a67d3fcaa2fa6f8aa76a2a1d22c3c99860d8833a0e72f09afdde12085bc7686e82a488ed3f48ba863549f194e1d19f3cbd34e68f4201a4e312a25025496997be03d15bb8da73c7ff890ab869fb175fe0484d0067634aaa6b32521600e088f8343ea22c5d6b27c0f16e66665179dd8c8e81564b723c153d6288a09d828c341560870127300e071cdd4cce8abd7926b1ebd4617309c042d5a7717966205b4318cf31b4f94e47f356586779ce3a19950a7b821ca48f613010b0c43687b8090f87d3974c7eae363ca051679b401060ceb2d213a79903b56862c6aa9ec14da3d3ca88120ff15657d1cd5db029048f48ca2167afbdc7e4d7cc0cc773af11cfc320676e4c1c9555f149c03b92ddd053352f32ca1d70df6cc0f5d5344718a4027496596704191360319c74807bc6668bf705550c3bc4753217b05e96c8ef68ca21ea9b6c1f78d0cfa284df5ec2c1c5e1ec3ec553a9014124a8a74e5ae95e78535b2a08994fe91f9f18b227726231b5308c5275a3d910b035c9d46bb178beeff05679fa82174137033781e4561058484e0e002fd2e5c49eab081f3bc11646a713335c3854398cac3c5accb6f03fc8de10197439bdaf4754071ddc5063a47ee756b8f9acee742ca8d0c8840478ba5c8a974b3b9d1e0405af0c19f509947a77745d560b2407296f2ef09cc816e5504a7b7675b716e7faa29e341aa99e8a05de505cae62cdfa9723143e7bb5efc1ee4b2d41ef68eb81f7872ada3230487c4d27244fa37d842790948231afc87b7ce6e4427da094681faf4c4bcaaafae791a0b4fb3e897354939a41eedebba693e5e9ad182b1d5b7256e2868b3e75892c85eb375b7d29fa117bc0e8cbf41f0821f5b5137b9b2714c26961d3231e02095d1540843a10f7f4b0f85861fdff7e745a90fb6a43c1d1e5a6b7b70dd07904dc650708708d91a7a5ce23b4417d691ec00ec4cbdeb0923a934c70a149e40f76f537f95245d9ce9901b8685fdb94cf2eeeddceca0ac0512435882e34bf9ed4e5f5f69d2957ef06db60ac242f2b45ad1326c246630524fd7407e708689c78ff33726f985ec67ad6b99e86589ce3f0e62770f20603d40879e1a8ee40173ba2756e9c66b40865f32641774c82de76256106e291b0179d47851e564fa7cf3998479a029f261ba821f6416b2c8a2f90a2a39c684897bab53433f8aadb04415236b69ab87e1784fb7cdb5b74c9ce6387ec7c8835b4bf53bb8a909c6cc42eeca0459ce9f43c790e6925e031708bc682753354ba8699d8ebb70031165d00fccccd9415afdd1b2380543475ac6d41c63097cd730de43b37c8ce5279c07cf96735056616106d1af81334220bcc332c9c69b0d90cc1ae67aa2b078656211eb5917910015ea38a90467daa0b26db2ec79f7f7bb2c666da4c16e56195ed06fb4381e8cdc64dcc5ee7e88d0a186859ac5c208504d8c3bbfa72af513cd6845ae34c359ff0eb1eb287d49674fb2ac1738e97526cb01c7b0963051100830d4e51ee8540887d824f5610870c278bea9d80325d7906fe2a350fb0f7ef70872ea7bd6853173cbdd4cd4d3af25e761b01e2a6b6a562275590b27c8a8a5c52a24d5c4446f6c1559e521ebcd0a201e6780b2e0e108464b37ed1e5556561136d50d6c684a9803b12ce4fee4fa2183a8dd6e589a46af09b4eabac4fcc33b2f4d0988f41c12ec4344cbbc6330c2a6a166f143b8c63d1e8ba4ff0f9852e4252d01b9edf49208eac8e6f8cdedb161eb3b82e65288e5ae2171df3770f8fd2fe2b9ba0c17bdd1c71e67ead4ff4c7a2dbd1448763034d82c52f07d36626e51ddb13b3b73d9c52fb962d0d6a79144fc8e3e3d4f52b0b7f96035bac0124b00a0d90469ea1455c5f06fbbcdc020b94f260fff03e68ff99d8aefe12b47bce2aa5662856ea115c796ea5773ac6157fed6db77f4956a5eb6de83633b0e00b3d940c3e3f3106228e94e38b8506bcadd9daff4ed33e82c255d89ed380d9c5478b0f69014e80b99f2e0d19845dc8539e5bb66bf7e48b8ccb8f472821a123afdbb561ec569839d2ffb21aee348f7f31fd756247083a5b47f04d63eab69afd27cc29385e78c0e9cdd1f9a4c7f927f0d55a858de3896abb6139317f10b9bc552f0392e18961afe7af6f3e963eeb5bded3db979cbf5cfe21abffe537184a6e4817066ac2f2abde03aa12e9dcd3ca7c3c540d397c475238d336f7e9495886182286be4375d5ee208e1eec7b812c9e5ba4c4bc02835394add6c448ac6c278dce9b3c57c4c1fbdcbd06e5a00eec90d3f28ffb72421be7045e10e3e439c4c31b01a7cfdaee4399583a1eaa938c7fb8cb827950e0f64c569402c5a5f15d40087222d7636cba44d46253f44f15cfa42a8d68d16242c9ca6589885ab84589cb8d5be1c6cf41c880c61cffd3fc13ea27048074c8606da072af1748e6bffdf1a4b194d9f196979e37dec18296bdfa3da9b831bd5c42c62e47e52f2ac2c045dd27b2e87d9cb4443c7ae358fa7e18b21ff803ba49e767fd4381312b79ea757644c84aa9dbf72d8f77e758f31ff302348f2708470e9284c2dcadcf2d15f472be4e7640a5b3367c5506ce9a89a508eec5d72269d732a682138d2e9bf4a1e8bc7404f9dc0ea569a84bcb926651b0398795b48978a9644d387c4c8c74d7be019e58a34c7f65f2fa6351a92729c22801d821708cb069380f0238ef3e1c8d4c0f03c59f0c05cc272e7a75a10059e6eaa176eb5dbc46f43f0ee97ef1bcb5d462826d4eaf985328901d4d306d7f209de0626c04cee8610486b7ec4f2f364835664689e771c26d483164c39e01bca0ee485f193e92e52036ab869f70728d76b200155903c2dc7d490b8293cdc5875933bfe461fe42f6ac00a0d12b000aa872d7e47749a8093819a4edf9b31d6f2fd7c9655cda379122fcca191df492f1ceef934e57e34fa879ed9344365ebe0b2b268006d3c66c63066f78a6889101e2ea47f53516421044e7ec162c51aa24f506803", 0x2000, &(0x7f0000008fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 00:17:33 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) readv(r1, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/207, 0xcf}], 0x1) 00:17:33 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:17:34 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 507.349692][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:34 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:34 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:34 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000440)={0x40000000, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = getpid() process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000000100)=""/152, 0x98}], 0x2, &(0x7f0000000040)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)=ANY=[], 0x20) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[], 0x10132) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r3, 0x0, 0x0, 0x0) migrate_pages(r3, 0xffff, &(0x7f0000000080)=0x1, &(0x7f00000001c0)=0x10001) setsockopt$sock_int(r2, 0x1, 0x1d, &(0x7f0000000000)=0xfffffffe, 0x4) recvmmsg(r2, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000002d40)={'wg0\x00'}) 00:17:34 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 507.809801][T14229] lo speed is unknown, defaulting to 1000 00:17:35 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) [ 508.389731][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:35 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 509.419627][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 509.579952][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.459758][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 510.779947][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.499723][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.546667][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.619793][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.581580][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:40 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:40 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:40 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000440)={0x40000000, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = getpid() process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000000100)=""/152, 0x98}], 0x2, &(0x7f0000000040)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)=ANY=[], 0x20) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[], 0x10132) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r3, 0x0, 0x0, 0x0) migrate_pages(r3, 0xffff, &(0x7f0000000080)=0x1, &(0x7f00000001c0)=0x10001) setsockopt$sock_int(r2, 0x1, 0x1d, &(0x7f0000000000)=0xfffffffe, 0x4) recvmmsg(r2, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000002d40)={'wg0\x00'}) 00:17:40 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:17:40 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:40 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000440)={0x40000000, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = getpid() process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000000100)=""/152, 0x98}], 0x2, &(0x7f0000000040)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)=ANY=[], 0x20) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[], 0x10132) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r3, 0x0, 0x0, 0x0) migrate_pages(r3, 0xffff, &(0x7f0000000080)=0x1, &(0x7f00000001c0)=0x10001) setsockopt$sock_int(r2, 0x1, 0x1d, &(0x7f0000000000)=0xfffffffe, 0x4) recvmmsg(r2, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000002d40)={'wg0\x00'}) 00:17:41 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:17:41 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 514.149612][T14264] lo speed is unknown, defaulting to 1000 [ 514.222633][T14253] lo speed is unknown, defaulting to 1000 [ 514.619897][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:41 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:17:42 executing program 1: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:17:42 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000440)={0x40000000, &(0x7f00000000c0), 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = getpid() process_vm_readv(r0, &(0x7f0000008400)=[{&(0x7f0000000300)=""/54, 0x36}, {&(0x7f0000000100)=""/152, 0x98}], 0x2, &(0x7f0000000040)=[{&(0x7f0000008480)=""/95, 0x5f}], 0x1, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f0000000000)=ANY=[], 0x20) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r1, &(0x7f0000000300)=ANY=[], 0x10132) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(r3, 0x0, 0x0, 0x0) migrate_pages(r3, 0xffff, &(0x7f0000000080)=0x1, &(0x7f00000001c0)=0x10001) setsockopt$sock_int(r2, 0x1, 0x1d, &(0x7f0000000000)=0xfffffffe, 0x4) recvmmsg(r2, &(0x7f0000001140)=[{{0x0, 0x0, 0x0}}], 0x700, 0x2, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000002d40)={'wg0\x00'}) 00:17:42 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) [ 515.659751][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.667886][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 515.922532][T14296] lo speed is unknown, defaulting to 1000 [ 516.709992][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.749636][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 518.708717][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 518.779741][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.819695][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 520.383940][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:47 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:47 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:47 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:47 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:17:47 executing program 3: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:47 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) (fail_nth: 1) [ 520.628192][T14312] FAULT_INJECTION: forcing a failure. [ 520.628192][T14312] name failslab, interval 1, probability 0, space 0, times 1 [ 520.678007][T14312] CPU: 1 PID: 14312 Comm: syz-executor.1 Not tainted 5.18.0-rc2-syzkaller #0 [ 520.686806][T14312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 520.696848][T14312] Call Trace: [ 520.700113][T14312] [ 520.703027][T14312] dump_stack_lvl+0x1e3/0x2cb [ 520.707814][T14312] ? bfq_pos_tree_add_move+0x436/0x436 [ 520.713255][T14312] ? panic+0x76e/0x76e [ 520.717343][T14312] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 520.723349][T14312] should_fail+0x384/0x4b0 [ 520.727802][T14312] should_failslab+0x5/0x20 [ 520.732325][T14312] kmem_cache_alloc_bulk+0x69/0x580 [ 520.737555][T14312] ? _raw_spin_unlock_irqrestore+0x8b/0x130 [ 520.743493][T14312] ? lockdep_hardirqs_on+0x95/0x140 [ 520.748677][T14312] __io_alloc_req_refill+0x28e/0x4df [ 520.753950][T14312] ? io_uring_alloc_task_context+0x6b5/0x6b5 [ 520.759917][T14312] ? io_task_refs_refill+0xc7/0x180 [ 520.765157][T14312] io_submit_sqes+0x5213/0xa8b0 [ 520.769997][T14312] ? atomic_dec_and_mutex_lock+0xb0/0xb0 [ 520.775683][T14312] ? rcu_read_lock_sched_held+0x89/0x130 [ 520.781320][T14312] ? __bpf_trace_rcu_stall_warning+0x10/0x10 [ 520.787316][T14312] ? percpu_ref_tryget+0x200/0x200 [ 520.792435][T14312] __se_sys_io_uring_enter+0x34e/0x1f70 [ 520.797971][T14312] ? read_lock_is_recursive+0x10/0x10 [ 520.803323][T14312] ? __x64_sys_io_uring_enter+0xf0/0xf0 [ 520.808850][T14312] ? __lock_acquire+0x1f80/0x1f80 [ 520.813859][T14312] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 520.819819][T14312] ? print_irqtrace_events+0x220/0x220 [ 520.825256][T14312] ? vtime_user_exit+0x2b2/0x3e0 [ 520.830176][T14312] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 520.836140][T14312] ? __x64_sys_io_uring_enter+0x1d/0xf0 [ 520.841673][T14312] do_syscall_64+0x2b/0x70 [ 520.846074][T14312] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 520.851949][T14312] RIP: 0033:0x7fc26c889049 [ 520.856346][T14312] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 520.875931][T14312] RSP: 002b:00007fc26da0d168 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 520.884328][T14312] RAX: ffffffffffffffda RBX: 00007fc26c99bf60 RCX: 00007fc26c889049 [ 520.892282][T14312] RDX: 0000000000000000 RSI: 000000000000450e RDI: 0000000000000003 [ 520.900235][T14312] RBP: 00007fc26da0d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 520.908187][T14312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 520.916135][T14312] R13: 00007ffc513b3a4f R14: 00007fc26da0d300 R15: 0000000000022000 [ 520.924098][T14312] [ 520.939323][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:48 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:48 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 521.739609][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 521.980043][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:49 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:49 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:49 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:49 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:49 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:49 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:49 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:50 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 523.020120][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.060006][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 524.788705][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.099835][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 526.142308][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 527.189930][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:54 executing program 3: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:54 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:54 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:17:54 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:54 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:54 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:54 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 527.819676][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:55 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 528.219956][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:55 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:17:55 executing program 4: setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:17:56 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 529.260176][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:17:56 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x307d, 0x0, 0x0, 0x0, 0x0) [ 529.979748][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.309791][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 530.868529][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 531.340015][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 532.379768][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.419857][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.899658][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 534.460018][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:01 executing program 3: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:01 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:01 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:01 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:01 executing program 4: setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:01 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 535.500131][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:02 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:02 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:03 executing program 4: setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:03 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:03 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x2, 0x0, 0x0, 0x0) 00:18:03 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 536.540147][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 536.949680][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 537.588586][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 538.619934][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.579767][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.659950][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 539.982161][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:07 executing program 3: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:07 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:07 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:07 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x7, 0x0, 0x0, 0x0) 00:18:07 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:07 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 540.715102][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:07 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:08 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:08 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:08 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:08 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:08 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 541.739891][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 542.779704][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.029677][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.819924][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 544.871022][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 545.909656][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:13 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) (fail_nth: 1) 00:18:13 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:13 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:13 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:13 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:13 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x8, 0x0, 0x0, 0x0) [ 546.059680][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:13 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:13 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 546.223674][T14465] FAULT_INJECTION: forcing a failure. [ 546.223674][T14465] name failslab, interval 1, probability 0, space 0, times 0 [ 546.279620][T14465] CPU: 0 PID: 14465 Comm: syz-executor.3 Not tainted 5.18.0-rc2-syzkaller #0 [ 546.288422][T14465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 546.298477][T14465] Call Trace: [ 546.301755][T14465] [ 546.304686][T14465] dump_stack_lvl+0x1e3/0x2cb [ 546.309367][T14465] ? bfq_pos_tree_add_move+0x436/0x436 [ 546.314826][T14465] ? panic+0x76e/0x76e [ 546.318896][T14465] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 546.324871][T14465] should_fail+0x384/0x4b0 [ 546.329280][T14465] should_failslab+0x5/0x20 [ 546.333775][T14465] kmem_cache_alloc_bulk+0x69/0x580 [ 546.338964][T14465] ? _raw_spin_unlock_irqrestore+0x8b/0x130 [ 546.344847][T14465] ? lockdep_hardirqs_on+0x95/0x140 [ 546.350037][T14465] __io_alloc_req_refill+0x28e/0x4df [ 546.355319][T14465] ? io_uring_alloc_task_context+0x6b5/0x6b5 [ 546.361299][T14465] ? io_task_refs_refill+0xc7/0x180 [ 546.366493][T14465] io_submit_sqes+0x5213/0xa8b0 [ 546.371335][T14465] ? atomic_dec_and_mutex_lock+0xb0/0xb0 [ 546.376955][T14465] ? rcu_read_lock_sched_held+0x89/0x130 [ 546.382572][T14465] ? __bpf_trace_rcu_stall_warning+0x10/0x10 [ 546.388560][T14465] ? percpu_ref_tryget+0x200/0x200 [ 546.393690][T14465] __se_sys_io_uring_enter+0x34e/0x1f70 [ 546.399234][T14465] ? read_lock_is_recursive+0x10/0x10 [ 546.404592][T14465] ? __x64_sys_io_uring_enter+0xf0/0xf0 [ 546.410126][T14465] ? __lock_acquire+0x1f80/0x1f80 [ 546.415174][T14465] ? lockdep_hardirqs_on_prepare+0x448/0x7b0 [ 546.421148][T14465] ? print_irqtrace_events+0x220/0x220 [ 546.426598][T14465] ? vtime_user_exit+0x2b2/0x3e0 [ 546.431529][T14465] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 546.437500][T14465] ? __x64_sys_io_uring_enter+0x1d/0xf0 [ 546.443034][T14465] do_syscall_64+0x2b/0x70 [ 546.447439][T14465] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 546.453326][T14465] RIP: 0033:0x7fd4efc89049 [ 546.457730][T14465] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 546.477319][T14465] RSP: 002b:00007fd4f0e7a168 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 546.485719][T14465] RAX: ffffffffffffffda RBX: 00007fd4efd9bf60 RCX: 00007fd4efc89049 [ 546.493680][T14465] RDX: 0000000000000000 RSI: 000000000000450e RDI: 0000000000000003 [ 546.501647][T14465] RBP: 00007fd4f0e7a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 546.509606][T14465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.517562][T14465] R13: 00007fff3c5ac53f R14: 00007fd4f0e7a300 R15: 0000000000022000 [ 546.525550][T14465] 00:18:13 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:13 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:13 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:14 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:14 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:14 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:14 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:14 executing program 2: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:14 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:14 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x10, 0x0, 0x0, 0x0) [ 547.504945][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:14 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:14 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:14 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:15 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:15 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) socket$alg(0x26, 0x5, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 548.628208][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:15 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x307d, 0x0, 0x0, 0x0, 0x0) 00:18:15 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:15 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:15 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:16 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x700, 0x0, 0x0, 0x0) 00:18:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:16 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:16 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 549.099881][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:16 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 549.179689][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:16 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000023c0), 0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 549.678560][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:16 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:16 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 550.718616][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.758908][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 552.141094][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 552.788862][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:20 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:20 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:20 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:20 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x2000, 0x0, 0x0, 0x0) 00:18:20 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x2, 0x0, 0x0, 0x0) [ 553.825162][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:21 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:21 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 554.872646][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.181318][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.908946][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.939992][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 557.993942][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 558.229785][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 558.789745][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 559.029018][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:26 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:26 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:26 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x800000, 0x0, 0x0, 0x0) 00:18:26 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x7, 0x0, 0x0, 0x0) 00:18:26 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:26 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:26 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:27 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 560.060003][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:27 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 561.118781][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 561.259859][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.148967][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 562.621090][ T1224] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.627425][ T1224] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.179909][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 564.236557][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 564.299661][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:31 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:31 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:31 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:31 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x8, 0x0, 0x0, 0x0) 00:18:31 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x1000000, 0x0, 0x0, 0x0) 00:18:31 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:31 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x2000000, 0x0, 0x0, 0x0) 00:18:31 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x0, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:32 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 565.276358][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:32 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:33 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:33 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 566.352255][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:33 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x7000000, 0x0, 0x0, 0x0) 00:18:33 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x10, 0x0, 0x0, 0x0) 00:18:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:33 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:33 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:34 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:34 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) [ 567.339784][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 567.419755][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:34 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:34 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:35 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x8000000, 0x0, 0x0, 0x0) 00:18:35 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 568.379777][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 568.469978][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:35 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x700, 0x0, 0x0, 0x0) 00:18:35 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:36 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 569.499874][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:36 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:36 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:36 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x10000000, 0x0, 0x0, 0x0) 00:18:36 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:37 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:18:37 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:37 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 570.380118][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 570.539716][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:37 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x2000, 0x0, 0x0, 0x0) 00:18:37 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:18:37 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:37 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:38 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:38 executing program 5: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:18:38 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x20000000, 0x0, 0x0, 0x0) 00:18:38 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 571.589886][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:39 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:39 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:39 executing program 5: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, 0x0, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 572.629932][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:39 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x800000, 0x0, 0x0, 0x0) 00:18:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:39 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:40 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0xf5ffffff, 0x0, 0x0, 0x0) 00:18:40 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:40 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:40 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0xfffffff5, 0x0, 0x0, 0x0) [ 573.429721][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:40 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:40 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:40 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 573.708301][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:40 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:41 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x1000000, 0x0, 0x0, 0x0) 00:18:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:41 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 574.786471][ T3678] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:41 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:41 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2, 0x0, 0x0) 00:18:41 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:42 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:42 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:42 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:42 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:18:42 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, 0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 575.873887][ T3678] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:43 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x2000000, 0x0, 0x0, 0x0) 00:18:43 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:43 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:43 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:18:43 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x7, 0x0, 0x0) 00:18:43 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 576.460872][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:43 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 576.939924][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:44 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:44 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:44 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:44 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) [ 577.980296][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 577.988742][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 577.996906][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.021258][ T45] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:45 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x7000000, 0x0, 0x0, 0x0) 00:18:45 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:45 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:45 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x8, 0x0, 0x0) 00:18:45 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:45 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 579.019968][ T22] net_ratelimit: 2 callbacks suppressed [ 579.019985][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:46 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:46 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:46 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 579.501206][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 580.071226][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:47 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x8000000, 0x0, 0x0, 0x0) 00:18:47 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:47 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x10, 0x0, 0x0) 00:18:47 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:47 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, 0x0, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:47 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x700, 0x0, 0x0) 00:18:47 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2000, 0x0, 0x0) 00:18:47 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:47 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x800000, 0x0, 0x0) 00:18:47 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 581.109420][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:48 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x10000000, 0x0, 0x0, 0x0) 00:18:48 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x1000000, 0x0, 0x0) 00:18:48 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140), 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:48 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:48 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:48 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:48 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2000000, 0x0, 0x0) 00:18:49 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x7000000, 0x0, 0x0) [ 582.171822][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:49 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x8000000, 0x0, 0x0) 00:18:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:49 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x10000000, 0x0, 0x0) [ 582.539766][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:50 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x20000000, 0x0, 0x0, 0x0) 00:18:50 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:50 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x20000000, 0x0, 0x0) 00:18:50 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:50 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xf5ffffff, 0x0, 0x0) [ 583.179741][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.207129][ T3730] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.251945][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.263087][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:50 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xfffffff5, 0x0, 0x0) 00:18:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:50 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x1000000000000, 0x0, 0x0) 00:18:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) [ 584.219677][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:51 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:52 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0xf5ffffff, 0x0, 0x0, 0x0) 00:18:52 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:52 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x80000000000000, 0x0, 0x0) [ 585.259739][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:52 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:52 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:52 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) [ 585.589775][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.299876][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:53 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x100000000000000, 0x0, 0x0) 00:18:53 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:53 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) 00:18:53 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) 00:18:54 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0xfffffff5, 0x0, 0x0, 0x0) 00:18:54 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 587.342337][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:54 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) 00:18:54 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x200000000000000, 0x0, 0x0) 00:18:54 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:55 executing program 5: write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 588.379832][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:55 executing program 5: write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 588.620228][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:55 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) 00:18:55 executing program 5: write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r0 = syz_open_pts(0xffffffffffffffff, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:55 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2, 0x0, 0x0) 00:18:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x700000000000000, 0x0, 0x0) 00:18:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(0x0, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 589.419685][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:56 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 590.459621][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:57 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x7, 0x0, 0x0) 00:18:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:57 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x800000000000000, 0x0, 0x0) 00:18:57 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:57 executing program 2: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:57 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) 00:18:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:58 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:58 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:18:58 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x8, 0x0, 0x0) [ 591.499757][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:58 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 591.659751][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:59 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x1000000000000000, 0x0, 0x0) 00:18:59 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 592.539695][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:18:59 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, 0x0, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:18:59 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 592.699619][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) 00:19:00 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x10, 0x0, 0x0) 00:19:00 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x700, 0x0, 0x0) 00:19:00 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:00 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2000, 0x0, 0x0) 00:19:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 593.579823][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:00 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2000000000000000, 0x0, 0x0) 00:19:00 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x800000, 0x0, 0x0) 00:19:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, 0x0) 00:19:01 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:01 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:01 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x1000000, 0x0, 0x0) 00:19:01 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2000000, 0x0, 0x0) 00:19:01 executing program 0: openat$nullb(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 594.619805][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 594.700475][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:01 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x7000000, 0x0, 0x0) 00:19:01 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x0, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:19:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:19:02 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x8000000, 0x0, 0x0) 00:19:02 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xf5ffffff00000000, 0x0, 0x0) 00:19:02 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:02 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) 00:19:02 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x10000000, 0x0, 0x0) [ 595.659720][ T3681] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:03 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (fail_nth: 1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:03 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x20000000, 0x0, 0x0) 00:19:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:03 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xf5ffffff, 0x0, 0x0) [ 596.103840][T15144] FAULT_INJECTION: forcing a failure. [ 596.103840][T15144] name failslab, interval 1, probability 0, space 0, times 0 [ 596.213276][T15144] CPU: 0 PID: 15144 Comm: syz-executor.0 Not tainted 5.18.0-rc2-syzkaller #0 [ 596.222079][T15144] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 596.232145][T15144] Call Trace: [ 596.235432][T15144] [ 596.238372][T15144] dump_stack_lvl+0x1e3/0x2cb [ 596.243068][T15144] ? bfq_pos_tree_add_move+0x436/0x436 [ 596.248542][T15144] ? panic+0x76e/0x76e [ 596.252652][T15144] ? __might_sleep+0xc0/0xc0 [ 596.257328][T15144] should_fail+0x384/0x4b0 [ 596.261762][T15144] ? kvmalloc_node+0x6d/0x100 [ 596.266507][T15144] should_failslab+0x5/0x20 [ 596.271023][T15144] __kmalloc_node+0x8e/0x400 [ 596.275623][T15144] ? tty_ldisc_ref_wait+0x21/0x70 [ 596.280735][T15144] kvmalloc_node+0x6d/0x100 [ 596.285252][T15144] file_tty_write+0x34b/0x960 [ 596.289984][T15144] ? n_tty_read+0x1c90/0x1c90 [ 596.294682][T15144] vfs_write+0xa22/0xd40 [ 596.298994][T15144] ? __lock_acquire+0x1f80/0x1f80 [ 596.304035][T15144] ? file_end_write+0x230/0x230 [ 596.308896][T15144] ? __fget_files+0x3d0/0x440 [ 596.313609][T15144] ? __fdget_pos+0x1d7/0x2e0 [ 596.318214][T15144] ? ksys_write+0x77/0x2c0 [ 596.322646][T15144] ksys_write+0x19b/0x2c0 [ 596.326980][T15144] ? print_irqtrace_events+0x220/0x220 [ 596.332451][T15144] ? __ia32_sys_read+0x80/0x80 [ 596.337227][T15144] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 596.343227][T15144] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 596.349219][T15144] do_syscall_64+0x2b/0x70 [ 596.353625][T15144] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 596.359517][T15144] RIP: 0033:0x7f5264489049 [ 596.363939][T15144] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 596.383547][T15144] RSP: 002b:00007f52655ac168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 596.391950][T15144] RAX: ffffffffffffffda RBX: 00007f526459bf60 RCX: 00007f5264489049 [ 596.399910][T15144] RDX: 000000000000ff2e RSI: 0000000020000080 RDI: 0000000000000003 00:19:03 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 596.407867][T15144] RBP: 00007f52655ac1d0 R08: 0000000000000000 R09: 0000000000000000 [ 596.415841][T15144] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 596.423815][T15144] R13: 00007ffe8196c73f R14: 00007f52655ac300 R15: 0000000000022000 [ 596.431799][T15144] 00:19:03 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xfffffff5, 0x0, 0x0) [ 596.715726][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:03 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x1000000000000, 0x0, 0x0) 00:19:03 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xffffffff00000000, 0x0, 0x0) 00:19:03 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (fail_nth: 2) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 597.011546][T15162] FAULT_INJECTION: forcing a failure. [ 597.011546][T15162] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 597.069459][T15162] CPU: 1 PID: 15162 Comm: syz-executor.0 Not tainted 5.18.0-rc2-syzkaller #0 [ 597.078265][T15162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 597.088334][T15162] Call Trace: [ 597.091626][T15162] [ 597.094565][T15162] dump_stack_lvl+0x1e3/0x2cb [ 597.099263][T15162] ? bfq_pos_tree_add_move+0x436/0x436 [ 597.104731][T15162] ? panic+0x76e/0x76e [ 597.108814][T15162] ? __lock_acquire+0x1f80/0x1f80 [ 597.113860][T15162] should_fail+0x384/0x4b0 [ 597.118288][T15162] _copy_from_iter+0x25c/0xec0 [ 597.123137][T15162] ? copy_mc_pipe_to_iter+0x460/0x460 [ 597.128502][T15162] ? __virt_addr_valid+0x21b/0x2d0 [ 597.133663][T15162] ? check_heap_object+0x13c/0x310 [ 597.138797][T15162] ? 0xffffffff81000000 [ 597.142936][T15162] ? __check_object_size+0x15a/0x210 [ 597.148209][T15162] file_tty_write+0x562/0x960 [ 597.152883][T15162] ? n_tty_read+0x1c90/0x1c90 [ 597.157552][T15162] vfs_write+0xa22/0xd40 [ 597.161782][T15162] ? __lock_acquire+0x1f80/0x1f80 [ 597.166805][T15162] ? file_end_write+0x230/0x230 [ 597.171647][T15162] ? __fget_files+0x3d0/0x440 [ 597.176318][T15162] ? __fdget_pos+0x1d7/0x2e0 [ 597.180895][T15162] ? ksys_write+0x77/0x2c0 [ 597.185303][T15162] ksys_write+0x19b/0x2c0 [ 597.189623][T15162] ? print_irqtrace_events+0x220/0x220 [ 597.195075][T15162] ? __ia32_sys_read+0x80/0x80 [ 597.199827][T15162] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 597.205804][T15162] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 597.211774][T15162] do_syscall_64+0x2b/0x70 [ 597.216178][T15162] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 597.222058][T15162] RIP: 0033:0x7f5264489049 [ 597.226461][T15162] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 597.246055][T15162] RSP: 002b:00007f52655ac168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 597.254456][T15162] RAX: ffffffffffffffda RBX: 00007f526459bf60 RCX: 00007f5264489049 [ 597.262413][T15162] RDX: 000000000000ff2e RSI: 0000000020000080 RDI: 0000000000000003 [ 597.270368][T15162] RBP: 00007f52655ac1d0 R08: 0000000000000000 R09: 0000000000000000 [ 597.278321][T15162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 597.286275][T15162] R13: 00007ffe8196c73f R14: 00007f52655ac300 R15: 0000000000022000 [ 597.294244][T15162] 00:19:04 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) 00:19:04 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, 0x0, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 597.740972][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.751215][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:05 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:05 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) 00:19:05 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:05 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (fail_nth: 3) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 598.780495][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:05 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x2) [ 599.001586][T15189] FAULT_INJECTION: forcing a failure. [ 599.001586][T15189] name failslab, interval 1, probability 0, space 0, times 0 [ 599.001899][T15189] [ 599.001904][T15189] ====================================================== [ 599.001910][T15189] WARNING: possible circular locking dependency detected [ 599.001916][T15189] 5.18.0-rc2-syzkaller #0 Not tainted [ 599.001924][T15189] ------------------------------------------------------ [ 599.001930][T15189] syz-executor.0/15189 is trying to acquire lock: [ 599.001938][T15189] ffffffff8c90f360 (console_owner){..-.}-{0:0}, at: console_lock_spinning_enable+0x2d/0x60 [ 599.002024][T15189] [ 599.002024][T15189] but task is already holding lock: [ 599.002029][T15189] ffff88807498f158 (&port->lock){-...}-{2:2}, at: pty_write+0xc5/0x170 [ 599.002068][T15189] [ 599.002068][T15189] which lock already depends on the new lock. [ 599.002068][T15189] [ 599.002072][T15189] [ 599.002072][T15189] the existing dependency chain (in reverse order) is: [ 599.002077][T15189] [ 599.002077][T15189] -> #2 (&port->lock){-...}-{2:2}: [ 599.002099][T15189] lock_acquire+0x1a7/0x400 [ 599.002114][T15189] _raw_spin_lock_irqsave+0xd1/0x120 [ 599.002131][T15189] tty_port_default_wakeup+0x21/0x100 [ 599.002146][T15189] serial8250_tx_chars+0x60e/0x810 [ 599.002189][T15189] serial8250_handle_irq+0x32f/0x410 [ 599.002205][T15189] serial8250_default_handle_irq+0xaf/0x190 [ 599.002260][T15189] serial8250_interrupt+0xa3/0x1e0 [ 599.002275][T15189] __handle_irq_event_percpu+0x200/0x620 [ 599.002292][T15189] handle_irq_event+0x83/0x1e0 [ 599.002330][T15189] handle_edge_irq+0x245/0xbe0 [ 599.002343][T15189] __common_interrupt+0xce/0x1e0 [ 599.002396][T15189] common_interrupt+0x9f/0xc0 [ 599.002413][T15189] asm_common_interrupt+0x1e/0x40 [ 599.002428][T15189] acpi_idle_enter+0x42d/0x790 [ 599.002476][T15189] cpuidle_enter_state+0x517/0xed0 [ 599.002569][T15189] cpuidle_enter+0x59/0x90 [ 599.002584][T15189] do_idle+0x3d2/0x640 [ 599.002596][T15189] cpu_startup_entry+0x15/0x20 [ 599.002609][T15189] start_kernel+0x4bf/0x56e [ 599.002675][T15189] secondary_startup_64_no_verify+0xc4/0xcb [ 599.002699][T15189] [ 599.002699][T15189] -> #1 (&port_lock_key){-.-.}-{2:2}: [ 599.002720][T15189] lock_acquire+0x1a7/0x400 [ 599.002734][T15189] _raw_spin_lock_irqsave+0xd1/0x120 [ 599.002749][T15189] serial8250_console_write+0x19c/0xf20 [ 599.002765][T15189] console_unlock+0xa98/0x1150 [ 599.002780][T15189] vprintk_emit+0xd1/0x1e0 [ 599.002793][T15189] _printk+0xcf/0x10f [ 599.002808][T15189] register_console+0x6e2/0x9c0 [ 599.002822][T15189] univ8250_console_init+0x41/0x43 [ 599.002845][T15189] console_init+0x5d/0xa8 [ 599.002858][T15189] start_kernel+0x328/0x56e [ 599.002872][T15189] secondary_startup_64_no_verify+0xc4/0xcb [ 599.002888][T15189] [ 599.002888][T15189] -> #0 (console_owner){..-.}-{0:0}: [ 599.002916][T15189] validate_chain+0x185c/0x65c0 [ 599.002930][T15189] __lock_acquire+0x129a/0x1f80 [ 599.002944][T15189] lock_acquire+0x1a7/0x400 [ 599.002965][T15189] console_lock_spinning_enable+0x52/0x60 [ 599.002981][T15189] console_unlock+0x7f4/0x1150 [ 599.002994][T15189] vprintk_emit+0xd1/0x1e0 [ 599.003008][T15189] _printk+0xcf/0x10f [ 599.003022][T15189] should_fail+0x366/0x4b0 [ 599.003036][T15189] should_failslab+0x5/0x20 [ 599.003053][T15189] __kmalloc+0x8b/0x370 [ 599.003067][T15189] __tty_buffer_request_room+0x1f0/0x540 [ 599.003081][T15189] tty_insert_flip_string_fixed_flag+0x91/0x2c0 [ 599.003096][T15189] pty_write+0xe9/0x170 [ 599.003109][T15189] n_tty_write+0x665/0x13b0 [ 599.003125][T15189] file_tty_write+0x5a5/0x960 [ 599.003140][T15189] vfs_write+0xa22/0xd40 [ 599.003153][T15189] ksys_write+0x19b/0x2c0 [ 599.003165][T15189] do_syscall_64+0x2b/0x70 [ 599.003178][T15189] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 599.003194][T15189] [ 599.003194][T15189] other info that might help us debug this: [ 599.003194][T15189] [ 599.003198][T15189] Chain exists of: [ 599.003198][T15189] console_owner --> &port_lock_key --> &port->lock [ 599.003198][T15189] [ 599.003223][T15189] Possible unsafe locking scenario: [ 599.003223][T15189] [ 599.003226][T15189] CPU0 CPU1 [ 599.003230][T15189] ---- ---- [ 599.003234][T15189] lock(&port->lock); [ 599.003243][T15189] lock(&port_lock_key); [ 599.003253][T15189] lock(&port->lock); [ 599.003263][T15189] lock(console_owner); [ 599.003272][T15189] [ 599.003272][T15189] *** DEADLOCK *** [ 599.003272][T15189] [ 599.003275][T15189] 6 locks held by syz-executor.0/15189: [ 599.003285][T15189] #0: ffff888031b7a098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 [ 599.003322][T15189] #1: ffff888031b7a130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_write+0x26e/0x960 [ 599.003359][T15189] #2: ffff888031b7a2e8 (&tty->termios_rwsem){++++}-{3:3}, at: n_tty_write+0x244/0x13b0 [ 599.003397][T15189] #3: ffffc90014d83378 (&ldata->output_lock){+.+.}-{3:3}, at: n_tty_write+0x61a/0x13b0 [ 599.003435][T15189] #4: ffff88807498f158 (&port->lock){-...}-{2:2}, at: pty_write+0xc5/0x170 [ 599.003470][T15189] #5: ffffffff8c7f7060 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0xb8/0x1e0 [ 599.003505][T15189] [ 599.003505][T15189] stack backtrace: [ 599.003510][T15189] CPU: 1 PID: 15189 Comm: syz-executor.0 Not tainted 5.18.0-rc2-syzkaller #0 [ 599.003527][T15189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 599.003535][T15189] Call Trace: [ 599.003541][T15189] [ 599.003547][T15189] dump_stack_lvl+0x1e3/0x2cb [ 599.003566][T15189] ? bfq_pos_tree_add_move+0x436/0x436 [ 599.003587][T15189] ? print_circular_bug+0x13e/0x1c0 [ 599.003604][T15189] check_noncircular+0x2f7/0x3b0 [ 599.003623][T15189] ? add_chain_block+0x850/0x850 [ 599.003639][T15189] ? lockdep_lock+0x11d/0x2a0 [ 599.003659][T15189] validate_chain+0x185c/0x65c0 [ 599.003682][T15189] ? vsnprintf+0x1ce0/0x1ce0 [ 599.003711][T15189] ? reacquire_held_locks+0x680/0x680 [ 599.003728][T15189] ? string+0x289/0x2d0 [ 599.003741][T15189] ? vsnprintf+0x1fa/0x1ce0 [ 599.003755][T15189] ? memcpy+0x3c/0x60 [ 599.003771][T15189] ? vsnprintf+0x1c02/0x1ce0 [ 599.003786][T15189] ? reacquire_held_locks+0x680/0x680 [ 599.003811][T15189] ? sprintf+0xd6/0x120 [ 599.003826][T15189] ? _prb_read_valid+0xbb9/0xbd0 [ 599.003844][T15189] ? mark_lock+0x98/0x350 [ 599.003861][T15189] __lock_acquire+0x129a/0x1f80 [ 599.003883][T15189] lock_acquire+0x1a7/0x400 [ 599.003897][T15189] ? console_lock_spinning_enable+0x2d/0x60 [ 599.003916][T15189] ? read_lock_is_recursive+0x10/0x10 [ 599.003932][T15189] ? console_lock_spinning_enable+0x2d/0x60 [ 599.003948][T15189] ? __lock_acquire+0x1f80/0x1f80 [ 599.003968][T15189] ? do_raw_spin_lock+0x148/0x360 [ 599.003988][T15189] ? _raw_spin_unlock+0x40/0x40 [ 599.004007][T15189] console_lock_spinning_enable+0x52/0x60 [ 599.004024][T15189] ? console_lock_spinning_enable+0x2d/0x60 [ 599.004040][T15189] console_unlock+0x7f4/0x1150 [ 599.004058][T15189] ? vprintk_emit+0xb8/0x1e0 [ 599.004073][T15189] ? console_trylock_spinning+0x450/0x450 [ 599.004088][T15189] ? vprintk_emit+0xb8/0x1e0 [ 599.004102][T15189] ? console_trylock+0x70/0x70 [ 599.004116][T15189] ? register_lock_class+0xfe/0x9d0 [ 599.004132][T15189] ? reacquire_held_locks+0x680/0x680 [ 599.004152][T15189] ? register_lock_class+0xfe/0x9d0 [ 599.004169][T15189] ? is_dynamic_key+0x1f0/0x1f0 [ 599.004186][T15189] vprintk_emit+0xd1/0x1e0 [ 599.004202][T15189] _printk+0xcf/0x10f [ 599.004221][T15189] ? panic+0x76e/0x76e [ 599.004243][T15189] should_fail+0x366/0x4b0 [ 599.004259][T15189] ? __tty_buffer_request_room+0x1f0/0x540 [ 599.004275][T15189] should_failslab+0x5/0x20 [ 599.004291][T15189] __kmalloc+0x8b/0x370 [ 599.004309][T15189] __tty_buffer_request_room+0x1f0/0x540 [ 599.004329][T15189] tty_insert_flip_string_fixed_flag+0x91/0x2c0 [ 599.004345][T15189] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 599.004362][T15189] ? _raw_spin_unlock+0x40/0x40 [ 599.004378][T15189] pty_write+0xe9/0x170 [ 599.004395][T15189] n_tty_write+0x665/0x13b0 [ 599.004414][T15189] ? _copy_from_iter+0x429/0xec0 [ 599.004434][T15189] ? n_tty_read+0x1c90/0x1c90 [ 599.004451][T15189] ? wait_woken+0x1b0/0x1b0 [ 599.004466][T15189] ? check_heap_object+0x13c/0x310 [ 599.004483][T15189] ? 0xffffffff81000000 [ 599.004494][T15189] ? __check_object_size+0x15a/0x210 [ 599.004512][T15189] file_tty_write+0x5a5/0x960 [ 599.004530][T15189] ? n_tty_read+0x1c90/0x1c90 [ 599.004547][T15189] vfs_write+0xa22/0xd40 [ 599.004562][T15189] ? __lock_acquire+0x1f80/0x1f80 [ 599.004579][T15189] ? file_end_write+0x230/0x230 [ 599.004597][T15189] ? __fget_files+0x3d0/0x440 [ 599.004615][T15189] ? __fdget_pos+0x1d7/0x2e0 [ 599.004629][T15189] ? ksys_write+0x77/0x2c0 [ 599.004643][T15189] ksys_write+0x19b/0x2c0 [ 599.004657][T15189] ? print_irqtrace_events+0x220/0x220 [ 599.004673][T15189] ? __ia32_sys_read+0x80/0x80 [ 599.004688][T15189] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 599.004708][T15189] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 599.004728][T15189] do_syscall_64+0x2b/0x70 [ 599.004743][T15189] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 599.004760][T15189] RIP: 0033:0x7f5264489049 [ 599.004773][T15189] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 599.004787][T15189] RSP: 002b:00007f52655ac168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 599.004805][T15189] RAX: ffffffffffffffda RBX: 00007f526459bf60 RCX: 00007f5264489049 [ 599.004817][T15189] RDX: 000000000000ff2e RSI: 0000000020000080 RDI: 0000000000000003 [ 599.004828][T15189] RBP: 00007f52655ac1d0 R08: 0000000000000000 R09: 0000000000000000 [ 599.004839][T15189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 599.004849][T15189] R13: 00007ffe8196c73f R14: 00007f52655ac300 R15: 0000000000022000 [ 599.004867][T15189] [ 599.967926][T15189] CPU: 1 PID: 15189 Comm: syz-executor.0 Not tainted 5.18.0-rc2-syzkaller #0 [ 599.976667][T15189] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 599.986714][T15189] Call Trace: [ 599.989991][T15189] [ 599.992914][T15189] dump_stack_lvl+0x1e3/0x2cb [ 599.997583][T15189] ? bfq_pos_tree_add_move+0x436/0x436 [ 600.003028][T15189] ? panic+0x76e/0x76e [ 600.007090][T15189] should_fail+0x384/0x4b0 [ 600.011496][T15189] ? __tty_buffer_request_room+0x1f0/0x540 [ 600.017286][T15189] should_failslab+0x5/0x20 [ 600.021777][T15189] __kmalloc+0x8b/0x370 [ 600.025927][T15189] __tty_buffer_request_room+0x1f0/0x540 [ 600.031548][T15189] tty_insert_flip_string_fixed_flag+0x91/0x2c0 [ 600.037773][T15189] ? _raw_spin_unlock_irqrestore+0xd9/0x130 [ 600.043705][T15189] ? _raw_spin_unlock+0x40/0x40 [ 600.048534][T15189] pty_write+0xe9/0x170 [ 600.052671][T15189] n_tty_write+0x665/0x13b0 [ 600.057158][T15189] ? _copy_from_iter+0x429/0xec0 [ 600.062081][T15189] ? n_tty_read+0x1c90/0x1c90 [ 600.066739][T15189] ? wait_woken+0x1b0/0x1b0 [ 600.071222][T15189] ? check_heap_object+0x13c/0x310 [ 600.076325][T15189] ? 0xffffffff81000000 [ 600.080494][T15189] ? __check_object_size+0x15a/0x210 [ 600.085759][T15189] file_tty_write+0x5a5/0x960 [ 600.090418][T15189] ? n_tty_read+0x1c90/0x1c90 [ 600.095077][T15189] vfs_write+0xa22/0xd40 [ 600.099304][T15189] ? __lock_acquire+0x1f80/0x1f80 [ 600.104314][T15189] ? file_end_write+0x230/0x230 [ 600.109157][T15189] ? __fget_files+0x3d0/0x440 [ 600.113834][T15189] ? __fdget_pos+0x1d7/0x2e0 [ 600.118412][T15189] ? ksys_write+0x77/0x2c0 [ 600.122836][T15189] ksys_write+0x19b/0x2c0 [ 600.127153][T15189] ? print_irqtrace_events+0x220/0x220 [ 600.132596][T15189] ? __ia32_sys_read+0x80/0x80 [ 600.137342][T15189] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 600.143310][T15189] ? syscall_enter_from_user_mode+0x2e/0x1a0 [ 600.149370][T15189] do_syscall_64+0x2b/0x70 [ 600.153774][T15189] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 600.159655][T15189] RIP: 0033:0x7f5264489049 [ 600.164056][T15189] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 600.183655][T15189] RSP: 002b:00007f52655ac168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 600.192052][T15189] RAX: ffffffffffffffda RBX: 00007f526459bf60 RCX: 00007f5264489049 [ 600.200005][T15189] RDX: 000000000000ff2e RSI: 0000000020000080 RDI: 0000000000000003 00:19:07 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x80000000000000, 0x0, 0x0) 00:19:07 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(0xffffffffffffffff, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:07 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) [ 600.207958][T15189] RBP: 00007f52655ac1d0 R08: 0000000000000000 R09: 0000000000000000 [ 600.215911][T15189] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 600.223868][T15189] R13: 00007ffe8196c73f R14: 00007f52655ac300 R15: 0000000000022000 [ 600.231828][T15189] [ 600.242670][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:07 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:07 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x7) 00:19:07 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f00000001c0)={0x6, &(0x7f0000000280)="a8fe6026eaa0813c5494a2f1f57a89be5a7caf99f041d0ef1a56b4cc8cafa050e81c93cacde79346fa9c8c9bf3c1c632e0e92911e396c45f1698fcaf33041aed42bc0df597234d7a81f0551b181cf2e51931fccad078f849b0773ec98a4abe4de417cbedc7045ce8ec928cf0122482208f4a325c422ad274065d4f5d7f2d8304d23a517f2c6e9b18463adf0a6a31f749a32e4fec1b14c84190877dd80adf16313ed28e2c30ac716a"}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYRESDEC=r2, @ANYRESHEX=r3, @ANYRES16=r3, @ANYRES32=r1, @ANYRES64=r2, @ANYRESOCT=r3], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r4 = syz_open_pts(r1, 0x0) r5 = dup3(r4, r1, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:07 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 600.779563][ T3721] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:08 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x100000000000000, 0x0, 0x0) 00:19:08 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x8) 00:19:08 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f00000001c0)={0x6, &(0x7f0000000280)="a8fe6026eaa0813c5494a2f1f57a89be5a7caf99f041d0ef1a56b4cc8cafa050e81c93cacde79346fa9c8c9bf3c1c632e0e92911e396c45f1698fcaf33041aed42bc0df597234d7a81f0551b181cf2e51931fccad078f849b0773ec98a4abe4de417cbedc7045ce8ec928cf0122482208f4a325c422ad274065d4f5d7f2d8304d23a517f2c6e9b18463adf0a6a31f749a32e4fec1b14c84190877dd80adf16313ed28e2c30ac716a"}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYRESDEC=r2, @ANYRESHEX=r3, @ANYRES16=r3, @ANYRES32=r1, @ANYRES64=r2, @ANYRESOCT=r3], 0xff2e) (async) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r4 = syz_open_pts(r1, 0x0) r5 = dup3(r4, r1, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:08 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) syz_open_pts(r0, 0x0) 00:19:08 executing program 0: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f00000001c0)={0x6, &(0x7f0000000280)="a8fe6026eaa0813c5494a2f1f57a89be5a7caf99f041d0ef1a56b4cc8cafa050e81c93cacde79346fa9c8c9bf3c1c632e0e92911e396c45f1698fcaf33041aed42bc0df597234d7a81f0551b181cf2e51931fccad078f849b0773ec98a4abe4de417cbedc7045ce8ec928cf0122482208f4a325c422ad274065d4f5d7f2d8304d23a517f2c6e9b18463adf0a6a31f749a32e4fec1b14c84190877dd80adf16313ed28e2c30ac716a"}) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[@ANYRESDEC=r2, @ANYRESHEX=r3, @ANYRES16=r3, @ANYRES32=r1, @ANYRES64=r2, @ANYRESOCT=r3], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) r4 = syz_open_pts(r1, 0x0) r5 = dup3(r4, r1, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) [ 601.261226][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:08 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:08 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x200000000000000, 0x0, 0x0) 00:19:08 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:08 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x301, 0x0) poll(&(0x7f0000000080)=[{r0, 0x96}, {r2, 0x8}, {r1, 0x1564}, {r1, 0x40}, {r0}, {r0, 0x402}], 0x6, 0xfffffff9) r3 = dup3(r1, r0, 0x0) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:08 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x700000000000000, 0x0, 0x0) 00:19:08 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x10) 00:19:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x301, 0x0) poll(&(0x7f0000000080)=[{r0, 0x96}, {r2, 0x8}, {r1, 0x1564}, {r1, 0x40}, {r0}, {r0, 0x402}], 0x6, 0xfffffff9) r3 = dup3(r1, r0, 0x0) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) (async) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) syz_open_pts(r0, 0x0) (async) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x301, 0x0) (async) poll(&(0x7f0000000080)=[{r0, 0x96}, {r2, 0x8}, {r1, 0x1564}, {r1, 0x40}, {r0}, {r0, 0x402}], 0x6, 0xfffffff9) (async) dup3(r1, r0, 0x0) (async) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) (async) 00:19:09 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x301, 0x0) poll(&(0x7f0000000080)=[{r0, 0x96}, {r2, 0x8}, {r1, 0x1564}, {r1, 0x40}, {r0}, {r0, 0x402}], 0x6, 0xfffffff9) (async) r3 = dup3(r1, r0, 0x0) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) syz_open_pts(r0, 0x0) [ 602.300055][ T3679] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.308159][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee00}}, './file0\x00'}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x500, 0x80) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000180)="2bd661f3f27f32320f73188ca8a17c05c6170efb6343a0ebcb4c0999cdb9a0edb9501e9509b81bc97a81f42aa9424bbf04a115851f38a7227e72ecd5c8aef67fcb3c05be5c40403327bdc6d88c76882e344537d2bf3dcb510aacfb673b6632cc20d29ae6e27b01c61b7396d705dd63c77d304ba86c") 00:19:09 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:09 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:09 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:09 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x700) 00:19:09 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee00}}, './file0\x00'}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x500, 0x80) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000180)="2bd661f3f27f32320f73188ca8a17c05c6170efb6343a0ebcb4c0999cdb9a0edb9501e9509b81bc97a81f42aa9424bbf04a115851f38a7227e72ecd5c8aef67fcb3c05be5c40403327bdc6d88c76882e344537d2bf3dcb510aacfb673b6632cc20d29ae6e27b01c61b7396d705dd63c77d304ba86c") openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) (async) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) syz_open_pts(r0, 0x0) (async) dup3(r1, r0, 0x0) (async) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee00}}, './file0\x00'}) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xa) (async) openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x500, 0x80) (async) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000180)="2bd661f3f27f32320f73188ca8a17c05c6170efb6343a0ebcb4c0999cdb9a0edb9501e9509b81bc97a81f42aa9424bbf04a115851f38a7227e72ecd5c8aef67fcb3c05be5c40403327bdc6d88c76882e344537d2bf3dcb510aacfb673b6632cc20d29ae6e27b01c61b7396d705dd63c77d304ba86c") (async) 00:19:09 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x800000000000000, 0x0, 0x0) 00:19:09 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r0, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r0, r1, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(0xffffffffffffffff, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:09 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r2, 0xc018937b, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0xee00}}, './file0\x00'}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0xa) r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x500, 0x80) ioctl$PIO_FONT(r4, 0x4b61, &(0x7f0000000180)="2bd661f3f27f32320f73188ca8a17c05c6170efb6343a0ebcb4c0999cdb9a0edb9501e9509b81bc97a81f42aa9424bbf04a115851f38a7227e72ecd5c8aef67fcb3c05be5c40403327bdc6d88c76882e344537d2bf3dcb510aacfb673b6632cc20d29ae6e27b01c61b7396d705dd63c77d304ba86c") 00:19:10 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) syz_open_pts(r0, 0x0) 00:19:10 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x19, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) [ 603.343545][ T3767] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:10 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:10 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x200) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:19:10 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:10 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x2000) 00:19:10 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x1000000000000000, 0x0, 0x0) [ 603.819525][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:10 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x800000) 00:19:11 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:11 executing program 2: write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(0xffffffffffffffff, 0x0) 00:19:11 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x200) (async) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) 00:19:11 executing program 2: write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(0xffffffffffffffff, 0x0) 00:19:11 executing program 2: write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(0xffffffffffffffff, 0x0) 00:19:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) [ 604.382547][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:11 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:11 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x2000000000000000, 0x0, 0x0) 00:19:11 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x1000000) 00:19:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x200) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) (async) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x200) (async) syz_open_pts(r0, 0x0) (async) dup3(r1, r0, 0x0) (async) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x581000, 0x0) fcntl$getown(r2, 0x9) r3 = dup3(r0, r1, 0x80000) ioctl$FIGETBSZ(r3, 0x2, &(0x7f00000003c0)) dup3(r1, r0, 0x0) ioctl$INCFS_IOC_CREATE_FILE(r2, 0xc058671e, &(0x7f0000000340)={{'\x00', 0x2}, {0x29658d08}, 0x80, 0x0, 0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)="0dca9b216745ef4984", 0x9, 0x0, &(0x7f00000001c0)={0x2, 0x10d, {0x1, 0xc, 0x9d, "5712f0262a42d4b07bbbc96aae9a74ce6c96b0890e288595f70d6c74ef1c69afb0f61bfef51b3326185528ba1cc717d911c5035165f81aa8dfc705ffe0466fbb2f052a3751909228aaa258376db0cf2fff9a23fcdd1b9985ecdf44136d783cf346278fce69144fa104b6876f805a98177c04a8c2549eaaa5c5f8ad3f98a99fc6847648326acbb6b2e853294e940367f2385083cab4cf7822c9d491b688", 0x63, "142ad1078cd609ee2609333407e3a291767b78509adb65a21e6395c357cf530321cf327f2273807eb27810c6f018966a32c31c168b12b7d80465335c2bb45fd28d5c179fa0fbb61805d84e9b5258bc6eccfc6dc310a31b38d6d137dcf4809b5193222d"}, 0x52, "c04a72f09582bc7db099ea77076a5941270b24820f3c31d4a7fbaca5c7ee030b2ea87ae8821ca95c3985239b0667fd1c2da6a635d05c4334efd893108617d6947422ce728ccc749e3fb0b6ed655b93e16f0e"}, 0x16b}) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x9, 0x8000, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x2000000) [ 605.419754][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:12 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, 0x0) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xf5ffffff00000000, 0x0, 0x0) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:12 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x581000, 0x0) fcntl$getown(r2, 0x9) r3 = dup3(r0, r1, 0x80000) ioctl$FIGETBSZ(r3, 0x2, &(0x7f00000003c0)) dup3(r1, r0, 0x0) ioctl$INCFS_IOC_CREATE_FILE(r2, 0xc058671e, &(0x7f0000000340)={{'\x00', 0x2}, {0x29658d08}, 0x80, 0x0, 0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)="0dca9b216745ef4984", 0x9, 0x0, &(0x7f00000001c0)={0x2, 0x10d, {0x1, 0xc, 0x9d, "5712f0262a42d4b07bbbc96aae9a74ce6c96b0890e288595f70d6c74ef1c69afb0f61bfef51b3326185528ba1cc717d911c5035165f81aa8dfc705ffe0466fbb2f052a3751909228aaa258376db0cf2fff9a23fcdd1b9985ecdf44136d783cf346278fce69144fa104b6876f805a98177c04a8c2549eaaa5c5f8ad3f98a99fc6847648326acbb6b2e853294e940367f2385083cab4cf7822c9d491b688", 0x63, "142ad1078cd609ee2609333407e3a291767b78509adb65a21e6395c357cf530321cf327f2273807eb27810c6f018966a32c31c168b12b7d80465335c2bb45fd28d5c179fa0fbb61805d84e9b5258bc6eccfc6dc310a31b38d6d137dcf4809b5193222d"}, 0x52, "c04a72f09582bc7db099ea77076a5941270b24820f3c31d4a7fbaca5c7ee030b2ea87ae8821ca95c3985239b0667fd1c2da6a635d05c4334efd893108617d6947422ce728ccc749e3fb0b6ed655b93e16f0e"}, 0x16b}) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x9, 0x8000, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) (async) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) syz_open_pts(r0, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x581000, 0x0) (async) fcntl$getown(r2, 0x9) (async) dup3(r0, r1, 0x80000) (async) ioctl$FIGETBSZ(r3, 0x2, &(0x7f00000003c0)) (async) dup3(r1, r0, 0x0) (async) ioctl$INCFS_IOC_CREATE_FILE(r2, 0xc058671e, &(0x7f0000000340)={{'\x00', 0x2}, {0x29658d08}, 0x80, 0x0, 0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)="0dca9b216745ef4984", 0x9, 0x0, &(0x7f00000001c0)={0x2, 0x10d, {0x1, 0xc, 0x9d, "5712f0262a42d4b07bbbc96aae9a74ce6c96b0890e288595f70d6c74ef1c69afb0f61bfef51b3326185528ba1cc717d911c5035165f81aa8dfc705ffe0466fbb2f052a3751909228aaa258376db0cf2fff9a23fcdd1b9985ecdf44136d783cf346278fce69144fa104b6876f805a98177c04a8c2549eaaa5c5f8ad3f98a99fc6847648326acbb6b2e853294e940367f2385083cab4cf7822c9d491b688", 0x63, "142ad1078cd609ee2609333407e3a291767b78509adb65a21e6395c357cf530321cf327f2273807eb27810c6f018966a32c31c168b12b7d80465335c2bb45fd28d5c179fa0fbb61805d84e9b5258bc6eccfc6dc310a31b38d6d137dcf4809b5193222d"}, 0x52, "c04a72f09582bc7db099ea77076a5941270b24820f3c31d4a7fbaca5c7ee030b2ea87ae8821ca95c3985239b0667fd1c2da6a635d05c4334efd893108617d6947422ce728ccc749e3fb0b6ed655b93e16f0e"}, 0x16b}) (async) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x9, 0x8000, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) (async) 00:19:13 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x7000000) 00:19:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) r1 = syz_open_pts(r0, 0x0) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x581000, 0x0) fcntl$getown(r2, 0x9) (async) r3 = dup3(r0, r1, 0x80000) ioctl$FIGETBSZ(r3, 0x2, &(0x7f00000003c0)) (async) dup3(r1, r0, 0x0) ioctl$INCFS_IOC_CREATE_FILE(r2, 0xc058671e, &(0x7f0000000340)={{'\x00', 0x2}, {0x29658d08}, 0x80, 0x0, 0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)="0dca9b216745ef4984", 0x9, 0x0, &(0x7f00000001c0)={0x2, 0x10d, {0x1, 0xc, 0x9d, "5712f0262a42d4b07bbbc96aae9a74ce6c96b0890e288595f70d6c74ef1c69afb0f61bfef51b3326185528ba1cc717d911c5035165f81aa8dfc705ffe0466fbb2f052a3751909228aaa258376db0cf2fff9a23fcdd1b9985ecdf44136d783cf346278fce69144fa104b6876f805a98177c04a8c2549eaaa5c5f8ad3f98a99fc6847648326acbb6b2e853294e940367f2385083cab4cf7822c9d491b688", 0x63, "142ad1078cd609ee2609333407e3a291767b78509adb65a21e6395c357cf530321cf327f2273807eb27810c6f018966a32c31c168b12b7d80465335c2bb45fd28d5c179fa0fbb61805d84e9b5258bc6eccfc6dc310a31b38d6d137dcf4809b5193222d"}, 0x52, "c04a72f09582bc7db099ea77076a5941270b24820f3c31d4a7fbaca5c7ee030b2ea87ae8821ca95c3985239b0667fd1c2da6a635d05c4334efd893108617d6947422ce728ccc749e3fb0b6ed655b93e16f0e"}, 0x16b}) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000000)={0x0, 0x9, 0x8000, 0x6, 0x0, "4af0281eacd8d412d0f0928287b73f1e1b8aa0"}) 00:19:13 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xff2e) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r4 = syz_open_pts(r2, 0x0) readv(r4, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/207, 0xcf}], 0x1) dup3(r4, r2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r5, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x20000, 0x0, 0x100006, 0x12, "4af02c1e1f00000000f20983e2d5bc634b9a1c"}) [ 606.463961][ T3682] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:13 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x0, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:13 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) dup3(0xffffffffffffffff, r0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x5402, 0x0) 00:19:13 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0xffffffff00000000, 0x0, 0x0) 00:19:13 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x8000000) 00:19:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) [ 606.859524][ T3719] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:14 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x10000000) 00:19:14 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) (async) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xff2e) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) r4 = syz_open_pts(r2, 0x0) readv(r4, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/207, 0xcf}], 0x1) dup3(r4, r2, 0x0) (async) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r5, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x20000, 0x0, 0x100006, 0x12, "4af02c1e1f00000000f20983e2d5bc634b9a1c"}) 00:19:14 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x2) 00:19:14 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r1 = syz_open_pts(r0, 0x0) dup3(r1, r0, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xff2e) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r4 = syz_open_pts(r2, 0x0) readv(r4, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/207, 0xcf}], 0x1) dup3(r4, r2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r5, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x20000, 0x0, 0x100006, 0x12, "4af02c1e1f00000000f20983e2d5bc634b9a1c"}) 00:19:14 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) (async) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async, rerun: 64) r1 = syz_open_pts(r0, 0x0) (rerun: 64) dup3(r1, r0, 0x0) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r2, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r2, &(0x7f0000000080)=ANY=[], 0xff2e) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) r4 = syz_open_pts(r2, 0x0) readv(r4, &(0x7f00000002c0)=[{&(0x7f0000000180)=""/207, 0xcf}], 0x1) (async) dup3(r4, r2, 0x0) (async) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "1241eab5fa02a4856d4a608abcb62d7f71e35b"}) write$binfmt_aout(r5, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r5, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) (async) ioctl$TCSETS(0xffffffffffffffff, 0x5402, &(0x7f0000000000)={0x0, 0x20000, 0x0, 0x100006, 0x12, "4af02c1e1f00000000f20983e2d5bc634b9a1c"}) [ 607.502878][ T22] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 00:19:14 executing program 4: setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000000)=@ccm_128={{}, "ca97bc6305b8644a", "df9fb50f3df117b80c332eb5699502e1", "5a00fe9d", "27b9f2b6aa077d4e"}, 0x28) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25, 0x0, 0x0, 0x2af}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) sched_setparam(0x0, &(0x7f0000000100)) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, &(0x7f0000000200)={0x0, @time={0x2, 0x40}}) mkdir(&(0x7f0000000380)='./bus\x00', 0x0) mkdir(&(0x7f00000002c0)='./file1\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB]) chdir(0x0) 00:19:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) write$binfmt_aout(r0, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) syz_open_pts(r0, 0x0) 00:19:14 executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x75d4, &(0x7f0000000340)={0x0, 0xee25}, &(0x7f0000ee7000/0x2000)=nil, &(0x7f0000eea000/0x1000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x40, &(0x7f0000000140)=0x307c, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index}, 0x0) io_uring_enter(r0, 0x450e, 0x0, 0x0, 0x0, 0x20000000) 00:19:14 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896f3337d5a000000000000000000000000602bfd2f1ace65f2e74dc99cb73a37f40362b7904e8a0ea8d2d9805c924f9985d22972031a1223afa1288af3f48c93fcdb11963d0b748287448f722dc180e87637b662b11effabf45beda2e3a7e1adf8f94b619fa152b33440f2358a745848caf7490eb305c936d26964a2a85e133d21368b8d228d02f96064de261cf02c9632a0eb4ab259e8f4dd63d8b6d2d6b2a0c29fbab7d04d73a381c296af344655b64e12f216fbc646cc6bd60ca773d187f2fd317f6cb2309d1a13526a44b7d9b2bf93947dc3ac3340a7a114051d33d152310574f0d784910dc1a8f5bbf3610c544437626236458f285196161496389b02ba46a72da0149b4ddfdd4ef7862a07395752a37cb0194e94e1310e0c0a148a9a48b149bf2f345f3f89813c9eb05160f63f0b363deee5cb77ea6e951857e1942e5c56d72d724af7aa24a8aadb512f3302972c53b0eb7a693e0b0c775b21aed72995cfe9e9347a07d43ce3db9f22d461e86416b3176f2e4e36306630052a2b03fd36ec52af0d684fabd5f38adffaa6c5a7a8100d1aefb88576b362690b76e2eb96b07ab790cf63cfc334b7469b5b5b397c622f7c3ee064f9272443bcb928b6f7a2450cd33550a42843b0b5ac9e37134c81bd56b72e1030b05a5b3ac47b5af22a9dff0700004adacc71db2b15b4ffd98e30224763382ade45d164be76b2e9a674448f3ee2cd29707484df87ea6e8e6333b5fcb1b8b43a7c005eb800000000000000000000010000000000387592adc78ccfe479549e6f4efc14c4a5cfe845e6157d6fe70b278147edf0e25065ec6b17f8022493d105c9c31121e7957aeec5f7f2af0446d128778c8bf15b87a0eec6f4c75966b5f0e067da85e335ac9af28f102aea1254d57c390e1f4174cd023a758ce59c9e2c4ce1f28b6783661e272bf1cb5c8ac177aa9c6ccbead9a96222394afb840247e5d69473b836f0d3dc0bf951ff24b0bbea730702835159e3517ffb3da0d01833589fec3bdab629b21e5d9e87c3c58d962fc24b87a20cd2b25b7d5a643674801e18b06ca98b49d9e28d004c7ebccf076c64ef71421f672b0948b18ab5af448ca9446e71ba6dd4bd15a12553c68c5ccd11ac3d5956d9d26ce27fdbe6721191f2ed1cc3f9c5e3d5cba447c4793165b3cbf51c7d0cf9edf823641e1bc7db7803b60dc8b21e49a33b73ac00337067dfd3ec9d13d0fbb4df8a72a6a75d1dd128af4e6dceee1048f300000000000000000000000000000000000000000000007958a50896df65337581398793d0a9abe75251908c07d2957ca70af1ac31aae536294d6a944cd35f46cb554d8aecae5a72cb24596d896ff9ad83473567b6cb9d032c395a1459399cea31ebafc1e77649b55af527ca0f1ac972ee72a78391473c1b9e000000000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x304, 0x10, &(0x7f0000000000), 0xfffffea2}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r1, 0x0, 0xe, 0x0, &(0x7f0000000040)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xcfac, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) write$binfmt_aout(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="cd0dc4d08e67d5cf18ad77fa4ecdde6eb939ec738d526c5f8ff0c50a19ab01f01dca5f3b800a7cc852095c8d9b9cc367b8d39737b7afdcc4bfa9b1b473c3d532e4a42c9fe8162e969492be9b4e1b66708bed3f3c34a48f9052392ea024e1b961be76583a24a85bc4d89e948c6890fc26254803d43843f3e977b81c3c7617738291f770fa4b490d4168f3b8ca63b0d33416beb534185cf978c04a9efec9e234349c4077f211e2d20d596619904bf41845d7367957aff54be0a7007e2e38b91515bab0ec1e786b8d75ef4b9ae969a3e5c997fddff76322e9e13fbf7e0b387219a991fe522c882ba6fe25227c36159e57b078a3210544aa2df785d2d412bc7a76c00d722fb407bed0dd06838e7ad179c453e4789de7652afbb81004c12e78045f0d81efc17b232d0404e640466e36b9227739039357d1e6e73e6c3e573666a171d46ca69304a155476bafaeb138d289a5b77fb0525f5e8002fbabca720d25c1eb56c8549b48c8dc726e18de476d147c6d5d60291aacc905cf7b6e5e86c5c9957ae10f6dc3eca15a7a59914b8b545a92016fdd00", @ANYRES32=r0, @ANYRESHEX=r1, @ANYRES16=r0, @ANYRESHEX=r0], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, "0040001e1d113c0000000000000100"}) r2 = syz_open_pts(r0, 0x0) r3 = dup3(r2, r0, 0x0) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x0, "4af0281eacd8d412d0f0000000003f1e1b8aa0"}) r4 = openat$damon_kdamond_pid(0xffffffffffffff9c, &(0x7f0000000080), 0x8400, 0x40) ioctl$TCSETAF(r4, 0x5408, &(0x7f0000000140)={0xe000, 0xffff, 0x4, 0x1, 0x1b, "bad00c69caf0c7f7"}) 00:19:15 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) (async) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000fef7ff7a0af0fff80000ff79a4f0ff00000000b7060000efffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00ba23008500000098000000b70000000000000095000000000000006f88300eaa179843d24f95acf0af839ec5300a584fe44c80de0b061417e9ade22cecede58ee094518a5800000082c81ddfe3960a29ea15fa7e22f0f3e51416b698f6da6fe8af496d22585ffab3af24974fae00d824313ffef788c6983945dd3663f79f67e78a48b24a4bcdc33b38c5f86e96111199f0f0af9f42099a0f54041889b971cf394bd43473a5ac2acab9768cbc52ff7f000000000000711727c4a32a6b7ecdae05d2b3fed4572eb0d88976d2adda68000000000000c47b18cf93996a43e2e080f57fadf535d8b3078ebe16b10160fad64474a7b558f7a56f41022feec18e013abd8fda2b96779e534d0675fbcc13ba9f9eb96319fd5b49521d5cb2ced401d7b6fce658f203a9c2da91116d986730da1be85b0000829512099df32814820fbf7be91cd13b77f4e4e599f8bbca388247856073472312a9ff4273b9cd08000000000000616e888cda842c661577818c2069cb41aa3b4b7fc28882cad315db3fffc5183deca7a32838ec0ad70d4f55382c1879b71ec504d2f3e3883428ee3d0123a5cad346f6d517f6fcea5b6bc4fcffffffffffff03f419a6e45fd98e77da4a8202ebbdafe6b2e38c9d7e506f5da2958cf7f0d9b31ca3275e64e29d39d158cebe43308cf8760588001172e19685e9a334aec76530861b772a1da96f0a227514bd0bc26df2b50a45e4eceae1ddfe88d58879d12afdb295ce2edecb253e0471714fa124211203000000000000001f502b6c760655ffb20ae13a1a94f7ae229fbf5da7cae4f994ee82fc98c864c3e352ad16f98208cf1469dd6c1212582a3687f7dbdf708929643f3f0f4e947c40742452685ec044fc71eaca9ac692145677e14054331801b1412b390864190520f18bc66aca9123b243f608c7f62d107ebc68df9f8d296721c9d465dad604bc0dc500000000000000000000000000000000000000000568a4997dd54fa83aacd2d209f66de2e26dc2fd862a0b8ee149c148197176745fc8ff1dd5bd6611daa882298a37b041b34668d4662ea8fbe2e787dfc4c8bef2124f0439b2d18cc83361da5cc732f365b0a528db31b90bc1405b6d5301c34319ccae29b1d6034b665c79baeeeac5e71d24e2e3b6ffc5bc2dcb600e645c0048b45e286a49e888d21abfc817085d9c00e08525207e33505226fdda16e6da6dd31f7a1736029b87e8d6a05bcb356298d7dccd7de2af0885bd4939ff96ab74da3871b877e4058c8752ba4994eafed8b239d781638fa339fa0f7dd135af3f80e40f4b885770cf27d205a45d4702f97b8b7c57b180c50b2b370dfb35dc895e8f05d6e71829f36150b2cde31469c4aea0c64850eb3f3e0dc35f8cdd76bdde2018366c3201307c370433762676f72e68c962430a0000000000000000000000000000e737dc2e1a3fdebbb510c663d24f72b954965201f775b3739c14dd4832768445bf06b880a4a10021fa81473c647c028be09f2809fd396fa26532a30a37737e95f0f41dd024b7bf8a6bf807c9fd9b8c7a39717729339dc3054117cb95693bdd61edcc2860b66545e194a961bdc5457d76ae1a87050e12ead896