x0, 0x0, [{}, {}, {0x0, 0x0, 0x7ff}, {}]}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x0, 0x1}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @const, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], '\f'}]}, {0x0, [0x0]}}, 0x0, 0x167}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:34 executing program 0: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x60, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8, 0x1, 'tbf\x00'}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28}, @TCA_TBF_BURST={0x8, 0x6, 0x7f}]}}]}, 0x60}}, 0x0) close(0xffffffffffffffff) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) 04:05:34 executing program 2: r0 = syz_open_dev$loop(&(0x7f0000000880)='/dev/loop#\x00', 0x10000000000, 0x1182) r1 = memfd_create(&(0x7f0000000240)='.^\xc5', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000140)='!', 0x1}], 0x1, 0x81805, 0x0) mlockall(0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r0, 0x0, 0x2400000e) ioctl$LOOP_CLR_FD(r0, 0x4c01) 04:05:34 executing program 5: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x119, 0x119, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @const, @datasec={0x0, 0x7, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}, {}], '\f'}]}}, 0x0, 0x136}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:34 executing program 1: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000013c0)={{{@in=@broadcast, @in, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@private1, 0x0, 0x32}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0x1}}, 0xe8) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0xb}}}, 0x1c) [ 741.806344][T20008] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 741.821723][T20008] sch_tbf: burst 127 is lower than device veth5 mtu (1514) ! 04:05:34 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) perf_event_open(&(0x7f0000000400)={0x2, 0x70, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = semget$private(0x0, 0x20000000102, 0x0) semop(r2, &(0x7f0000000080)=[{0x2, 0x7fff}], 0x1) semop(r2, &(0x7f0000000000)=[{0x2}], 0x1) semctl$IPC_RMID(r2, 0x0, 0x0) 04:05:34 executing program 1: r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) ioctl$BLKTRACESTOP(0xffffffffffffffff, 0x1275, 0x0) ioctl$BLKTRACESTOP(r0, 0x1275, 0x0) 04:05:34 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:34 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000900)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980200009802000098020000030080000000000000000000ffffffffe00000010000004000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f736530000000000000000000000000000000000000000000000000000000000000e4ff0800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000000000000000000003000000070000000000000000000000000000004800435400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @random="311dd5965231", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5}}}}}}, 0x0) [ 741.851636][T20021] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.0'. [ 741.880232][T20008] sch_tbf: burst 127 is lower than device veth5 mtu (1514) ! 04:05:34 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:34 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 741.930117][T20037] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables [ 741.993105][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.042658][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 743.111509][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.072869][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:37 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:37 executing program 4: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/loop-control\x00', 0x0, 0x0) getrandom(&(0x7f0000000040)=""/4135, 0x1027, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, 0x0) 04:05:37 executing program 2: perf_event_open(&(0x7f0000000000)={0x1000000002, 0x70, 0x800000000000013, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x3) 04:05:37 executing program 5: r0 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x0, 0x0) close(r0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_GET(r0, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={0x0}}, 0x0) 04:05:37 executing program 0: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) getrandom(&(0x7f0000001040)=""/4115, 0x1013, 0x0) ioctl$KDFONTOP_SET_DEF(r0, 0x4b72, 0x0) 04:05:37 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:37 executing program 2: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x0) close(r0) socket$packet(0x11, 0x2, 0x300) bind(r0, &(0x7f0000000100)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random="d07e041334c5"}, 0x80) 04:05:37 executing program 4: sched_setscheduler(0x0, 0x5, &(0x7f0000000180)) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f511, 0x0) 04:05:37 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f00000002c0), 0x161) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:37 executing program 0: getrandom(&(0x7f0000001040)=""/4115, 0x1013, 0x0) ioctl$TCFLSH(0xffffffffffffffff, 0x540b, 0x0) ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, 0x0) 04:05:37 executing program 4: 04:05:37 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:37 executing program 2: 04:05:37 executing program 5: 04:05:37 executing program 4: 04:05:37 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f00000002c0), 0x161) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:37 executing program 0: 04:05:37 executing program 4: 04:05:37 executing program 4: 04:05:37 executing program 5: 04:05:37 executing program 0: 04:05:37 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r0 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x3e, &(0x7f00000002c0), 0x161) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:37 executing program 2: [ 745.125080][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.151906][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.160346][T11912] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.169710][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.177824][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.187222][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.192763][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:40 executing program 2: 04:05:40 executing program 4: 04:05:40 executing program 5: 04:05:40 executing program 0: 04:05:40 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:40 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:40 executing program 4: 04:05:40 executing program 2: 04:05:40 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:40 executing program 0: 04:05:40 executing program 5: 04:05:40 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:40 executing program 4: [ 748.232817][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.271209][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.279327][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.312870][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:43 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:43 executing program 5: 04:05:43 executing program 0: 04:05:43 executing program 2: 04:05:43 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, 0x0, 0xbb8) 04:05:43 executing program 4: 04:05:43 executing program 5: 04:05:43 executing program 4: 04:05:43 executing program 0: 04:05:43 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, 0x0, 0xbb8) 04:05:43 executing program 2: 04:05:43 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, 0x0, 0xbb8) [ 751.362751][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.311791][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 752.402965][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 753.432760][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:46 executing program 2: 04:05:46 executing program 5: 04:05:46 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:46 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:46 executing program 0: 04:05:46 executing program 4: 04:05:46 executing program 4: 04:05:46 executing program 0: 04:05:46 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:46 executing program 5: 04:05:46 executing program 2: 04:05:46 executing program 4: 04:05:46 executing program 5: 04:05:46 executing program 2: [ 754.482382][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.351233][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.513852][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.552910][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:49 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:49 executing program 0: 04:05:49 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:49 executing program 4: 04:05:49 executing program 5: 04:05:49 executing program 2: 04:05:49 executing program 5: 04:05:49 executing program 4: 04:05:49 executing program 0: 04:05:49 executing program 2: 04:05:49 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:49 executing program 4: [ 757.593175][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 758.391210][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 758.632804][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.683148][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:52 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:52 executing program 5: 04:05:52 executing program 0: 04:05:52 executing program 2: 04:05:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) 04:05:52 executing program 4: 04:05:52 executing program 5: 04:05:52 executing program 0: 04:05:52 executing program 4: 04:05:52 executing program 2: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3c, 0x3c, 0x5, [@array, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x59}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:52 executing program 5: unshare(0x6c060000) r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f00000001c0)="1c0000001200050f0c1000000049b276062f763e9b200a00080001c0", 0x1c, 0x0, 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000400)=""/4092, 0xc462, 0x0, 0x0, 0xf4acd1e9c4fa5544) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB="02"], 0x1}}, 0x0) r1 = socket$inet6(0x10, 0x2, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="1ba0000010001d0200fdc5cbdd041d8e828003000000000001a7960fab0fc8da78031c6660b08f00003f71aced466b4644434a88fed7d75725e1069e42dc4b3844e5fb82bb02fec770967c740c00000000d02830b5a4c01a92317320f0c0a5adb7b5b8bf255f1a8dffa8", 0xfe0b, 0x40800, 0x0, 0xffffffffffffff95) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000100)={'lo\x00', {0x2, 0x0, @local}}) socket$inet(0x2, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) 04:05:52 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0xbb8) [ 760.333529][T20179] IPVS: ftp: loaded support on port[0] = 21 [ 760.368475][T20179] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 760.377967][T20179] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 760.388231][T20179] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 760.399603][T20179] netlink: 40027 bytes leftover after parsing attributes in process `syz-executor.5'. [ 760.409602][T20179] device lo entered promiscuous mode [ 760.415736][T20179] device tunl0 entered promiscuous mode [ 760.422268][T20179] device gre0 entered promiscuous mode [ 760.428704][T20179] device gretap0 entered promiscuous mode [ 760.434449][T20179] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 760.459983][T20203] netlink: 40027 bytes leftover after parsing attributes in process `syz-executor.5'. [ 760.470126][T20203] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 760.521358][T11912] tipc: TX() has been purged, node left! [ 760.714272][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.431205][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.753213][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.792840][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:55 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:55 executing program 4: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe1, 0xe1, 0x4, [@func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{}, {}, {}, {}]}, @fwd, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], '\x00'}, @array, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x100}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:55 executing program 2: getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000380)=ANY=[], 0x1) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000002cc0), 0x1a3, 0xa201000000000000) 04:05:55 executing program 0: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000300)={0x18, 0x0, 0x7ffd, "b329f978b61aa66028d5fe057ed7bee7fb25dc0e3d2a6505"}) 04:05:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5}, 0xbb8) 04:05:55 executing program 5: setresuid(0xee01, 0x0, 0x0) r0 = getuid() setresuid(0xee01, r0, 0x0) msgrcv(0x0, 0x0, 0x0, 0x0, 0x0) 04:05:55 executing program 4: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd9, 0xd9, 0x4, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @fwd, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], '\x00'}, @array, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0xf8}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:55 executing program 0: r0 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000300)={0x5, 0x0, 0x0, "b329f978b6"}) 04:05:55 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5}, 0xbb8) 04:05:55 executing program 5: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff6000/0x2000)=nil, &(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x0, 0x0, r0}, 0x68) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='net/ip6_tables_names\x00') preadv(r1, &(0x7f00000017c0), 0x3da, 0x2, 0x0) [ 763.259846][T20219] ptrace attach of "/root/syz-executor.4"[20216] was attempted by "/root/syz-executor.4"[20219] 04:05:55 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x2, 0x8000000, 0x1c8, 0xc8, 0xc8, 0xc8, 0x0, 0xc8, 0x160, 0x160, 0x160, 0x160, 0x160, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0x70, 0x98}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}, {{@ip={@rand_addr, @multicast2, 0x0, 0x0, 'syzkaller1\x00', 'caif0\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x228) socket$inet(0x2, 0x0, 0x0) 04:05:55 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 763.354585][T20229] ptrace attach of "/root/syz-executor.4"[20227] was attempted by "/root/syz-executor.4"[20229] [ 763.833584][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.471198][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 764.884005][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.922962][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:05:58 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:05:58 executing program 5: socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x2, 0x3, 0x1f8, 0xc8, 0xc8, 0xc8, 0x0, 0xc8, 0x160, 0x160, 0x160, 0x160, 0x160, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@inet=@tcp={{0x30, 'tcp\x00'}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}, {{@ip={@rand_addr, @multicast2, 0x0, 0x0, 'syzkaller1\x00', 'caif0\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x258) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x1) socket$inet(0x2, 0x0, 0x0) 04:05:58 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5}, 0xbb8) 04:05:58 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:05:58 executing program 2: getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000380)=ANY=[], 0x1) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x802, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000002cc0), 0x1a3, 0xa201000000000000) 04:05:58 executing program 0: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x2, 0x8000000, 0x1c8, 0xc8, 0xc8, 0xc8, 0x0, 0xc8, 0x160, 0x160, 0x160, 0x160, 0x160, 0x3, 0x0, {[{{@uncond=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0x70, 0x98}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00'}}, {{@ip={@rand_addr, @multicast2, 0x0, 0x0, 'syzkaller1\x00', 'caif0\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x228) socket$inet(0x2, 0x0, 0x0) 04:05:58 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600), 0x0, 0x5}, 0xbb8) 04:05:58 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x0, 0x5, &(0x7f00000008c0)=ANY=[@ANYBLOB="d48535dfcacd5b94674a79d2cacce50c6c5f8fcac8c7f159e43bcea488939ebd8df6c3f79ea696f0e4f8ed4d48943f0251982d2dc2063a8031b09e4b73fb86669682c25c4189f93b57b4bfb9b849ff2bae3a1a880d6b02f78332090000000000000077ed51d0f9a800ea32ab3b9c6efded79ee4c16dd9e84cd134d9d0b457b8448386cc8be0ead7ff584b8bc870000000018b61e0ba37509831435969dc53200003afb034bfef35a344f6b71d4606aa1858e8ea8bd63db5b574d84f7d483a1b273d77ee8191e2cfcc305b5f11e1c5387cc13acbaa088b1b06e21954b31df6bf2f64b8619"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x78) perf_event_open(&(0x7f0000001240)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x201, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000012c0)=ANY=[@ANYBLOB="b702000006000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cd00006ed3d09a6175b8fb9e1517137ed239d4037958e271b60dedf8937f02008b5e5a076d83923dd29c034055d47dafe6c8dc3d5d78c87f34e4d5b3185b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3adeef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e6ea09c346dfebd31a08b32808b80200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a5f3d74ca891c4594e8a4399e01eadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182babc18cae2ed4b4390af9a9ceefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f8cd3fcc3dc3dec04b25dfc17975238345d4f71af35910b158e56657b7218baaa7cbf781c0a99bd50499ccc421ace5e85efb17c7beba3da8223fe5308e4e65eebaace04f4087c4f0da0d9a88f9dbb593ddebf70132a4d0175b989b8eccf707882042e716df9b57b290c661d4e85031086e97bcc5ca0e221a0e34323c129102b6b7a643e82e88a1940b3c02ed9c92d6f64b1282dc519b00159830d7617001154c46bd3ca96318c570f0721fc7aa2a58090000000000000094f22cdf550ef091a78098534f0d973058594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf754a52e4b2d0f22d428bd705414888700a30e2366c6a06b3367a389ca390597a7790017b0689a173db9c24db65c1e0048d11d573dab18fd0600885f1ea8f2453dcb6a2bfd299fc3cdafda323e9c7080397bc49d70c060d57bc89fbe3bbaa058b040362ab9261503def363fb099408885afc2bf9a4f8c35070669ea69f5e4be1b8e0d6697e98186fc5141bd670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead1348474250eda2c8067ab743c1d82a5687f2ed690000522a0b7426000000000000000500000000000000000000000093fc7a82b98f99d9dedf7ba17f5f0b6d15e552fbd21f7eecff10241f43af03eea84c4304a5d3f93c3fc74c00000000000043e1ed82b9aa0ae92a499984a082776eb0937523f5292d126599d4345cde64f903c3415c618a32c2318f0858f19c6def80e1481e8e1c0098fc3f38b7a57211adb15d824cfdcf229628c0de49860a442863d6e257cfa4ce50f3d163d442824414a7da26cc86d7e18631c2061b1c8a8e3c06837fe08de62f8710ca877960b74d0000ce73da6022a8671d1a3575b421d100003203bf134686dd65808452cb6b76fcb134252c78de9b240de7b4cd015a77f76b3f964f432a4bf6cddd6222c2da006b6fdb9c8468ae1d986a893b9519444d16a6dfa92c04331a6698507048fab5ae402acd05fe621f22712dfd09ea4770b4278fa14547d8ce3c21188e5e4e2baacd98e8e443d6aaafe80053636ed1d99346c2468dd952595d78e9583bf4ea5de36099e3cddcb23aefd124b0ab85580f4ebb6eddb9e87c9ece874be869b3abe1c6ea55887dfa18d0aea13625895db90e237157a34e9f447237ea5b391bddd1290f7ce987a0e36b8e71b1779bbe95ffa9c3c0f6ba66e4d48e52253e49d21836e4b3220616aafbe7a3a18375ae593eb58fd500426286472466823cb8e1800aaaa0d9463c0c4ea5541a55df6eeffec0b6a7651004132c6e0898374c644eea45de7867a0efbad0ab2bc33b350440a90b79134e42da4e030916d86a7c2e1b2b33f74a112a3b91b40bed8db2df8633207f8387e04ca52ab0f3f7b058b13523b896800b992972d9609551c27a5916ea16069c5bf55b98d926d3c27e7945b29996e5cefbc9f857bc1332d29c42ffa701624d73b70000000000194f219821e23d790c475b14b7fe4fe002dffd651faa79bb0cee0cdac2bc3218f2ddaa6f7ba04b696a30d313bed388a88da09c01a4b827aa1784d927aca9b8540534c5c49a424ccfbc2213fc1572b0204dd456c81a454d1f32fb16b4fc1bfb8c1777a66c8a61650cf7cfb066a071413198369b086c319b161009c2cc0ad211a463c84c1b101efca17c95d92554afdbfe8d774c2a03e0cef3843ecafc3418137543e823ef09a7b0b40a70e28ab7665477115705b724b763be47c757a1cd3dd958b990b72a5df3b844804a31d85a9953da5d6e3ab4d7f614fb5ff8fc0508d89ccd37204c0bee486a1e770279a4f87c71da7fcb4e8afe1ac751df0ac45932e725e11445b8dc7ca59d19"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0xe80, 0x0, &(0x7f0000000980)="b9ff0300600d698cff9e14f008004de7f9c764362ae28e79667717032de9bda08b79", 0x0, 0xfc, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD(0x5, 0x0, 0x0) [ 766.287163][T20252] xt_TCPMSS: Only works on TCP SYN packets 04:05:58 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:05:58 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600), 0x0, 0x5}, 0xbb8) 04:05:58 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:05:58 executing program 5: r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-net\x00', 0x2, 0x0) ppoll(&(0x7f00000000c0)=[{r0}], 0x1, &(0x7f0000000100)={0x0, 0x3938700}, 0x0, 0x0) [ 766.962951][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.511205][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.992947][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 769.034315][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:01 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:01 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600), 0x0, 0x5}, 0xbb8) 04:06:01 executing program 2: r0 = syz_io_uring_setup(0x6ad4, &(0x7f0000000340), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d4000/0x4000)=nil, &(0x7f0000000180), &(0x7f0000000040)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/124, 0x7c}, {&(0x7f0000000440)=""/4096, 0x1000}], 0x2) 04:06:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:01 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0xb83, 0x0) dup2(r0, r1) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) 04:06:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:01 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0xb83, 0x0) dup2(r0, r1) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000600)={'team0\x00'}) 04:06:01 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0x0) 04:06:01 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:01 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="50000000090601020000000000f8ff0000000000200008801c00078018000180140002400000000000000000000000000000000008000940000000000900020073797a30001700000500010007"], 0x50}}, 0x0) [ 769.425532][ T28] audit: type=1804 audit(1596945961.710:38): pid=20291 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16269 res=1 errno=0 04:06:01 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 769.703813][ T28] audit: type=1804 audit(1596945961.990:39): pid=20316 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16269 res=1 errno=0 [ 770.082698][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.551234][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.122770][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.153366][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:04 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0x0) 04:06:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:04 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:04 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:04 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:04 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f0000000300)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000001600)=[@ip_retopts={{0x10}}], 0x10, 0x5}, 0x0) 04:06:04 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a9f120086d049608d663000000010902120001ea0000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_disconnect(0xffffffffffffffff) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) [ 772.439581][ T28] audit: type=1804 audit(1596945964.720:40): pid=20323 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16104 res=1 errno=0 04:06:04 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:04 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 773.193403][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.591237][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.242976][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.273219][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:07 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:07 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:07 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:07 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:07 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xec, 0x2e, 0x1, 0x8, 0x1d19, 0x1104, 0x5ef7, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf, 0xa5, 0x3c}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_open_dev$hiddev(0x0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000740)={0x84, &(0x7f0000000280), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000001200)={0x2c, &(0x7f0000001580)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000800)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x87, 0x2}, 0x0}) 04:06:07 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 775.461636][ T28] audit: type=1804 audit(1596945967.750:41): pid=20352 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16299 res=1 errno=0 04:06:07 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:07 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:07 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) socket$inet6(0xa, 0x6, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:07 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) socket$inet6(0xa, 0x6, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 776.313294][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.631185][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.353210][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:10 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:10 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:10 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) socket$inet6(0xa, 0x6, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:10 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:10 executing program 3: r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a9f120086d049608d663000000010902120001ea0000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000006c0)={0x84, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) [ 778.393060][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:10 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:10 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 778.504322][ T28] audit: type=1804 audit(1596945970.790:42): pid=20390 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16260 res=1 errno=0 04:06:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:10 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 779.432737][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.671230][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.474006][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:13 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:13 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:13 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendfile(r4, r3, 0x0, 0x80000000) 04:06:13 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:13 executing program 3: 04:06:13 executing program 3: 04:06:13 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:13 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 781.514139][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:13 executing program 3: 04:06:13 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:13 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 781.550047][ T28] audit: type=1804 audit(1596945973.830:43): pid=20409 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16267 res=1 errno=0 [ 782.552968][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.711256][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.593227][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.601849][T11912] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.610294][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.618718][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:16 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:16 executing program 3: 04:06:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:16 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:16 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendfile(r4, r3, 0x0, 0x80000000) 04:06:16 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:16 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:16 executing program 3: 04:06:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:16 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 784.579195][ T28] audit: type=1804 audit(1596945976.860:44): pid=20434 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16258 res=1 errno=0 04:06:16 executing program 3: 04:06:16 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 784.644884][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.682949][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.751939][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 786.712973][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:19 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:19 executing program 3: 04:06:19 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:19 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:19 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendfile(r4, r3, 0x0, 0x80000000) 04:06:19 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:19 executing program 5: bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x400000001ffffffd) r0 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:19 executing program 3: 04:06:19 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:19 executing program 3: 04:06:19 executing program 5: bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x400000001ffffffd) r0 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:19 executing program 3: [ 787.593427][ T28] audit: type=1804 audit(1596945979.880:45): pid=20454 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16269 res=1 errno=0 [ 787.753105][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.791246][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 788.802912][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 789.833030][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:22 executing program 3: 04:06:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:22 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:22 executing program 5: bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x400000001ffffffd) r0 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x80000000) 04:06:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:22 executing program 3: 04:06:22 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:22 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:22 executing program 3: r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup2(r0, r1) r3 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r3, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) r4 = dup2(r3, r3) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x105, &(0x7f00000016c0)={0x1, [0x0]}, &(0x7f0000001700)=0x8) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x19, &(0x7f0000000080), &(0x7f00000000c0)=0x8) 04:06:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x80000000) [ 790.634506][ T28] audit: type=1804 audit(1596945982.920:46): pid=20480 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16272 res=1 errno=0 04:06:22 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 790.798134][ T28] audit: type=1804 audit(1596945983.080:47): pid=20507 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=15891 res=1 errno=0 [ 790.882767][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:23 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:23 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:23 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:23 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) sendmsg(r0, &(0x7f0000000480)={&(0x7f0000000000)=@in6={0x1c, 0x1c, 0x2}, 0x1c, 0x0, 0x0, &(0x7f00000002c0)=[{0x10}, {0x10}], 0x20}, 0x0) 04:06:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x80000000) 04:06:23 executing program 4: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:23 executing program 5: r0 = socket$inet6(0xa, 0x0, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:23 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 791.483035][ T28] audit: type=1804 audit(1596945983.770:48): pid=20520 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16066 res=1 errno=0 [ 791.831239][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 791.922570][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 792.952670][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:25 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:25 executing program 3: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x14, &(0x7f0000000000)={0x2, [0x1, 0x0]}, 0x8) 04:06:25 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:25 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x80000000) 04:06:25 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:26 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000780)={0xffffffffffffffff}) dup2(r1, r0) 04:06:26 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:26 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:26 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:26 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x2e, &(0x7f0000000100)={@local={0xfe, 0x80, [], 0x0}}, 0x14) 04:06:26 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:26 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 794.003014][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 794.871203][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 795.032652][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 796.082746][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:29 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:29 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x80000000) 04:06:29 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) setsockopt$sock_timeval(r0, 0xffff, 0x1005, &(0x7f00000000c0), 0x10) 04:06:29 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:29 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:29 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:29 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) connect$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) 04:06:29 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x80000000) 04:06:29 executing program 3: socket$inet_sctp(0x2, 0x0, 0x84) r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000780)={0xffffffffffffffff}) dup2(r1, r0) 04:06:29 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 797.113035][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 797.911233][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 798.153121][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 799.193058][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:32 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, 0x0, 0x0) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:32 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:32 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) close(r0) 04:06:32 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:32 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:32 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x0, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:32 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) recvfrom$inet6(r1, 0x0, 0x0, 0x2, 0x0, 0x0) 04:06:32 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100), 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 04:06:32 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x0, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 04:06:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:32 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100), 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 800.128510][ T28] audit: type=1804 audit(1596945992.410:49): pid=20629 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16271 res=1 errno=0 [ 800.233883][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 800.444759][ T28] audit: type=1804 audit(1596945992.730:50): pid=20660 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16261 res=1 errno=0 04:06:33 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:33 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r0, &(0x7f00000015c0)={0x1c, 0x1c, 0x3}, 0x1c) 04:06:33 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, 0x0, 0x0, 0x0) 04:06:33 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x0, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:33 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100), 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:33 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:33 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:33 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:33 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x29, &(0x7f00000000c0), &(0x7f0000000100)=0x8) 04:06:33 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:33 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 800.952644][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 801.089121][ T28] audit: type=1804 audit(1596945993.370:51): pid=20680 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16272 res=1 errno=0 [ 801.273133][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:33 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:33 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:33 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:33 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:33 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0x101, &(0x7f0000000000), &(0x7f00000000c0)=0x98) 04:06:33 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:34 executing program 1: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:34 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:34 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:34 executing program 3: r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) r2 = dup2(r1, r1) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x105, &(0x7f00000016c0)={0x1, [0x0]}, &(0x7f0000001700)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x29, &(0x7f0000000000)={r3}, &(0x7f0000000040)=0x8) 04:06:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:34 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:34 executing program 1: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 801.824215][T20714] ptrace attach of "/root/syz-executor.1"[20709] was attempted by "/root/syz-executor.1"[20714] 04:06:34 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:34 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:34 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x104, &(0x7f00000000c0), &(0x7f0000000100)=0x4) 04:06:34 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:34 executing program 1: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) [ 801.920152][T20728] ptrace attach of "/root/syz-executor.1"[20726] was attempted by "/root/syz-executor.1"[20728] 04:06:34 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:34 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:06:34 executing program 2: write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r1, 0x20000000000001) recvmmsg(r0, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:34 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) setsockopt$sock_timeval(r0, 0xffff, 0x1006, &(0x7f00000000c0), 0x10) 04:06:34 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x0) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:34 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:34 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, 0x0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 802.037941][T20744] ptrace attach of "/root/syz-executor.1"[20743] was attempted by "/root/syz-executor.1"[20744] 04:06:34 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x22, &(0x7f0000000140), &(0x7f0000000180)=0xc) 04:06:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:06:34 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:34 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, 0x0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:34 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x2}, 0x1c) 04:06:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:06:34 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 802.325051][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 802.366548][ T28] audit: type=1804 audit(1596945994.650:52): pid=20780 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16311 res=1 errno=0 04:06:35 executing program 2: write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r1, 0x20000000000001) recvmmsg(r0, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:35 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, 0x0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:35 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:35 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:35 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getrandom(0x0, 0x0, 0x0) 04:06:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:06:35 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc), 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:35 executing program 3: r0 = socket(0x200000000000011, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockname$packet(r0, &(0x7f0000000500), &(0x7f0000000040)=0x10eef0f1) 04:06:35 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:35 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:35 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc), 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:35 executing program 3: perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="23000000420081aee405e9a4000000000000c6ff07d800400300"/35, 0x23}], 0x1}, 0x0) recvmsg$kcm(r0, &(0x7f0000001740)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)=""/101, 0x65}, {&(0x7f0000000280)=""/91, 0x5}, {&(0x7f0000000300)=""/4096, 0x1000}], 0x3}, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000019c0)='/dev/sequencer\x00', 0x1, 0x0) write$sndseq(r1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, @tick, {0x92}, {}, @quote}], 0xff33) syz_open_dev$usbfs(0x0, 0x0, 0x0) [ 803.026777][ T28] audit: type=1804 audit(1596945995.310:53): pid=20796 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16084 res=1 errno=0 [ 803.352740][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:35 executing program 2: write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r1, 0x20000000000001) recvmmsg(r0, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:35 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000002c0)=ANY=[@ANYBLOB="66696c74657200000000000000000000000200000000000000000000000000000e00000004000000a003000000000000b80100005002000000000000580200001003000008030000080300000803000010030000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009001b801000000000000000000000000000000000000000028006367726f75700000000000000000000000000000000000000000000000000000000000000000f800726563656e74000000000000000000000000000000000000000000000000fdff000000000000210073797a3100000000000000000000000000000000000000010000000000000000002bdf0f012a36d32c0d093bc694d3c5bd001e0000000000000000000000000000000000000000000000000000000000f80000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000990578500000000000000000000000000000000280052454a4543540000000000000000000000000000000000000000000000000000000000000000e0000001ac1e0001000000000000000076657468315f746f5f6272696467650065727370616e30000200000000000000000000000000000000000000000000060000000000003165fcbf5d273bf600000000000000000000700098000000000000000000000000000000000000000000280052454a4543540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000007000b80000000000000000000000000000000000000000004800544545000000000000000000000000200000000000000000000000000001ac1414bb0000000000000000000000007665748f334fb4879eb3096e64000000000000edf8e6c200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000080000000000feffffff"], 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) connect$inet(r1, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(r1, &(0x7f0000003340)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 04:06:35 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:35 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc), 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:35 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r0, r0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:06:36 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:36 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) socket$inet6(0xa, 0x6, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:36 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:36 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 803.749127][T20829] x_tables: duplicate underflow at hook 2 [ 803.777041][T20829] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:36 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, 0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:36 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 803.813270][ T28] audit: type=1804 audit(1596945996.100:54): pid=20830 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16249 res=1 errno=0 [ 803.837649][T20829] x_tables: duplicate underflow at hook 2 [ 803.853782][T20841] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 803.991599][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 804.393370][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:36 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:36 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r2 = accept(r0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f00000005c0)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6612edf1767f157", 0xfffffcb9}], 0x1, &(0x7f0000000480)=[@op={0x18}], 0x18}, {0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="cf791563229735eeca617e572b9181e85320948df904d4df053f8a140a8e3305623e07b348846344ed3804d310bcc11ed26c6f9d66c4bb76284caa35f5573d6615c3d4afc72b1213b9d37d517f94178902ea2d6e0a024effe171910e3fe770c6af6ba6d620c7e0b9673947e20df350777ecbeeae9760763265f61275bf52e9679e1cf347cfb9ba106aed39b9b3f44c50354be7643b8916f42395e8093d71e9f477121647233d3c91d41f4585d75ca50df80a021da088b480771fd5446354a8f6af4566f7fd23a35f156fd900d01d79206eac", 0xd2}, {&(0x7f0000000200)="6fa752c52b0452e65d3905a55687867f062809ae2db85cc2dc80c7a0874dbab00c0bdacbd17975f3ee018a53a6cd23dc7f39a9046c57f3832617c94b67c09ce870b135b04a7554b6ccf799df186266320f6202997ebdbb49c64bf6bc188fab0649359456818cd00759f6b0246368df3b214faa4b2b87531ea22143f10da39acdfae3e0d0a6dac911961e3c196d05e787891e0e7d828b24", 0x97}], 0x2, &(0x7f00000004c0)=ANY=[@ANYBLOB="180008000000000000000000030000000000000000000000180000000000000017010000030044e76c14920000000000fc969e9f001800000000e1000017010000040000000000000000000000180000000000000017010000030000000000000000000000880000000000000017010000020000006d0000002317ec6f54bb2ab4dceb03b4e52ce031008322b422c0e40d2d5153e395faf3da35ab504de74549c0b33c285e25355a3ba699452f5d18606aaca29db10e24128112bb9d3a662d2195fb2c7214838fab482e99c9a84e2edb98c5aa008775b62d96571372d02d0e8a44badd2ebedc0000"], 0xe8}], 0x2, 0x0) recvmsg(r2, &(0x7f0000000300)={0x0, 0xcdc, &(0x7f0000000100)=[{&(0x7f000000b500)=""/151, 0x97}, {&(0x7f0000000180)=""/20, 0x40000314}], 0x2}, 0x0) 04:06:36 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, 0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:36 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:36 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r2, r1, 0x0, 0x80000000) 04:06:36 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:36 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, 0x0, 0x0) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:36 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:36 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 804.604318][ T28] audit: type=1804 audit(1596945996.890:55): pid=20861 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16384 res=1 errno=0 04:06:36 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:37 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 805.434210][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 806.482981][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:39 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:39 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:39 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r2, r1, 0x0, 0x80000000) 04:06:39 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:39 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r2 = accept(r0, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f00000005c0)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6612edf1767f157", 0xfffffcb9}], 0x1, &(0x7f0000000480)=[@op={0x18}], 0x18}, {0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="cf791563229735eeca617e572b9181e85320948df904d4df053f8a140a8e3305623e07b348846344ed3804d310bcc11ed26c6f9d66c4bb76284caa35f5573d6615c3d4afc72b1213b9d37d517f94178902ea2d6e0a024effe171910e3fe770c6af6ba6d620c7e0b9673947e20df350777ecbeeae9760763265f61275bf52e9679e1cf347cfb9ba106aed39b9b3f44c50354be7643b8916f42395e8093d71e9f477121647233d3c91d41f4585d75ca50df80a021da088b480771fd5446354a8f6af4566f7fd23a35f156fd900d01d79206eac", 0xd2}, {&(0x7f0000000200)="6fa752c52b0452e65d3905a55687867f062809ae2db85cc2dc80c7a0874dbab00c0bdacbd17975f3ee018a53a6cd23dc7f39a9046c57f3832617c94b67c09ce870b135b04a7554b6ccf799df186266320f6202997ebdbb49c64bf6bc188fab0649359456818cd00759f6b0246368df3b214faa4b2b87531ea22143f10da39acdfae3e0d0a6dac911961e3c196d05e787891e0e7d828b24", 0x97}], 0x2, &(0x7f00000004c0)=ANY=[@ANYBLOB="180008000000000000000000030000000000000000000000180000000000000017010000030044e76c14920000000000fc969e9f001800000000e1000017010000040000000000000000000000180000000000000017010000030000000000000000000000880000000000000017010000020000006d0000002317ec6f54bb2ab4dceb03b4e52ce031008322b422c0e40d2d5153e395faf3da35ab504de74549c0b33c285e25355a3ba699452f5d18606aaca29db10e24128112bb9d3a662d2195fb2c7214838fab482e99c9a84e2edb98c5aa008775b62d96571372d02d0e8a44badd2ebedc0000"], 0xe8}], 0x2, 0x0) recvmsg(r2, &(0x7f0000000300)={0x0, 0xcdc, &(0x7f0000000100)=[{&(0x7f000000b500)=""/151, 0x97}, {&(0x7f0000000180)=""/20, 0x40000314}], 0x2}, 0x0) 04:06:39 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:39 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:39 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:39 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 806.974436][ T28] audit: type=1804 audit(1596945999.260:56): pid=20882 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16384 res=1 errno=0 04:06:39 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:39 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 807.031202][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:39 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) [ 807.513497][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.553118][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 809.592869][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:42 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept4(r0, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:42 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:42 executing program 0: socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r2, r1, 0x0, 0x80000000) 04:06:42 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:42 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="7db700e100000000f56810"], 0x14}}, 0x0) 04:06:42 executing program 3: 04:06:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:42 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept4(r0, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:42 executing program 3: [ 810.002999][ T28] audit: type=1804 audit(1596946002.290:57): pid=20916 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16135 res=1 errno=0 04:06:42 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) accept4(r0, 0x0, 0x0, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10, 0x10d}], 0x24}}], 0x1, 0x0) 04:06:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 810.071202][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:42 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000005c0)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6612edf1767f157", 0xfffffcb9}], 0x1, &(0x7f0000000480)=[@op={0x18}], 0x18}, {0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="cf791563229735eeca617e572b9181e85320948df904d4df053f8a140a8e3305623e07b348846344ed3804d310bcc11ed26c6f9d66c4bb76284caa35f5573d6615c3d4afc72b1213b9d37d517f94178902ea2d6e0a024effe171910e3fe770c6af6ba6d620c7e0b9673947e20df350777ecbeeae9760763265f61275bf52e9679e1cf347cfb9ba106aed39b9b3f44c50354be7643b8916f42395e8093d71e9f477121647233d3c91d41f4585d75ca50df80a021da088b480771fd5446354a8f6af4566f7fd23a35f156fd900d01d79206eac", 0xd2}, {&(0x7f0000000200)="6fa752c52b0452e65d3905a55687867f062809ae2db85cc2dc80c7a0874dbab00c0bdacbd17975f3ee018a53a6cd23dc7f39a9046c57f3832617c94b67c09ce870b135b04a7554b6ccf799df186266320f6202997ebdbb49c64bf6bc188fab0649359456818cd00759f6b0246368df3b214faa4b2b87531ea22143f10da39acdfae3e0d0a6dac911961e3c196d05e787891e0e7d828b24", 0x97}], 0x2, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000170100000300000000000000000000001800000000000000170100000300000000000000000000001800000000e1000017010000040000000000000000000000180000000000000017010000030000000000000000000000880000000000000017010000020000006d0000002317ec6f54bb2ab4dceb03b4e52ce031008322b422c0e40d2d5153e395faf3da35ab504de74549c0b33c285e25355a3ba699452f5d18606aaca29db10e24128112bb9d3a662d2195fb2c7214838fab482e99c9a84e2edb98c5aa008775b62d96571372d02d0e8a44badd2ebedc00000000000000"], 0xe8}], 0x2, 0x0) recvmsg(r1, &(0x7f0000000300)={0x0, 0xcdc, &(0x7f0000000100)=[{&(0x7f000000b500)=""/151, 0x34000}, {&(0x7f0000000180)=""/20, 0x40000314}], 0x2}, 0x0) [ 810.642887][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 811.673070][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 812.722657][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:45 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:45 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) 04:06:45 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:45 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:06:45 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:45 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r1 = accept(r0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000005c0)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6612edf1767f157", 0xfffffcb9}], 0x1, &(0x7f0000000480)=[@op={0x18}], 0x18}, {0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)="cf791563229735eeca617e572b9181e85320948df904d4df053f8a140a8e3305623e07b348846344ed3804d310bcc11ed26c6f9d66c4bb76284caa35f5573d6615c3d4afc72b1213b9d37d517f94178902ea2d6e0a024effe171910e3fe770c6af6ba6d620c7e0b9673947e20df350777ecbeeae9760763265f61275bf52e9679e1cf347cfb9ba106aed39b9b3f44c50354be7643b8916f42395e8093d71e9f477121647233d3c91d41f4585d75ca50df80a021da088b480771fd5446354a8f6af4566f7fd23a35f156fd900d01d79206eac", 0xd2}, {&(0x7f0000000200)="6fa752c52b0452e65d3905a55687867f062809ae2db85cc2dc80c7a0874dbab00c0bdacbd17975f3ee018a53a6cd23dc7f39a9046c57f3832617c94b67c09ce870b135b04a7554b6ccf799df186266320f6202997ebdbb49c64bf6bc188fab0649359456818cd00759f6b0246368df3b214faa4b2b87531ea22143f10da39acdfae3e0d0a6dac911961e3c196d05e787891e0e7d828b24", 0x97}], 0x2, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000170100000300000000000000000000001800000000000000170100000300000000000000000000001800000000e1000017010000040000000000000000000000180000000000000017010000030000000000000000000000880000000000000017010000020000006d0000002317ec6f54bb2ab4dceb03b4e52ce031008322b422c0e40d2d5153e395faf3da35ab504de74549c0b33c285e25355a3ba699452f5d18606aaca29db10e24128112bb9d3a662d2195fb2c7214838fab482e99c9a84e2edb98c5aa008775b62d96571372d02d0e8a44badd2ebedc00000000000000"], 0xe8}], 0x2, 0x0) recvmsg(r1, &(0x7f0000000300)={0x0, 0xcdc, &(0x7f0000000100)=[{&(0x7f000000b500)=""/151, 0x34000}, {&(0x7f0000000180)=""/20, 0x40000314}], 0x2}, 0x0) 04:06:45 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) 04:06:45 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:45 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:45 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:45 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, 0x0, 0x0, 0x0) [ 813.029600][ T28] audit: type=1804 audit(1596946005.310:58): pid=20942 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16148 res=1 errno=0 04:06:45 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 813.118388][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 813.753371][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 814.803111][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 815.841213][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:48 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:48 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:48 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440), 0x0, 0x0) 04:06:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:48 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:06:48 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000026000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923d3f56a307e973e9cfd29c78c07f34e4d5b3185b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e60a0ac346dfebd31a08060000000200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08ab1e1ad828267d42b4e54861d0227dbfd2e6d7f715a7f3deadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182babc18cae2ed4b4390af9a9ceefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f8cd3fcc3dc3dec04b25dfc17975238345d4f71af35910b158c36657b7218baaa7cbf781c0a99bd50499ccc421ace5e85efb5b9964e4beba3da8223fe5308e4e65ee93e1d92b9f99f8ddebf70132a4d0175b989b8eccf707882042e716df9bc8b290c661d4e85031086e97bcc5ca0e221a0e34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d0d09504fe8ca28bd705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe33c3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab926150363fb099408885afc2bf9a46a076b7babfcddeff8c35070669ea69f5e4be1b8e0d6697e97186fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690000000000000000000000000000000000000000000099d4040000000000003f0ecdc7c82e72919c91d2039afe17e95edeeeba72205beff7771bcb293747b88486cacee4ccd8aeeda2919a4bff2ed893f20a6aba26cce2d4eedf35679fa697c7e0cf761f918725704a01c56051a9f748e5aaf30000bd8c40889967a39d63e6615264e3d3f8e0048e55ae289ce2ad77c43c549737d6d79ce71d4dc30cbb2cc4289d2f884d66cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c155fbf3d162dc1c27fa30f0dc60b9f253db5d1c7ed2e152cb2cf06f8edb30177fead735a952ffce676a93110904d5ee2abdab2ef3ff86a4d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354fa8de21eada75d3a3afb2f7629a5f14b7981699b6c0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d2503a3ea376721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e6712823221eb9ee0b3b68c9e209756623adf685dd715d68ed11e4b4d5502f5124948f8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb27098b7174bef66fa03a99b5c0c20b378065fac4ef9cd2d0d804b9400000000000000000000a321bc093d8100c593ac652e43e8b20db660275d19b60a121eff3566df60b693e3448c48b7422d5cef2816fc6ebf64dd27cd097ab9c58145c9ea19a10107291f59046322e922bbb078bc0c4d05d91406ad1cd600"/1580], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f0000000280)="b9ff0300600d698c389e14f00800", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 04:06:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:48 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:48 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440), 0x0, 0x0) 04:06:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:48 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000026000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923d3f56a307e973e9cfd29c78c07f34e4d5b3185b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e60a0ac346dfebd31a08060000000200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08ab1e1ad828267d42b4e54861d0227dbfd2e6d7f715a7f3deadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182babc18cae2ed4b4390af9a9ceefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f8cd3fcc3dc3dec04b25dfc17975238345d4f71af35910b158c36657b7218baaa7cbf781c0a99bd50499ccc421ace5e85efb5b9964e4beba3da8223fe5308e4e65ee93e1d92b9f99f8ddebf70132a4d0175b989b8eccf707882042e716df9bc8b290c661d4e85031086e97bcc5ca0e221a0e34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d0d09504fe8ca28bd705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe33c3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab926150363fb099408885afc2bf9a46a076b7babfcddeff8c35070669ea69f5e4be1b8e0d6697e97186fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690000000000000000000000000000000000000000000099d4040000000000003f0ecdc7c82e72919c91d2039afe17e95edeeeba72205beff7771bcb293747b88486cacee4ccd8aeeda2919a4bff2ed893f20a6aba26cce2d4eedf35679fa697c7e0cf761f918725704a01c56051a9f748e5aaf30000bd8c40889967a39d63e6615264e3d3f8e0048e55ae289ce2ad77c43c549737d6d79ce71d4dc30cbb2cc4289d2f884d66cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c155fbf3d162dc1c27fa30f0dc60b9f253db5d1c7ed2e152cb2cf06f8edb30177fead735a952ffce676a93110904d5ee2abdab2ef3ff86a4d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354fa8de21eada75d3a3afb2f7629a5f14b7981699b6c0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d2503a3ea376721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e6712823221eb9ee0b3b68c9e209756623adf685dd715d68ed11e4b4d5502f5124948f8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb27098b7174bef66fa03a99b5c0c20b378065fac4ef9cd2d0d804b9400000000000000000000a321bc093d8100c593ac652e43e8b20db660275d19b60a121eff3566df60b693e3448c48b7422d5cef2816fc6ebf64dd27cd097ab9c58145c9ea19a10107291f59046322e922bbb078bc0c4d05d91406ad1cd600"/1580], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f0000000280)="b9ff0300600d698c389e14f00800", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 04:06:48 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 816.072869][ T28] audit: type=1804 audit(1596946008.360:59): pid=20970 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16009 res=1 errno=0 [ 816.153554][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 816.872756][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 817.923023][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:51 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:51 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:51 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440), 0x0, 0x0) 04:06:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:51 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000026000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923d3f56a307e973e9cfd29c78c07f34e4d5b3185b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e60a0ac346dfebd31a08060000000200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08ab1e1ad828267d42b4e54861d0227dbfd2e6d7f715a7f3deadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182babc18cae2ed4b4390af9a9ceefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f8cd3fcc3dc3dec04b25dfc17975238345d4f71af35910b158c36657b7218baaa7cbf781c0a99bd50499ccc421ace5e85efb5b9964e4beba3da8223fe5308e4e65ee93e1d92b9f99f8ddebf70132a4d0175b989b8eccf707882042e716df9bc8b290c661d4e85031086e97bcc5ca0e221a0e34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d0d09504fe8ca28bd705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe33c3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab926150363fb099408885afc2bf9a46a076b7babfcddeff8c35070669ea69f5e4be1b8e0d6697e97186fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690000000000000000000000000000000000000000000099d4040000000000003f0ecdc7c82e72919c91d2039afe17e95edeeeba72205beff7771bcb293747b88486cacee4ccd8aeeda2919a4bff2ed893f20a6aba26cce2d4eedf35679fa697c7e0cf761f918725704a01c56051a9f748e5aaf30000bd8c40889967a39d63e6615264e3d3f8e0048e55ae289ce2ad77c43c549737d6d79ce71d4dc30cbb2cc4289d2f884d66cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c155fbf3d162dc1c27fa30f0dc60b9f253db5d1c7ed2e152cb2cf06f8edb30177fead735a952ffce676a93110904d5ee2abdab2ef3ff86a4d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354fa8de21eada75d3a3afb2f7629a5f14b7981699b6c0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d2503a3ea376721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e6712823221eb9ee0b3b68c9e209756623adf685dd715d68ed11e4b4d5502f5124948f8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb27098b7174bef66fa03a99b5c0c20b378065fac4ef9cd2d0d804b9400000000000000000000a321bc093d8100c593ac652e43e8b20db660275d19b60a121eff3566df60b693e3448c48b7422d5cef2816fc6ebf64dd27cd097ab9c58145c9ea19a10107291f59046322e922bbb078bc0c4d05d91406ad1cd600"/1580], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f0000000280)="b9ff0300600d698c389e14f00800", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 04:06:51 executing program 0: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) [ 818.952925][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:51 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:51 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 04:06:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:51 executing program 3: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a00)=ANY=[@ANYBLOB="b702000026000000bfa300000000000007030000007effff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf2827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923d3f56a307e973e9cfd29c78c07f34e4d5b3185b310efd4989147a09000000f110026e6d2ef831ab7ea0c34f17e3ad6ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b0a341a2d7cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c21476619f28d9961b626c57c2691208173656d60a17e3c184b751c51160fbcbbdb5b1e7be6148ba532e60a0ac346dfebd31a08060000000200000000000000334d83239dd27080e71113610e10d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08ab1e1ad828267d42b4e54861d0227dbfd2e6d7f715a7f3deadd3964663e88535c133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0182babc18cae2ed4b4390af9a9ceefd07e002cab5ebf8aad34732181feb215139f15ea7e8cb0c7cbe31fbae7c34d5ac5e7e64c21add9191eadd6e1795ad6a0f7f8cd3fcc3dc3dec04b25dfc17975238345d4f71af35910b158c36657b7218baaa7cbf781c0a99bd50499ccc421ace5e85efb5b9964e4beba3da8223fe5308e4e65ee93e1d92b9f99f8ddebf70132a4d0175b989b8eccf707882042e716df9bc8b290c661d4e85031086e97bcc5ca0e221a0e34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb00159830d7617001154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d0d09504fe8ca28bd705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe33c3cdafda323e9c7080397bc49d70c060d57bc88fbe3bbaa058b040362ab926150363fb099408885afc2bf9a46a076b7babfcddeff8c35070669ea69f5e4be1b8e0d6697e97186fc51439d670dba6623279f73db9dec75070cd9ab0fd96b069ef6d2857b6bf955012cf7fe50d133d541da86e0477e4a6cc999dc21c3ef408e633dfa35f14d6e734837d365e63845f3c1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cad4ead134847425a6da2c8067ab743c1d82a5687f2ed690000000000000000000000000000000000000000000099d4040000000000003f0ecdc7c82e72919c91d2039afe17e95edeeeba72205beff7771bcb293747b88486cacee4ccd8aeeda2919a4bff2ed893f20a6aba26cce2d4eedf35679fa697c7e0cf761f918725704a01c56051a9f748e5aaf30000bd8c40889967a39d63e6615264e3d3f8e0048e55ae289ce2ad77c43c549737d6d79ce71d4dc30cbb2cc4289d2f884d66cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c155fbf3d162dc1c27fa30f0dc60b9f253db5d1c7ed2e152cb2cf06f8edb30177fead735a952ffce676a93110904d5ee2abdab2ef3ff86a4d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354fa8de21eada75d3a3afb2f7629a5f14b7981699b6c0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d2503a3ea376721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e6712823221eb9ee0b3b68c9e209756623adf685dd715d68ed11e4b4d5502f5124948f8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb27098b7174bef66fa03a99b5c0c20b378065fac4ef9cd2d0d804b9400000000000000000000a321bc093d8100c593ac652e43e8b20db660275d19b60a121eff3566df60b693e3448c48b7422d5cef2816fc6ebf64dd27cd097ab9c58145c9ea19a10107291f59046322e922bbb078bc0c4d05d91406ad1cd600"/1580], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r0, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f0000000280)="b9ff0300600d698c389e14f00800", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 04:06:51 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 04:06:51 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 819.110812][ T28] audit: type=1804 audit(1596946011.390:60): pid=20996 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16056 res=1 errno=0 [ 819.191770][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.993064][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 821.042565][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:54 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:54 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:54 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 04:06:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) 04:06:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:54 executing program 3: r0 = syz_open_dev$video4linux(&(0x7f00000000c0)='/dev/v4l-subdev#\x00', 0x0, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0185647, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) 04:06:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:54 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x1, 0x0) [ 822.084414][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:54 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x1, 0x0) 04:06:54 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) [ 822.128672][ T28] audit: type=1804 audit(1596946014.410:61): pid=21019 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=15937 res=1 errno=0 04:06:54 executing program 3: 04:06:54 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) [ 822.231676][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 823.123125][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 824.152883][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:06:57 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:06:57 executing program 3: 04:06:57 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)}}], 0x1, 0x0) 04:06:57 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:06:57 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:57 executing program 3: 04:06:57 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:06:57 executing program 3: 04:06:57 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10}], 0x24}}], 0x1, 0x0) 04:06:57 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:06:57 executing program 3: [ 825.180030][ T28] audit: type=1804 audit(1596946017.460:62): pid=21056 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16114 res=1 errno=0 [ 825.202758][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 825.273306][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 826.233369][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 827.272977][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:00 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:07:00 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:00 executing program 3: 04:07:00 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10}], 0x24}}], 0x1, 0x0) 04:07:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:00 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:00 executing program 3: 04:07:00 executing program 5: r0 = socket$inet6(0xa, 0x40000080806, 0x0) bind$inet6(r0, &(0x7f000047b000)={0xa, 0x404e20, 0x0, @empty}, 0x1c) listen(r0, 0x400000001ffffffd) r1 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r2, &(0x7f0000005440)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[{0x10}], 0x24}}], 0x1, 0x0) 04:07:00 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:07:00 executing program 3: 04:07:00 executing program 5: [ 828.224128][ T28] audit: type=1804 audit(1596946020.510:63): pid=21075 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16177 res=1 errno=0 04:07:00 executing program 3: 04:07:00 executing program 5: [ 828.312754][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 828.323449][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 829.352780][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 830.403634][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:03 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:03 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:07:03 executing program 3: 04:07:03 executing program 5: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x5, [@fwd, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x4d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:03 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:03 executing program 3: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x9c, 0x9c, 0x5, [@union={0x0, 0x7, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @int, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{}, {}, {}, {}]}]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0xb9}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:03 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:07:03 executing program 5: bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x0, 0x4000000000080002, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socket$nl_audit(0x10, 0x3, 0x9) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x169, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) recvmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4091, 0x7ffff000}], 0x1}, 0x100) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[], 0x1000001bd) [ 831.226443][T21100] ptrace attach of "/root/syz-executor.5"[21096] was attempted by "/root/syz-executor.5"[21100] 04:07:03 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000200)=""/4084, 0xff4, 0x62, 0x0, 0x0) 04:07:03 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x105, 0x105, 0x4, [@var, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{}, {}, {}, {}]}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @fwd, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], '\x00'}, @array, @func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{}, {}, {}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x124}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 831.277123][ T28] audit: type=1804 audit(1596946023.560:64): pid=21097 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16122 res=1 errno=0 [ 831.300245][T21109] ptrace attach of "/root/syz-executor.3"[21106] was attempted by "/root/syz-executor.3"[21109] [ 831.351255][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:03 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, 0x0, 0x0, 0x62, 0x0, 0x0) [ 831.397933][T21117] ptrace attach of "/root/syz-executor.3"[21116] was attempted by "/root/syz-executor.3"[21117] [ 831.436954][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 832.473097][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 833.522756][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:06 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:06 executing program 3: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1bbd000000db1c00010000000000006d3a09ffc2c65400"}, 0x80) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd1, 0xd1, 0x4, [@var, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @fwd, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], '\x00'}, @array]}, {0x0, [0x0, 0x0]}}, 0x0, 0xf0}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) 04:07:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:06 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, 0x0, 0x0, 0x62, 0x0, 0x0) 04:07:06 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:06 executing program 5: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x64, 0x64, 0x5, [@union={0x0, 0x6, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}]}, @int]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x81}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:06 executing program 3: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000105804135000000000000109022400010000000009040000490300000009210000000122dc0109058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000140)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="0010b803"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, &(0x7f0000000100)={0x20, 0x21, 0x4, {0x4, 0x31, "8804"}}, &(0x7f0000000600)=ANY=[@ANYBLOB="00030400000004035204359268738c216b26f535c7a980768ac292aca1b7042f"], 0x0, &(0x7f0000000240)={0x0, 0x21, 0x9, {0x9, 0x21, 0x5, 0xfb, 0x1, {0x22, 0xf41}}}}, &(0x7f00000005c0)={0x2c, &(0x7f0000000300)={0x0, 0x7, 0xcf, "f448caf2ccf08f193236e38b143aa9e0e00d7dc178e8a93500b9c4092eb5aa6c099b02db19525151e9a5dde64341a78469fe0ef3421b723f215b33fc454ca9a60b498d8260998e5bf866d8fe0b03e9804e2a5d4a075e7394bd38805828a4d282c14768b06584af70b927eb77e000a0c13bde8ac63af627bbe230a66f8ae5f71bc3dd241941941ff762707159e78245cd561391d8ce69f4c43f7627664061cc3bc772f4597486a027df5cd1a9b3a395823f6fe0c6d396c906dc702f230d3b5e5853362dd9b054ae6645b6a98605bd1b"}, &(0x7f0000000400)={0x0, 0xa, 0x1}, &(0x7f0000000440)={0x0, 0x8, 0x1}, &(0x7f0000000480)={0x20, 0x1, 0xbb, "9157ff4586712a5222597b92248ec4277a0e1d529ebe056b1d4fec9e2fe0c59b58396aaca9b75b611a941072d456bb3cb72f44cef705153f37f97ebeeaeb017ec9b1a7fac4a48e884b094c69d62559e79079878e22ca1b05f176f013cc161163d906e45316930a488f65bd1d0af3bb8dfd213a5a3170e05c6f24ddbcfc38736c377d70505e7236bf50f4d7ddf11b7db8906ab80aaf959a2312c01550e5bd0e2663874d6626d8005f6eecbe5c547937c9418ac8846aa3ec25a26a99"}, &(0x7f0000000580)={0x20, 0x3, 0x1, 0x7}}) syz_open_dev$hiddev(0x0, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000080)='/dev/usb/hiddev#\x00', 0x2, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000000c0)='/dev/usb/hiddev#\x00', 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000840)={0x24, &(0x7f0000000680)={0x20, 0xe, 0xdd, {0xdd, 0xb, "cd18039f194e345c06569f27aa1f1fea0ec761622dea411eb08361f57fe22aba8ca1efb40af4a8f769d2b4fb3c3372a72add48027fe8b3326760ae2800cf06bd722525f3a58c84fabfabb20c4498448b50f52c6b8e5e5e0b47d82843e1108edee45e34c8c8f3fb1de36f7b33b47e0d38dd6bed7c71c9c4514ab3ba9ef34bc7e777832473d3f16ecb2aba4a73f3bee6ae26be81007851b89f4c43103d2abedb273e67b9a46d75349cbdda18d32936cc50b4008c59b2bc1f5d7a05ae6ce2a5fde82398cc4885c804c80aa7b53a225fdae1345b871fd1de281e85a393"}}, &(0x7f0000000780)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x3c0a}}, &(0x7f00000007c0)={0x0, 0x22, 0x17, {[@main=@item_4={0x3, 0x0, 0x8, "0ecd9836"}, @local=@item_4={0x3, 0x2, 0x2, "3fb3541d"}, @main=@item_012={0x2, 0x0, 0xa, "0f8d"}, @global=@item_4={0x3, 0x1, 0x3, "9a9aed7e"}, @local=@item_4={0x3, 0x2, 0x5, "077787c2"}]}}, &(0x7f0000000800)={0x0, 0x21, 0x9, {0x9, 0x21, 0x9402, 0x0, 0x1, {0x22, 0x6b2}}}}, &(0x7f00000009c0)={0x2c, &(0x7f0000000880)={0x20, 0xe, 0xd, "83305aafc4888d95bbec63b975"}, &(0x7f00000008c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000900)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000940)={0x20, 0x1, 0x2e, "46a3db839c7396c7d8a51e1b16c4f3f67630c4ab6308f9758e16d47a7a7819d44abe0f36c98494f16733e8b31cd5"}, &(0x7f0000000980)={0x20, 0x3, 0x1}}) ioctl$HIDIOCGCOLLECTIONINDEX(r1, 0x40184810, 0x0) [ 834.255379][T21135] ptrace attach of "/root/syz-executor.3"[21129] was attempted by "/root/syz-executor.3"[21135] [ 834.266662][T21134] ptrace attach of "/root/syz-executor.5"[21132] was attempted by "/root/syz-executor.5"[21134] 04:07:06 executing program 5: clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x5, [@int]}, {0x0, [0x0, 0x0, 0x0]}}, 0x0, 0x2d}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:06 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, 0x0, 0x0, 0x62, 0x0, 0x0) [ 834.295695][ T28] audit: type=1804 audit(1596946026.580:65): pid=21137 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16262 res=1 errno=0 04:07:06 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x0, 0x0, 0x0) 04:07:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:06 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000193c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xed, 0xed, 0x4, [@func_proto={0x0, 0x4, 0x0, 0xd, 0x0, [{}, {}, {}, {}]}, @func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{}, {}, {}]}, @fwd, @datasec={0x0, 0x6, 0x0, 0xf, 0x1, [{}, {}, {}, {}, {}, {}], '\x00'}, @func_proto={0x0, 0x6, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x10c}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r2, 0x40) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r2, 0x0, 0x0) [ 834.381867][T21148] ptrace attach of "/root/syz-executor.5"[21147] was attempted by "/root/syz-executor.5"[21148] [ 834.410456][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 834.489237][T21156] ptrace attach of "/root/syz-executor.5"[21154] was attempted by "/root/syz-executor.5"[21156] [ 834.548184][ T28] audit: type=1804 audit(1596946026.830:66): pid=21155 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16273 res=1 errno=0 [ 834.572910][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 835.602763][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 836.632774][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:09 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:09 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x0, 0x0, 0x0) 04:07:09 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x0, 0x0) pwritev(r0, 0x0, 0x0, 0x0, 0x0) 04:07:09 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:07:09 executing program 3: syz_emit_ethernet(0x3e, &(0x7f0000000140)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x33, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @local, @local}}}}}}, 0x0) 04:07:09 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:09 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000140)="11", 0x1, 0x0, 0x0, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000001200), 0x14) recvfrom$inet(r0, &(0x7f0000000200)=""/4084, 0xff4, 0x0, 0x0, 0x0) 04:07:09 executing program 3: r0 = socket(0x100000000011, 0x2, 0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000100)) 04:07:09 executing program 5: r0 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000b28000)=0x6) fcntl$setsig(r1, 0xa, 0x12) recvmmsg(r2, &(0x7f0000002bc0)=[{{0x0, 0xfffffffffffffd10, 0x0, 0x0, 0x0, 0xfffffffffffffde4}}], 0x40000fd, 0x0, 0x0) dup2(r1, r2) r3 = gettid() fcntl$setown(r2, 0x8, r3) tkill(r0, 0x16) [ 837.384920][ T28] audit: type=1804 audit(1596946029.670:67): pid=21166 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16239 res=1 errno=0 04:07:09 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) epoll_pwait(r1, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0, 0x0) 04:07:09 executing program 3: r0 = socket(0x100000000011, 0x2, 0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000100)) [ 837.431290][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:09 executing program 3: pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r0, 0x0, 0x4240a2a0) [ 837.675356][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 838.713109][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 839.762689][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) 04:07:12 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x800000805, 0x0) write$uinput_user_dev(r0, &(0x7f0000000100)={'syz1\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) 04:07:12 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x20}}, 0x0) 04:07:12 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:12 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f", 0x1}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:12 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x400000000000010, 0x3, 0x0) write(r3, &(0x7f00000000c0)="24000000200099f0003be90000ed190e020008160000100000ba108008000200", 0x20) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x24, 0x0, 0x0) [ 840.320536][T21197] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 840.357440][T21197] device veth3 entered promiscuous mode [ 840.373765][T21197] team0: Port device veth3 added [ 840.399582][ T28] audit: type=1804 audit(1596946032.680:68): pid=21200 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16240 res=1 errno=0 [ 840.456535][T21197] device veth3 left promiscuous mode [ 840.471187][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 840.473483][T21197] team0: Port device veth3 removed 04:07:12 executing program 4: r0 = socket(0x11, 0x800000003, 0x8) bind(r0, &(0x7f0000000280)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x58) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x76, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0xeb}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7fffffff}, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860ac5cf65ac618ded897489596eaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf93a1a7511bf746bec66ba", 0xfe6a, 0x20c49a, 0x0, 0x20c49a) 04:07:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x20}}, 0x0) 04:07:12 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, r2, 0x0, 0x80000000) [ 840.670875][T21225] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 840.707947][T21225] device veth3 entered promiscuous mode [ 840.720691][T21225] team0: Port device veth3 added [ 840.793203][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 840.813123][T21225] device veth3 left promiscuous mode [ 840.826425][ T28] audit: type=1804 audit(1596946033.110:69): pid=21230 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16373 res=1 errno=0 [ 840.848204][T21225] team0: Port device veth3 removed 04:07:13 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x20}}, 0x0) 04:07:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 841.005024][T21237] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 841.023792][T21237] device veth3 entered promiscuous mode [ 841.030855][T21237] team0: Port device veth3 added [ 841.085224][T21237] device veth3 left promiscuous mode [ 841.099501][T21237] team0: Port device veth3 removed [ 841.111892][ T28] audit: type=1804 audit(1596946033.400:70): pid=21243 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16373 res=1 errno=0 04:07:13 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newlink={0x20, 0x11, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r6}}, 0x20}}, 0x0) 04:07:13 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) [ 841.195441][T21252] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 841.224217][T21252] device veth3 entered promiscuous mode [ 841.230467][T21252] team0: Port device veth3 added 04:07:13 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 841.264354][T21252] device veth3 left promiscuous mode [ 841.270688][T21252] team0: Port device veth3 removed 04:07:13 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) [ 841.407397][T21269] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 841.425467][T21269] device veth3 entered promiscuous mode [ 841.433793][ T28] audit: type=1804 audit(1596946033.720:71): pid=21266 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16373 res=1 errno=0 [ 841.456780][T21269] team0: Port device veth3 added 04:07:13 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) [ 841.832486][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 842.882992][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) 04:07:15 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f", 0x1}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:15 executing program 4: r0 = socket(0x11, 0x800000003, 0x8) bind(r0, &(0x7f0000000280)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x58) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000040)=0x76, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0xeb}]}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7fffffff}, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(r1, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860ac5cf65ac618ded897489596eaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf93a1a7511bf746bec66ba", 0xfe6a, 0x20c49a, 0x0, 0x20c49a) 04:07:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:15 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:15 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) [ 843.366331][T21285] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 843.424937][T21293] device veth5 entered promiscuous mode [ 843.430822][T21293] team0: Port device veth5 added 04:07:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) 04:07:15 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) [ 843.462071][ T28] audit: type=1804 audit(1596946035.750:72): pid=21287 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16243 res=1 errno=0 [ 843.512116][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 843.544835][T21301] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 843.568323][T21301] device veth7 entered promiscuous mode [ 843.577550][T21301] team0: Port device veth7 added 04:07:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 04:07:15 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:15 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:16 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) [ 843.663084][T21312] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 843.680480][T21312] device veth9 entered promiscuous mode [ 843.688268][T21312] team0: Port device veth9 added [ 843.739874][T21322] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 843.756673][T21322] device veth11 entered promiscuous mode [ 843.763161][T21322] team0: Port device veth11 added [ 843.912767][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 844.963874][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 845.993196][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:18 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f", 0x1}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:18 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:18 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:18 executing program 4: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xcd, 0xcd, 0x7, [@datasec={0x0, 0x1, 0x0, 0xf, 0x1, [{}], '\x00'}, @union={0x0, 0x7, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @int]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0]}}, 0x0, 0xef}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0xffffffffffffff3a}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 846.396926][T21336] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:18 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) [ 846.442293][T21336] device veth13 entered promiscuous mode [ 846.449711][T21336] team0: Port device veth13 added 04:07:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:18 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 846.551446][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 847.032771][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 848.072867][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 849.112786][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:21 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, 0x0, 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:21 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:21 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:21 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000003600)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000005bc0)="d3", 0x1}], 0x1}, 0x0) 04:07:21 executing program 4: mkdir(&(0x7f0000000080)='./file0\x00', 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0}, 0x40) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2000020000b85d, 0x187f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000480)='nfs\x00', 0x0, &(0x7f0000000000)) 04:07:21 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, 0x0, 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:21 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) [ 849.445160][T21374] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, 0x0, 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 849.518269][T21389] NFS: Device name not specified 04:07:21 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:21 executing program 4: r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000280)="a9", 0x1, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000001b80)='asymmetric\x00', &(0x7f0000000100)=@keyring={'key_or_keyring:', r0}) 04:07:21 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 849.575209][T21400] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 849.592691][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 850.162949][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:22 executing program 4: r0 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000280)="a9", 0x1, 0xffffffffffffffff) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000001b80)='asymmetric\x00', &(0x7f0000000100)=@keyring={'key_or_keyring:', r0}) 04:07:22 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:22 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:22 executing program 4: [ 850.285883][T21420] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:22 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:22 executing program 4: 04:07:22 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:22 executing program 4: [ 850.440833][T21447] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:23 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:23 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:23 executing program 4: 04:07:23 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:23 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) shutdown(0xffffffffffffffff, 0x20000000000001) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) [ 851.115065][T21458] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:23 executing program 4: [ 851.182600][T21469] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 851.204566][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 851.326300][ T28] audit: type=1804 audit(1596946043.610:73): pid=21464 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16312 res=1 errno=0 [ 852.232519][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 852.631256][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 853.272853][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:25 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:25 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:25 executing program 4: 04:07:25 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:25 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:25 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x0) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:25 executing program 4: 04:07:25 executing program 4: [ 853.440934][T21485] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:25 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:25 executing program 4: 04:07:25 executing program 4: 04:07:25 executing program 4: [ 853.585618][T21503] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 853.640815][ T28] audit: type=1804 audit(1596946045.920:74): pid=21495 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16236 res=1 errno=0 [ 854.313197][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 855.362717][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 855.671213][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 856.393047][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:28 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:28 executing program 4: 04:07:28 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x10, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:28 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:28 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:28 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x0) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:28 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@private0, 0xa4ffffff}, 0x20) [ 856.483005][T21519] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:28 executing program 4: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000baa000/0x3000)=nil, 0x3000, 0x0, 0x31, 0xffffffffffffffff, 0x0) 04:07:28 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:28 executing program 4: 04:07:28 executing program 4: 04:07:28 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 856.698710][ T28] audit: type=1804 audit(1596946048.980:75): pid=21531 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16255 res=1 errno=0 [ 857.432748][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.472774][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 858.711248][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:31 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:31 executing program 4: 04:07:31 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:31 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:31 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:31 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x0) recvmmsg(r1, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:31 executing program 4: 04:07:31 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 859.512724][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:31 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:31 executing program 4: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="2c0000001600ff070ccce689ee91379d8367"], 0x2c}}, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) sendmmsg$alg(r0, &(0x7f0000000140), 0x4924b68, 0x0) 04:07:31 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 859.600727][T21557] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:31 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f00000001c0)=0x9, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @broadcast}, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f0000000080)=[{&(0x7f0000000000)="39000000130009006900000000000000ab0080001f0000004600010707000014190001001000000800005068000000000000ef38bf461e59d7", 0x39}], 0x1) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 859.722303][T21572] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 859.764098][ T12] bridge0: port 2(bridge_slave_1) entered disabled state 04:07:32 executing program 4: socket$inet6(0xa, 0x1, 0x0) unshare(0x6c060000) socket$inet6(0x10, 0x0, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000100)={'lo\x00', {0x2, 0x0, @local}}) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='dctcp\x00', 0x6) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x0, @local}, 0x10) 04:07:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 859.810507][T21583] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 859.830350][ T28] audit: type=1804 audit(1596946052.110:76): pid=21560 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=15904 res=1 errno=0 04:07:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 859.874402][T21589] IPVS: ftp: loaded support on port[0] = 21 [ 859.927359][T21607] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 859.951263][T11912] tipc: TX() has been purged, node left! [ 860.078776][ T28] audit: type=1804 audit(1596946052.360:77): pid=21622 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16271 res=1 errno=0 04:07:32 executing program 3: getpid() semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0) 04:07:32 executing program 4: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x31, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000def000/0xe000)=nil, 0xe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) 04:07:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 860.390437][T21630] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 860.513519][ T28] audit: type=1804 audit(1596946052.800:78): pid=21638 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16251 res=1 errno=0 [ 860.553260][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 861.604117][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 861.751214][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:34 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:34 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r1, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) 04:07:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(0xffffffffffffffff, &(0x7f00000075c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001540)=ANY=[@ANYRESOCT], 0x210}}], 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x1, &(0x7f0000000000)=[{0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000001e00), 0x3fffffffffffe36, 0x0) 04:07:34 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:34 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:34 executing program 3: getpid() semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0) [ 862.633256][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 862.670356][T21649] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:35 executing program 4: unshare(0x6c060000) r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f00000001c0)="1c0000001200050f0c1000000049b23e9b200a00080001c000000001", 0x1c, 0x0, 0x0, 0x0) recvfrom$inet6(r0, &(0x7f0000000400)=""/4096, 0x1000, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[@ANYBLOB='\x00'], 0x1}}, 0x0) r1 = socket$inet6(0x10, 0x2, 0x0) sendto$inet6(r1, &(0x7f00000000c0)="1ba0000010001d0200fdc5cbdd041d8e828003000000000001a7960fab0fc8da78031c6660b08f00003f71aced466b4644434a88fed7d75725e1069e42dc4b3844e5fb82bb02fec770967c740c00000000d02830b5a4c01a92317320f0c0a5adb7b5b8bf255f1a8dffa8", 0xfe0b, 0x40800, 0x0, 0xffffffffffffff95) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000100)={'lo\x00', {0x2, 0x0, @local}}) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000040)=0x72, 0x4) bind$inet(r3, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='bbr\x00', 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000600)=0x1801, 0x4) sendmmsg(r3, &(0x7f00000075c0)=[{{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000001540)="f685a288c84ec47e44864a1ae8659eb07e2f26d6c91f25104caa92162d00eba54e68088986aa066431445c5412f138db82e75760578858a6259283c4958956ef0217ed787072bbfb32de603a48f306d3e6346b7c9328b5b8f805a4dc61538e3bc88cdc349dabf717313af026ca16b9669abd", 0x72}, {&(0x7f0000001780)="cfd063443cdc8585517304d96a713e7fb6273277543dd8cc3f1f2506e70e28180a2d2cf93495d7ef3a25d4b8a05b98a627ae8e98ed6f0fa2c78dd9ce1b9ef81f7c9274c78b728e5032c69cf8ebe9d42dd43d2f19d09e91a71f81c3b192d96cc627241b95ec8fbb6c71f603e0d07fcb5a6e07585208dd2ac721d2fdab2c29411f66ec7cca1e1760a2d6ca8af4ec79cae5c78430ea32a266856c8260e4de581475abdd2153aa8fea34789320ee2514903088dfd546a136d40646857b851b65a7a918c58881be75d5d71239c7698d7bdb3f879f49436bbbd87586553407860397d48842400126f8703ddc55ba", 0xeb}, {&(0x7f0000000000)="0c06251f00000000461ace70236fa0348db1147c2390dbe06de04e35eb0265000000", 0x22}, {&(0x7f0000000300)="cd96bdb578810f358b2aaaf2bacafe0e46d11b73fdeffa5726afc6a69f941fc2599736bb61d60c3c812d5418a5ea3ae461b9018b039a4f69e2fdb082765b01000000d10caad94fd56acc522d8ccc79457da8b9fd8a3c83e184d7ec12809c5ee6b6e151ac4607a4f00b038bb363c37a", 0x6f}], 0x4}}, {{0x0, 0x0, &(0x7f0000001fc0)=[{&(0x7f0000001e00)="8f093e579a0ad13bbfa6dfcf5f92e9137fcecd3422187adb2613d1cb2a10ac11024822cad9f16a8b47c13f163ae0a1beeec0926acde449fbfe0e5541045b2c313750354dae2754d46379a01c17bd3c8c6f824123ab7b626a841f", 0x5a}], 0x1}}], 0x2, 0x0) sendto$inet(r3, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860005cf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 04:07:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:35 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r1, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) [ 862.756200][T21667] IPVS: ftp: loaded support on port[0] = 21 [ 862.784373][T21673] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 862.808371][T21681] netlink: 40027 bytes leftover after parsing attributes in process `syz-executor.4'. [ 862.846270][T21681] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 04:07:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:35 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r1, 0x20000000000001) recvmmsg(0xffffffffffffffff, &(0x7f0000001f4c), 0x209a6b90bb7b17, 0x0, 0x0) [ 862.875491][T21681] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 862.949851][T17225] tipc: TX() has been purged, node left! [ 863.673257][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 864.713075][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 864.791243][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:37 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xae}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:37 executing program 4: r0 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000080)) r1 = socket(0x10, 0x80002, 0x0) mmap(&(0x7f00009db000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) mmap$xdp(&(0x7f0000b02000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x11, r0, 0x0) 04:07:37 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:37 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:37 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 04:07:37 executing program 3: getpid() semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0) 04:07:38 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_opts(r0, 0x0, 0x1a, 0x0, &(0x7f00000000c0)) [ 865.704247][T21718] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:38 executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000a40)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d8, 0x0, 0x2b8, 0x0, 0x0, 0xff000000, 0x308, 0x3a8, 0x3a8, 0x308, 0x3a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1f8, 0x218, 0x0, {}, [@common=@inet=@hashlimit1={{0x58, 'hashlimit\x00'}, {'sit0\x00', {0x0, 0x0, 0x9, 0x0, 0x16030000, 0x5, 0x13}}}, @common=@inet=@recent0={{0xf8, 'recent\x00'}, {0x0, 0x0, 0x0, 0x0, 'syz1\x00'}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x438) 04:07:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 865.753222][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 865.753993][ T28] audit: type=1804 audit(1596946058.040:79): pid=21716 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16251 res=1 errno=0 04:07:38 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 04:07:38 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) accept4(r0, 0x0, 0x0, 0x0) [ 865.843095][T21736] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 865.857388][T21737] xt_hashlimit: max too large, truncated to 1048576 04:07:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 865.962713][T21749] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 866.793193][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 867.831286][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 867.839488][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:40 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000040)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) shutdown(r2, 0x20000000000001) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) 04:07:40 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x0, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="850000004f000000350000000000000085000000070000009500000000000000f4670880271e3503200ffa95a2c8c037c5a142dfa8d76287066c5197fabd5f7010e8c226b737126ea6f7dc39cd34d5aeed8d38e65cb6e2aff5dbc4d10955dde54704d25c79949c0800000000005b000000c09cc28de194f44842a5f0a8320e13822c8707f8612c10b100000000b0d3712c7e93363af3c075ff1e23166a32d95433bb755af3d576090c4867a7b6393e366c6386d5ec7209d031eb7443d7f40f3012e9576e51a7f550afc852003b2f7846c744ae06f3c037102124d85cec074c6949e1d76d067a97f5fe47fe5f17fdab800f4104dbaba46aa43a815b1e5c6d1d224b64be6c4d7f47ef21eb7e46f95aba0b7eb6baaa4a9779f8555eaea768c1f2c221c110ef05000082ab76f593d928cf95846be7277c04b8c5324812696a623cd8a4f8dc8dcba00b1b2d2547c45b0c52087b5efabf8496b9a951667dd58ea0327b56c0ebfb19a3426833564809000000328c10752a42dce52fbd8c1452b651ebf942788cebd6f7a2c087907b2744419a2f238f173d0cd46dafc6e95500f53e5309ec91d83cf4fbd775d9c07d8d591a4dac60ff000000b78863e629b3b200000000000000000000000000000000000000b5e35a3e91f6a2c328f6095bc4d08370a5eae0c5545768268df945e9c3c75893b300065741a39c3eff0be83e7500eacd4ea00625c99b9402c55bdf940e9fd4d480300e8abe198b3e6cca3b375bdc5488a35a146ec575a4e7db29662b53cf87f6dfe0558b725fb3d935c18278a9f36948c7079d4177d4fab7009c85c2ddff607e4f0e76de4a238627d4b6e4937ad014467f25ae891a5cb791a6d0af8d013fb3b7703db2a28f46f5f0a6291f98062c89b8c4a3ada08a7b49ba59855d5abbb73a8e7e41fd7b8624642af785cedf977dc0b8fe35ad284170de78102e898b21b905bb610000000000c31a003a16b82b819da9cb57b0ba69dff0b246f0e7c023616f1fe7b07294f69053920dd439a7f830b4cbdc03775376fd254396ab1a2d9dea2de0c2120b098b3a3129a360f497f449a1a9b4629c49c2b8a248d9383a5d4459949053473a25c9d4f5184d1646010f3e35ee361347478fbd3d62e8560d5b1e709e99cee3c067eb2252bcb7f41abc4efa59aafe51e0f19a906ae727afae91c113c5c6ad84b569d7f92bda07f8056b56b63f292e15bd9291ff6414b92e94eb56d96556cb86ea9bc0d9290608f5544e92275e75c139c441aee60039f914296ef5c4a3a5fc149b1a8b7309b1f4ff"], &(0x7f0000000140)='GPL\x00', 0x0, 0x3f, &(0x7f0000000180)=""/153, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffc1a}, 0x15) 04:07:40 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xae}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:40 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:40 executing program 3: r0 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 04:07:41 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x32, &(0x7f0000000040)={@private0}, 0x20) [ 868.723395][T21761] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:41 executing program 4: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r0, 0x4058534c, &(0x7f0000000040)) [ 868.776836][ T28] audit: type=1804 audit(1596946061.060:80): pid=21760 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16273 res=1 errno=0 04:07:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:41 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 868.819959][T21778] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:41 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0xa, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0x848}, {0x80000006, 0x0, 0x0, 0x9}]}, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(r3, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) [ 868.873459][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 868.889987][T21788] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 868.910386][ T28] audit: type=1804 audit(1596946061.190:81): pid=21789 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/588/bus" dev="sda1" ino=16311 res=1 errno=0 [ 868.945853][ T28] audit: type=1800 audit(1596946061.190:82): pid=21789 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16311 res=0 errno=0 04:07:41 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 868.989678][T21797] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 869.005829][ T28] audit: type=1804 audit(1596946061.290:83): pid=21795 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/588/bus" dev="sda1" ino=16311 res=1 errno=0 [ 869.039543][ T28] audit: type=1800 audit(1596946061.290:84): pid=21795 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16311 res=0 errno=0 [ 869.066486][ T28] audit: type=1804 audit(1596946061.350:85): pid=21805 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/589/bus" dev="sda1" ino=15984 res=1 errno=0 [ 869.100792][ T28] audit: type=1800 audit(1596946061.350:86): pid=21805 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15984 res=0 errno=0 [ 869.914083][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.871491][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.952766][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:44 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xae}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, 0x0, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:44 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:07:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, 0x0, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:44 executing program 3: r0 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 04:07:44 executing program 4: socketpair(0xf, 0x3, 0x0, &(0x7f0000000040)) 04:07:44 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000040)={{0x0, @loopback, 0x0, 0x0, 'ovf\x00'}, {@multicast1}}, 0x44) [ 871.758453][ T28] audit: type=1804 audit(1596946064.040:87): pid=21815 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/590/bus" dev="sda1" ino=16252 res=1 errno=0 [ 871.799985][T21814] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 871.833369][T21829] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:0 04:07:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:44 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:07:44 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r0, &(0x7f0000000040)="1c0000001200050f0c1000000049b276062f763e08000a000600ffff", 0x1c, 0x0, 0x0, 0x0) write$FUSE_ENTRY(0xffffffffffffffff, 0x0, 0x0) [ 871.836431][ T28] audit: type=1800 audit(1596946064.040:88): pid=21815 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16252 res=0 errno=0 [ 871.865827][T21829] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:0 [ 871.911600][T21833] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 871.913809][ T28] audit: type=1804 audit(1596946064.180:89): pid=21818 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16271 res=1 errno=0 04:07:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/adsp1\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, 0x0) close(r0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/renderD128\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, 0x0) 04:07:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 871.973709][ T28] audit: type=1804 audit(1596946064.260:90): pid=21843 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/591/bus" dev="sda1" ino=16311 res=1 errno=0 [ 872.002975][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 872.022822][ T28] audit: type=1800 audit(1596946064.260:91): pid=21843 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16311 res=0 errno=0 [ 872.040482][T21848] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 873.032629][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 873.911305][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 874.083912][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:47 executing program 2: creat(&(0x7f00000002c0)='./bus\x00', 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) lseek(r3, 0x0, 0x4) 04:07:47 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 04:07:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, 0x0}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:47 executing program 3: r0 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 04:07:47 executing program 4: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/unix\x00') preadv(r1, &(0x7f0000000500), 0x37d, 0x0, 0x0) [ 874.841942][T21860] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:47 executing program 2: creat(&(0x7f00000002c0)='./bus\x00', 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) lseek(r3, 0x0, 0x4) 04:07:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 874.872448][ T28] audit: type=1804 audit(1596946067.160:92): pid=21862 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/592/bus" dev="sda1" ino=16271 res=1 errno=0 04:07:47 executing program 4: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getsockopt$nfc_llcp(r0, 0x118, 0x0, 0x0, 0x74a000) 04:07:47 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/adsp1\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000000)) close(r0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/renderD128\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_CAP(0xffffffffffffffff, 0xc010640c, 0x0) [ 874.947974][ T28] audit: type=1800 audit(1596946067.160:93): pid=21862 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16271 res=0 errno=0 [ 874.973893][ T28] audit: type=1804 audit(1596946067.220:94): pid=21863 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=15995 res=1 errno=0 04:07:47 executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000207d1ebe2d40000000000109022400010000000009040000010301000009210000000122050009058103"], 0x0) syz_usb_disconnect(r0) syz_usb_disconnect(0xffffffffffffffff) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000380)={0x24, 0x0, 0x0, &(0x7f0000000340)={0x0, 0x22, 0x5, {[@global=@item_4={0x3, 0x1, 0x7, "f967e6f1"}]}}, 0x0}, 0x0) 04:07:47 executing program 2: creat(&(0x7f00000002c0)='./bus\x00', 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) lseek(r3, 0x0, 0x4) [ 874.999762][T21883] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 875.024537][ T28] audit: type=1804 audit(1596946067.280:95): pid=21880 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/593/bus" dev="sda1" ino=16032 res=1 errno=0 04:07:47 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8400fffffff8) lseek(0xffffffffffffffff, 0x0, 0x4) [ 875.050747][ T28] audit: type=1800 audit(1596946067.280:96): pid=21880 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16032 res=0 errno=0 04:07:47 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8400fffffff8) lseek(0xffffffffffffffff, 0x0, 0x4) [ 875.123314][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 876.162783][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 876.951430][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 877.193541][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:50 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:50 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8400fffffff8) lseek(0xffffffffffffffff, 0x0, 0x4) 04:07:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, 0x0}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:50 executing program 3: r0 = getpid() r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:50 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r1}}, 0x10) 04:07:50 executing program 4: socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/unix\x00') preadv(r0, &(0x7f0000000500), 0x37d, 0x0, 0x0) 04:07:50 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 877.898273][T21912] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:50 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 877.950048][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 877.950140][ T28] audit: type=1804 audit(1596946070.230:99): pid=21906 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16311 res=1 errno=0 04:07:50 executing program 4: getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000380)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0xf2a}, 0x14) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0x0, 0xffffffff}) ioctl$VFIO_IOMMU_GET_INFO(r1, 0x3b70, 0x0) 04:07:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:50 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 877.979204][ T28] audit: type=1804 audit(1596946070.230:100): pid=21925 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/598/bus" dev="sda1" ino=16373 res=1 errno=0 [ 878.035443][T21932] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 878.050787][ T28] audit: type=1800 audit(1596946070.230:101): pid=21925 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16373 res=0 errno=0 [ 878.072711][ T28] audit: type=1804 audit(1596946070.300:102): pid=21928 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/599/bus" dev="sda1" ino=16272 res=1 errno=0 [ 878.100221][ T28] audit: type=1800 audit(1596946070.300:103): pid=21928 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16272 res=0 errno=0 [ 878.125483][ T28] audit: type=1804 audit(1596946070.380:104): pid=21935 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/600/bus" dev="sda1" ino=16373 res=1 errno=0 [ 878.150695][ T28] audit: type=1800 audit(1596946070.380:105): pid=21935 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16373 res=0 errno=0 [ 878.233118][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 879.272761][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 879.991291][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 880.313356][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:53 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:53 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:07:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000240)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:53 executing program 4: getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000380)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0xf2a}, 0x14) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0x0, 0xffffffff}) ioctl$VFIO_IOMMU_GET_INFO(r1, 0x3b70, 0x0) 04:07:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, 0x0}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:53 executing program 3: r0 = getpid() r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) [ 880.928260][T21948] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 880.942014][ T28] audit: type=1804 audit(1596946073.230:106): pid=21953 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/601/bus" dev="sda1" ino=16246 res=1 errno=0 04:07:53 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:07:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000240)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:53 executing program 4: getpid() sched_setscheduler(0x0, 0x5, &(0x7f0000000380)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0xf2a}, 0x14) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0x0, 0xffffffff}) ioctl$VFIO_IOMMU_GET_INFO(r1, 0x3b70, 0x0) [ 880.978579][ T28] audit: type=1800 audit(1596946073.230:107): pid=21953 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16246 res=0 errno=0 [ 881.003694][ T28] audit: type=1804 audit(1596946073.280:108): pid=21951 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16255 res=1 errno=0 04:07:53 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {r3}}, 0x10) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) 04:07:53 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 881.095384][T21970] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:07:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, 0x0, &(0x7f0000000240)) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 881.210202][T21983] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 881.364075][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 882.394036][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 883.031286][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 883.442952][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:56 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r2 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r2, 0x0, 0x8400fffffff8) lseek(r2, 0x0, 0x4) 04:07:56 executing program 4: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000000000000000000080000000000a20000000000a01000000000000000000000000000900010073797a300000000070000000120a0100000c34010400008000000000040004800900020073797a30000000000900010073797a3000000000080003400000000022000200b76312c411737903"], 0xb8}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x8}, 0x0) 04:07:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:56 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={0x0, 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:56 executing program 3: r0 = getpid() r1 = perf_event_open(0x0, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) [ 883.957464][T21995] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 883.964339][T21998] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 883.979671][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 883.979684][ T28] audit: type=1804 audit(1596946076.260:113): pid=21999 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/604/bus" dev="sda1" ino=16077 res=1 errno=0 [ 884.036057][T21998] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 884.043587][ T28] audit: type=1800 audit(1596946076.260:114): pid=21999 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16077 res=0 errno=0 [ 884.068592][T22012] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 04:07:56 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r2 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r2, 0x0, 0x8400fffffff8) lseek(r2, 0x0, 0x4) 04:07:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:56 executing program 4: getpid() sched_setscheduler(0x0, 0x0, &(0x7f0000000380)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0x0, 0xffffffff}) [ 884.071934][ T28] audit: type=1804 audit(1596946076.330:115): pid=22007 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16082 res=1 errno=0 04:07:56 executing program 4: getpid() sched_setscheduler(0x0, 0x0, &(0x7f0000000380)) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0x0, 0xffffffff}) [ 884.173050][T22018] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 884.185341][ T28] audit: type=1804 audit(1596946076.480:116): pid=22019 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/605/bus" dev="sda1" ino=16099 res=1 errno=0 04:07:56 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/adsp1\x00', 0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f00000001c0)) ioctl$SNDCTL_DSP_SPEED(0xffffffffffffffff, 0xc0045002, &(0x7f0000000080)) close(r0) r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dri/renderD128\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000040)={0x6}) dup(0xffffffffffffffff) 04:07:56 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r2 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r2, 0x0, 0x8400fffffff8) lseek(r2, 0x0, 0x4) [ 884.245191][ T28] audit: type=1800 audit(1596946076.500:117): pid=22019 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16099 res=0 errno=0 04:07:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:56 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f00000002c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast2={0xff, 0x4}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) 04:07:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={0x0, 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) [ 884.356049][T22034] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 884.381061][ T28] audit: type=1804 audit(1596946076.660:118): pid=22037 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/606/bus" dev="sda1" ino=15986 res=1 errno=0 [ 884.413819][ T28] audit: type=1800 audit(1596946076.660:119): pid=22037 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15986 res=0 errno=0 [ 884.473697][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 884.483434][ T28] audit: type=1804 audit(1596946076.770:120): pid=22041 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16082 res=1 errno=0 [ 885.513005][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 886.071289][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 886.561331][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:07:59 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:07:59 executing program 4: r0 = socket(0x840000000002, 0x3, 0x80) sendmmsg$inet(r0, &(0x7f00000006c0)=[{{&(0x7f0000000040), 0x10, 0x0}}], 0x1, 0x0) 04:07:59 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:07:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={0x0, 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:07:59 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:07:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 886.992576][ T28] audit: type=1804 audit(1596946079.280:121): pid=22051 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/607/bus" dev="sda1" ino=16134 res=1 errno=0 04:07:59 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f0000000000)={0xb, 0x10, 0xfa00, {0x0, 0xffffffffffffffff, 0x800}}, 0x18) 04:07:59 executing program 4: r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000380)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000240)='./file1\x00', 0x0) chdir(&(0x7f00000002c0)='./bus\x00') openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000140)='cgroup.type\x00', 0x2, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0xf2a}, 0x14) ioctl$FITRIM(r1, 0xc0185879, &(0x7f00000000c0)={0x0, 0xffffffff}) ioctl$VFIO_IOMMU_GET_INFO(r1, 0x3b70, 0x0) 04:07:59 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 887.076501][ T28] audit: type=1800 audit(1596946079.280:122): pid=22051 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16134 res=0 errno=0 04:07:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:07:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 887.592898][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 888.643651][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 889.111305][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 889.672942][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:02 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:02 executing program 4: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$nfc_llcp(r0, 0x118, 0x0, 0x0, 0x0) 04:08:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:02 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:02 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:02 executing program 4: 04:08:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 890.040957][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 890.040970][ T28] audit: type=1804 audit(1596946082.320:126): pid=22088 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/609/bus" dev="sda1" ino=16246 res=1 errno=0 04:08:02 executing program 4: 04:08:02 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 890.084868][ T28] audit: type=1804 audit(1596946082.370:127): pid=22085 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16251 res=1 errno=0 04:08:02 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 890.125010][ T28] audit: type=1800 audit(1596946082.370:128): pid=22088 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16246 res=0 errno=0 04:08:02 executing program 4: [ 890.253190][ T28] audit: type=1804 audit(1596946082.540:129): pid=22103 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/610/bus" dev="sda1" ino=16209 res=1 errno=0 [ 890.278098][ T28] audit: type=1800 audit(1596946082.540:130): pid=22103 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16209 res=0 errno=0 [ 890.722685][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 891.753085][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 892.151289][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 892.802922][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:05 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:05 executing program 4: 04:08:05 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:05 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:05 executing program 4: [ 893.066385][ T28] audit: type=1804 audit(1596946085.350:131): pid=22113 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/611/bus" dev="sda1" ino=16267 res=1 errno=0 04:08:05 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:05 executing program 2: r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:05 executing program 4: 04:08:05 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 893.110791][ T28] audit: type=1800 audit(1596946085.350:132): pid=22113 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16267 res=0 errno=0 [ 893.136769][ T28] audit: type=1804 audit(1596946085.420:133): pid=22109 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16311 res=1 errno=0 [ 893.194184][ T28] audit: type=1804 audit(1596946085.430:134): pid=22122 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/612/bus" dev="sda1" ino=16272 res=1 errno=0 [ 893.250383][ T28] audit: type=1800 audit(1596946085.430:135): pid=22122 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16272 res=0 errno=0 [ 893.832674][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 894.882536][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 895.191298][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 895.922681][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:08 executing program 2: r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:08 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:08 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:08 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:08 executing program 4: 04:08:08 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:08 executing program 4: 04:08:08 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 896.099546][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 896.099599][ T28] audit: type=1804 audit(1596946088.380:138): pid=22137 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/614/bus" dev="sda1" ino=16255 res=1 errno=0 04:08:08 executing program 4: 04:08:08 executing program 2: r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:08 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 896.162683][ T28] audit: type=1800 audit(1596946088.410:139): pid=22137 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16255 res=0 errno=0 04:08:08 executing program 4: [ 896.224307][ T28] audit: type=1804 audit(1596946088.440:140): pid=22134 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16273 res=1 errno=0 [ 896.238978][T22151] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:08 executing program 4: [ 896.260885][ T28] audit: type=1804 audit(1596946088.540:141): pid=22150 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/615/bus" dev="sda1" ino=16312 res=1 errno=0 [ 896.298461][ T28] audit: type=1800 audit(1596946088.540:142): pid=22150 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16312 res=0 errno=0 [ 896.963890][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 897.993500][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 898.231269][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 899.033117][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:11 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:11 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:11 executing program 2: r0 = creat(0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:11 executing program 4: 04:08:11 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:11 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) [ 899.147698][ T28] audit: type=1804 audit(1596946091.430:143): pid=22162 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/616/bus" dev="sda1" ino=16269 res=1 errno=0 [ 899.150865][T22163] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:11 executing program 4: 04:08:11 executing program 2: r0 = creat(0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:11 executing program 4: [ 899.177787][ T28] audit: type=1800 audit(1596946091.430:144): pid=22162 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16269 res=0 errno=0 04:08:11 executing program 2: r0 = creat(0x0, 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:11 executing program 4: [ 899.246930][ T28] audit: type=1804 audit(1596946091.530:145): pid=22161 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16252 res=1 errno=0 04:08:11 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 899.288226][ T28] audit: type=1804 audit(1596946091.530:146): pid=22171 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/617/bus" dev="sda1" ino=15775 res=1 errno=0 [ 899.342063][T22178] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 899.350640][ T28] audit: type=1800 audit(1596946091.540:147): pid=22171 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15775 res=0 errno=0 [ 900.082734][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 901.122492][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 901.271404][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:14 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:14 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:14 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:14 executing program 4: 04:08:14 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:14 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) [ 902.158227][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 902.178500][T22185] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 902.200984][ T28] kauditd_printk_skb: 2 callbacks suppressed 04:08:14 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:14 executing program 4: [ 902.200997][ T28] audit: type=1804 audit(1596946094.480:150): pid=22188 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/619/bus" dev="sda1" ino=16311 res=1 errno=0 04:08:14 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:14 executing program 4: 04:08:14 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 902.263036][ T28] audit: type=1800 audit(1596946094.520:151): pid=22188 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16311 res=0 errno=0 [ 902.266341][T22196] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 902.291226][ T28] audit: type=1804 audit(1596946094.540:152): pid=22184 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16251 res=1 errno=0 04:08:14 executing program 4: [ 902.372607][ T28] audit: type=1804 audit(1596946094.630:153): pid=22201 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/620/bus" dev="sda1" ino=16255 res=1 errno=0 [ 902.376195][T22202] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 902.425570][ T28] audit: type=1800 audit(1596946094.630:154): pid=22201 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16255 res=0 errno=0 [ 903.192737][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 904.242547][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 904.311472][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:17 executing program 4: 04:08:17 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(0x0, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:17 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:17 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f00000000000002800"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:17 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:17 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:17 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:17 executing program 4: 04:08:17 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f00000000000002800"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 905.209377][ T28] audit: type=1804 audit(1596946097.490:155): pid=22211 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/621/bus" dev="sda1" ino=16255 res=1 errno=0 04:08:17 executing program 4: [ 905.271872][ T28] audit: type=1800 audit(1596946097.490:156): pid=22211 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16255 res=0 errno=0 [ 905.300144][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:17 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f00000000000002800"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 905.331570][ T28] audit: type=1804 audit(1596946097.580:157): pid=22217 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/622/bus" dev="sda1" ino=16079 res=1 errno=0 04:08:17 executing program 4: 04:08:17 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c0001"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:17 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 905.385127][ T28] audit: type=1800 audit(1596946097.580:158): pid=22217 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16079 res=0 errno=0 [ 905.416674][ T28] audit: type=1804 audit(1596946097.600:159): pid=22221 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16176 res=1 errno=0 [ 905.447072][T22230] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 906.323166][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 907.351835][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 907.360161][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:20 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:20 executing program 4: 04:08:20 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:20 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c0001"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:20 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:20 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:20 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c0001"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 908.280376][T22239] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 908.303762][ T28] kauditd_printk_skb: 2 callbacks suppressed [ 908.303775][ T28] audit: type=1804 audit(1596946100.590:162): pid=22242 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/624/bus" dev="sda1" ino=16312 res=1 errno=0 04:08:20 executing program 4: 04:08:20 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c0001007665"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:20 executing program 4: [ 908.364972][T22249] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 908.403052][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:20 executing program 4: [ 908.429465][T22253] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 908.433960][ T28] audit: type=1800 audit(1596946100.630:163): pid=22242 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16312 res=0 errno=0 04:08:20 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c0001007665"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 908.478635][ T28] audit: type=1804 audit(1596946100.640:164): pid=22241 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16269 res=1 errno=0 [ 908.529675][T22258] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 909.432790][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 910.391232][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 910.472930][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:23 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:23 executing program 4: 04:08:23 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:23 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c0001007665"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:23 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:23 executing program 4: 04:08:23 executing program 4: [ 911.321451][T22267] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 911.336511][ T28] audit: type=1804 audit(1596946103.620:165): pid=22268 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/625/bus" dev="sda1" ino=16237 res=1 errno=0 04:08:23 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c000100766574"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 911.437835][ T28] audit: type=1800 audit(1596946103.650:166): pid=22268 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16237 res=0 errno=0 04:08:23 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x10, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x61, 0x11, 0x2c}, [@func={0x85, 0x0, 0x1, 0xf00, 0x2}, @call, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0}, 0x70) 04:08:23 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 911.494255][ T28] audit: type=1804 audit(1596946103.710:167): pid=22265 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16252 res=1 errno=0 [ 911.509618][T22282] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 911.526269][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:23 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c000100766574"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 911.666499][ T28] audit: type=1804 audit(1596946103.950:168): pid=22290 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/626/bus" dev="sda1" ino=15889 res=1 errno=0 [ 911.702269][T22288] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 911.726628][ T28] audit: type=1800 audit(1596946103.950:169): pid=22290 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15889 res=0 errno=0 [ 912.553009][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.431216][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.439753][ T7] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.448361][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.456839][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 913.602672][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:26 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:26 executing program 4: r0 = socket$kcm(0xa, 0x2, 0x73) close(r0) 04:08:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:26 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:26 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c000100766574"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:26 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:26 executing program 4: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x100002, 0x0) write$cgroup_int(r1, &(0x7f0000000200), 0x400086) write$cgroup_type(r2, &(0x7f0000000180)='threaded\x00', 0x9) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) [ 914.374259][T22300] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 914.388677][ T28] audit: type=1804 audit(1596946106.670:170): pid=22301 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/627/bus" dev="sda1" ino=15938 res=1 errno=0 04:08:26 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:26 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 914.427757][ T28] audit: type=1800 audit(1596946106.670:171): pid=22301 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15938 res=0 errno=0 [ 914.451532][ T28] audit: type=1804 audit(1596946106.710:172): pid=22297 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16132 res=1 errno=0 04:08:26 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 914.524711][T22315] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:26 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed00000000"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:26 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) [ 914.589355][ T28] audit: type=1804 audit(1596946106.870:173): pid=22318 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/628/bus" dev="sda1" ino=16145 res=1 errno=0 [ 914.619816][T22320] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 914.629808][ T28] audit: type=1800 audit(1596946106.900:174): pid=22318 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16145 res=0 errno=0 [ 914.653281][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 914.726094][ T28] audit: type=1804 audit(1596946107.010:175): pid=22322 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16050 res=1 errno=0 [ 915.672835][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.471256][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 916.722975][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:29 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x4, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:29 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETFILTEREBPF(r0, 0x5452, &(0x7f0000000040)) 04:08:29 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:29 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:29 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed00000000"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:29 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:29 executing program 4: bpf$OBJ_GET_MAP(0x7, &(0x7f0000000540)={&(0x7f0000000500)='./file0\x00', 0x0, 0x18}, 0x10) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) [ 917.430517][T22337] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.5'. [ 917.452254][ T28] audit: type=1804 audit(1596946109.740:176): pid=22341 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/629/bus" dev="sda1" ino=16239 res=1 errno=0 04:08:29 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:29 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:29 executing program 4: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001380)=[{&(0x7f0000000040)="2e0000001c00810e000f80ecdb4c1b020200000001000800680047fb12000100040fda1b40000500000f00000000", 0x2e}], 0x1, 0x0, 0x0, 0x10}, 0x0) [ 917.513794][ T28] audit: type=1800 audit(1596946109.740:177): pid=22341 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16239 res=0 errno=0 [ 917.538733][ T28] audit: type=1804 audit(1596946109.790:178): pid=22338 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16237 res=1 errno=0 04:08:29 executing program 4: socket$kcm(0x2, 0x5, 0x84) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000000540)={&(0x7f0000000380)=@in={0x2, 0x4e21, @rand_addr=0x7fffffff}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x0, 'memory', 0xc}]}, 0xfdef) 04:08:29 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) [ 917.577297][T22351] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 917.588967][ T28] audit: type=1804 audit(1596946109.870:179): pid=22353 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/630/bus" dev="sda1" ino=16373 res=1 errno=0 [ 917.762457][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 918.792997][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 919.511231][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 919.832750][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xae}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:32 executing program 4: socket$kcm(0x2, 0x5, 0x84) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000000540)={&(0x7f0000000380)=@in={0x2, 0x4e21, @rand_addr=0x7fffffff}, 0x80, 0x0}, 0xfd00) write$cgroup_subtree(r1, &(0x7f0000000280)={[{0x0, 'memory', 0xc}]}, 0xfdef) 04:08:32 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:32 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed00000000"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x80000000) 04:08:32 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:32 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x100002, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x6628, 0x0) [ 920.453080][T22371] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 920.479124][ T28] kauditd_printk_skb: 3 callbacks suppressed 04:08:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 920.479137][ T28] audit: type=1804 audit(1596946112.760:183): pid=22375 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/632/bus" dev="sda1" ino=16238 res=1 errno=0 04:08:32 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:32 executing program 4: r0 = socket$kcm(0x2, 0x2, 0x0) recvmsg(r0, &(0x7f0000000a00)={0x0, 0x0, 0x0}, 0x0) [ 920.545202][ T28] audit: type=1800 audit(1596946112.800:184): pid=22375 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16238 res=0 errno=0 [ 920.553736][T22389] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:32 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 920.589924][ T28] audit: type=1804 audit(1596946112.810:185): pid=22370 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16234 res=1 errno=0 04:08:32 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 920.628249][ T28] audit: type=1804 audit(1596946112.900:186): pid=22396 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/633/bus" dev="sda1" ino=16272 res=1 errno=0 [ 920.657530][ T28] audit: type=1800 audit(1596946112.900:187): pid=22396 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16272 res=0 errno=0 [ 920.704408][ T28] audit: type=1804 audit(1596946112.970:188): pid=22401 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/634/bus" dev="sda1" ino=16252 res=1 errno=0 [ 920.728473][ T28] audit: type=1800 audit(1596946112.970:189): pid=22401 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16252 res=0 errno=0 [ 920.873157][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 921.913621][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 922.551245][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 922.962810][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:35 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xae}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:35 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x80000000) 04:08:35 executing program 3: getpid() r0 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 04:08:35 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$cgroup_ro(r0, &(0x7f0000000080)='cgroup.stat\x00', 0x275a, 0x0) 04:08:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:35 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000000540)={&(0x7f0000000380)=@in={0x2, 0x4e21, @rand_addr=0x7fffffff}, 0x80, 0x0}, 0xfd18) [ 923.511038][ T28] audit: type=1804 audit(1596946115.790:190): pid=22415 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/635/bus" dev="sda1" ino=16251 res=1 errno=0 04:08:35 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:35 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x80000000) 04:08:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:35 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000000540)={&(0x7f0000000380)=@in={0x2, 0x4e21, @rand_addr=0x7fffffff}, 0x80, 0x0}, 0xfd18) [ 923.550888][ T28] audit: type=1800 audit(1596946115.790:191): pid=22415 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16251 res=0 errno=0 [ 923.576229][ T28] audit: type=1804 audit(1596946115.860:192): pid=22411 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16252 res=1 errno=0 04:08:35 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(0x0, 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 923.992781][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 925.033017][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 925.591286][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 926.074091][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:38 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x94, 0x94, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xae}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:38 executing program 4: sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000001740)=""/102400}, 0x20) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x180a5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) socketpair(0x2a, 0x0, 0x8000, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'dummy0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f2, &(0x7f0000000080)='ip6tnl0\x00') bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380), 0x0, 0x7fff, 0xa8, &(0x7f00000004c0)=""/168, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x10}, 0x78) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040), 0x4) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) socketpair(0x0, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(0x0, 0x0, 0xd, 0xffffffffffffffff, 0xa) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000140), 0x12) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0xf7, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffff7, 0x7fffffff}, 0xb53af93e992395e3, 0x0, 0x40800000, 0x4}, 0x0, 0x4, 0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') 04:08:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x80000000) 04:08:38 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(0x0, 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:38 executing program 3: getpid() r0 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 04:08:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:38 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(0x0, 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:38 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="48000000100005070000", @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:38 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x11, 0x0, 0x2}}, 0x0, 0x1a}, 0x20) 04:08:38 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 926.614746][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 926.614757][ T28] audit: type=1804 audit(1596946118.900:196): pid=22448 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16236 res=1 errno=0 04:08:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x80000000) [ 926.664553][T22463] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 926.697757][ T28] audit: type=1804 audit(1596946118.980:197): pid=22467 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/640/bus" dev="sda1" ino=16267 res=1 errno=0 [ 926.806778][ T28] audit: type=1804 audit(1596946119.090:198): pid=22470 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16239 res=1 errno=0 [ 927.112900][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 928.163010][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 928.631259][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 929.193057][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$TUNSETFILTEREBPF(r0, 0x40086604, 0x0) 04:08:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="48000000100005070000", @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:41 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:41 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x80000000) 04:08:41 executing program 3: getpid() r0 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x0) 04:08:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="48000000100005070000", @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 929.556245][T22475] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 929.570107][ T28] audit: type=1804 audit(1596946121.860:199): pid=22478 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/641/bus" dev="sda1" ino=16272 res=1 errno=0 04:08:41 executing program 4: r0 = socket$kcm(0x2b, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x400c00) write$cgroup_netprio_ifpriomap(r2, &(0x7f00000001c0)={'veth1_to_bridge'}, 0x12) write$cgroup_int(r1, &(0x7f0000000200), 0x400086) [ 929.629782][T22486] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r3, 0xffffffffffffffff, 0x0, 0x80000000) 04:08:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700000000000000", @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:42 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 929.680442][ T28] audit: type=1804 audit(1596946121.960:200): pid=22480 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16236 res=1 errno=0 04:08:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700000000000000", @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 929.768012][T22497] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 929.820727][ T28] audit: type=1804 audit(1596946122.100:201): pid=22499 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/642/bus" dev="sda1" ino=16246 res=1 errno=0 [ 929.855073][T22503] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:42 executing program 4: r0 = socket$kcm(0x2, 0x0, 0x0) recvmsg(r0, &(0x7f0000000a00)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.stat\x00', 0x0, 0x0) socket$kcm(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x1ab, &(0x7f00000003c0)='bdev!)-%+wlan\x00posi\x19Mx_dxl_accesszQ\tU\x97\x12=J\xd5\x8b;YE\xec\x8c;\xf7\xcc\xa7\x8b6\n\xbe\x01\x01\xae\xb6\f4\x87\xd9j\xd8\x0e\xc2\x10\xb1\x7f\x95\x01fE\xaea\x10\x8f\xac\xa9+V\x863Hhk{2\x00\x14I\xf7\xd6\xcd)\x05\x87q6\xed~\xd0\xb2\xf8\x8d\xaa\b\xe4\"\x1c\xbf\x8f_[\x17@\xe5\xec\x10\a\xb95w\x8by}/\x8cw\xe6\x99\xfe \x84]8\x940U\xb3E;\xff\xa1!\x9a\x87\x88\x02\xbf\xab\x97B\xd9\x06\xf2\n\xf7\x1f\xd8v\x7fD\xf2\x87\xf7}V\x89}\xf0\xb7\x8d\x85\xf6\x9b\xcc\xd3Lh.\r\xd3J\"\x1f\xdeW;F.\xdf$\xee\x18\x0e5\xa1\xfcN\x88`\xbbj,q[\x90/\x9b\xf0\xccr\xc1\xa8\x85E\x85p+\xd1\xbe\x10\rgx\xb8\x93k\x8c\x1dTi\xafq\xde\x06/ \x93O.\xe5<0\xfa\b\x82\xe4c&\x99\xd6psf\xa8\xacjh9\x8bk\x8f\n$\xf2\x06#\xc8\xd2\x00\x00w\x03,\xbb\xed\xf1o\xd8\x19\xd2\x1d\xbb\xd3\x18E\x0e&\x83\xdfWL?P$\xb4a\f\x154\xdd\xacx\x91<\x97\x13\xab\xe2\xdd\n\x13\x19\xb9U\n\xb5\xb6\xffBQ\x80\xe6\xe6\xaf\xc8\x15_>\xe6\xfc\xb9R\x06\xcd/\x87\x11\xf1\xb9\xbe&,c\xfd3\xc4\xeaP\x9b\xdf5\xcc\xa4RDx\xad\xc0\x8f|\xe3u\xbe\x1e\xd5\xa6\xcc\xb8\x86\x8b0\'\xcc\x01\x9bQ/\xf9\xa7vfa\xdf!\x1axt\xd1\r\xd9&MC\xcc,2\xce\xd2kCJ\x10\x88\xc5#\x92\xa32)2\xd3\xa02q\xdb\xe4\xe3\x97\x9d\xbc\xc9\xf8G'}, 0x30) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c42, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40305839, &(0x7f0000000040)) 04:08:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x0) [ 929.887502][ T28] audit: type=1804 audit(1596946122.150:202): pid=22498 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16311 res=1 errno=0 [ 930.037906][ T28] audit: type=1804 audit(1596946122.320:203): pid=22512 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16267 res=1 errno=0 [ 930.233059][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 931.272979][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 931.671255][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 932.313060][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:44 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700000000000000", @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:44 executing program 2: creat(&(0x7f00000002c0)='./bus\x00', 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:44 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.stat\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) write$cgroup_subtree(r3, &(0x7f0000000400)=ANY=[], 0x32600) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETFILTEREBPF(r1, 0x6609, 0x0) 04:08:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x0) 04:08:44 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, 0x0, 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:45 executing program 2: creat(&(0x7f00000002c0)='./bus\x00', 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 932.649467][T22520] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 932.665431][ T28] audit: type=1804 audit(1596946124.950:204): pid=22522 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/643/bus" dev="sda1" ino=16267 res=1 errno=0 [ 932.724210][ T28] audit: type=1800 audit(1596946124.950:205): pid=22522 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16267 res=0 errno=0 04:08:45 executing program 2: creat(&(0x7f00000002c0)='./bus\x00', 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fallocate(r0, 0x0, 0x0, 0x5000f4) r3 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x8400fffffff8) lseek(r3, 0x0, 0x4) 04:08:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000000c0)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000031c0)={0x0, 0x0, &(0x7f0000003180)={&(0x7f0000000000)=ANY=[@ANYBLOB="ed0000000010"], 0x38}}, 0x0) sendfile(r4, r3, 0x0, 0x0) [ 932.773586][ T28] audit: type=1804 audit(1596946125.040:206): pid=22535 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/644/bus" dev="sda1" ino=16239 res=1 errno=0 [ 932.775372][T22536] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 932.807577][ T28] audit: type=1800 audit(1596946125.040:207): pid=22535 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16239 res=0 errno=0 04:08:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='memory.stat\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(0xffffffffffffffff, 0x40086602, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) write$cgroup_subtree(r3, &(0x7f0000000400)=ANY=[], 0x32600) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETFILTEREBPF(r1, 0x6609, 0x0) 04:08:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 932.882837][ T28] audit: type=1804 audit(1596946125.040:208): pid=22527 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16233 res=1 errno=0 [ 932.926503][T22545] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 932.937187][ T28] audit: type=1804 audit(1596946125.170:209): pid=22540 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/645/bus" dev="sda1" ino=16269 res=1 errno=0 [ 932.976436][ T28] audit: type=1800 audit(1596946125.170:210): pid=22540 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16269 res=0 errno=0 [ 932.997864][ T28] audit: type=1804 audit(1596946125.200:211): pid=22541 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="cgroup.controllers" dev="sda1" ino=16240 res=1 errno=0 [ 933.362975][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 934.393126][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 934.711248][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 935.433350][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:47 executing program 0: r0 = socket$kcm(0xa, 0x5, 0x0) sendmsg(r0, &(0x7f0000000400)={&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @loopback={0x0, 0x7ffff000}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000000)="be", 0x246c3}], 0x1, 0x0, 0x0, 0x500}, 0x60) 04:08:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:47 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/18, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:47 executing program 4: r0 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r0, &(0x7f0000000380)='\x00', 0x1, 0x0, &(0x7f00000000c0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r0, 0x1) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000004c0)={0x0, @in, 0x0, 0x0, 0x0, 0x0, 0x34}, 0x98) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x31e, 0x8}, 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6, 0x0, 0x0, 0x0, 0x0, 0xc}, 0x98) 04:08:47 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, 0x0, 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/19, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:48 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable\x00', 0x9) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) [ 935.684765][T22557] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 935.704093][ T28] audit: type=1804 audit(1596946127.990:212): pid=22558 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/646/bus" dev="sda1" ino=16239 res=1 errno=0 04:08:48 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0xb4, 0x4) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='scalable\x00', 0x9) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2925c7c6e56216d4e35e39a9977e27e21450596008761c86e21", 0xc9}], 0x1) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[], 0x150}}, 0x0) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000001b40)=[{&(0x7f0000000380)=""/46, 0x2e}, {&(0x7f0000001600)=""/188, 0xbc}], 0x2}, 0x0) sendto$inet(r0, &(0x7f00000012c0)='\f', 0x300, 0x0, 0x0, 0xf4010000) 04:08:48 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) 04:08:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/19, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:48 executing program 4: socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0xc2, &(0x7f0000000080)={@multicast, @random="e0d35b1004bb", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x74, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010101, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x3, 0x0, 0x0, {0x16, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @private, {[@timestamp_prespec={0x44, 0x44, 0x0, 0x3, 0x0, [{@broadcast}, {@multicast2}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@multicast2}, {@multicast2}, {@loopback}, {@remote}, {@private}]}]}}}}}}}, 0x0) [ 935.754455][ T28] audit: type=1800 audit(1596946127.990:213): pid=22558 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16239 res=0 errno=0 [ 935.779508][T22565] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:48 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, 0xffffffffffffffff, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x4) [ 935.870304][T22577] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. [ 936.482981][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 937.512702][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 937.751267][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 938.552941][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:50 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:50 executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) write$tun(r0, &(0x7f0000000700)={@void, @val={0x0, 0x4, 0x9, 0x9}, @llc={@llc={0x0, 0x0, "a1", "6cf14cce4f693c9f4e0cd77cf3c98d7993de42a788a67dcdfffea2678421ea6d53510ea348ed2273840bf20875da476836ed1c26f953db590680a9d7bde4ac199561225f59c9450f572c0c803b8e09f8a5dcebffa70ac7ae81e4ebb6b93c7e1050175618cb2e74735a1bd425d2941461a439e0536898f5928f8fe2503cf94d98a4b9bb494dbe03cfd765265d760131178a95dc6237db902b5f706feae57db207474eab08b726a713b7609f3f5a1dd8042c4ec6d436838a043dc5524afeccb27e68c8f452b27b5c5b35dc708380d05836720985804bf9e70e467049665c944371f32e5fa7dd016023b7f3c185a4a1b6cb51e9e49e8d3a846155e58b366aa8f316442d3b3596ae1e6fbd4e1a60afa9fcf9e6879fe92677fcb42201e4aedf25d1d4b3dcea6688c6b68ddf5781085e30b1f1556dd2efd042237beb2092f29dca001d7742ee86c9d94e70e2bf4e56a33ddd4d11ce88671d06b0c383d02a881ecadb19e357575a876ed53948b074d2384fdb9036a25deddafa120305886b58f87856434941ab5869db4ea2715fdb21f577146ade09ec1fcc8378039f952ea0812877e4f76dbc51f6487070e60308effb06aea30f5e98742c4c7fce46abc5e2b39edb05725c4d78a9696ca9612e6677cd6292f429c9294b53f5d375af0110f1c045db48045c1a4e14405f75a8e5c879c36055ee0cec2354ed734c8ebda696f4d4c62871e2e46a2eeeb56d1f6a584c56b577ed07cf0e7221e3c64afdd3772cba0f5490380bcfb5f6733b5bf693ddaab73d435a547b59911d1209523a6c297d58860f569bd0205892d204bc4d8c60d004b1005988fb93f925445b76ea958d8a11f84997493e5d9cd7d159a5fed05b4d1d52ac446ff825fee000053cd538eb18f9f422bc2ee14445a6dbfc6d970ff891e0323fe08d316667a4ab453554231a369905a290aacb006945e91293cf30ac166a2e8b201cc0e36c635cbef6f255d2b9c22c7a17feba667764a2a0c0d9e91ad09877c8ff803f52afb5119efcfc38447ea3711afa36aee513770a56c4aadbd65f86f2f25d66dde0be5229a46cbfe617cfaef776689d3cb8f5db7b948704ee5de5f112adcb55c0a9b8a0b178b9abe4bda34a2367f656cfc460259d3f227fd944fbac8a688b0242905001ef5b49a167dc44074b81b54e82db006e1e722d092d2daf22f93ddaa885b4bee6cd5766113217973bada4169eb637c98fd463cb3338b0ee3abaf4437ed0dd47c34ece0ec8ffb5092c422380f84be28b86a6b7921c2cb9f4772aa514129cb43316e8fe7759b7a1ea2eab335d57cf20ed317ef9b517147271d9d7e2efa2785368864b9ad616a05b35343509a40474183df4d231f83fa3c9a4f211070a4da01853515eb5a4c5625472c810cd0b49c1eaaa19915f416d5b1465741a8684d8409a04dffb825a643f0a76e0af69d655d39932b59a9a1553c2ef06cbb4a51978fbd52c2127fa62cdafb43f998fedb23db10d22610a1e221bd94b3470acb55b1f20f90fb31a70b5d181ea35bcf166b08f5e5ddf64424ed1f28730560867a16fc23aa630ede26a00eab0c42283e922aebd8cefe2ad9c3a76d06a7e6e4cb29bace6ac2858ad561e609fab646afd8f4a2d4e4e86d3baffaac5a1a5aa6d47709d78fc51dc009d8ff8f1fe46aa117a868041e532f446051ba44c04b988a69b2e05bc58ebc946318df4e44ba59f8369236f2b2d00152b39e0f198a672ed7887e179799d2972f83ef90e07302bbbc29915ce36ec91e6be2e4ecc4db3bdf334a508f15a3db0298f555ec6b4658892ad6b16ab304fd8aadfeef18e528b105574a56cd086973840fd8e74918d6a257cb13345cca4d3de733acfc1e7d44be8804cb6618f6df28f61c33300061a5a5f58efa58aa6eb0a0433701a0adf1b91a7e07127ae4ecc8e701daf0909af0eb70956de4d7ed03fac7a2f81ab82696eef4796b53430b4776f674490942556e65b8d0dc991b3a8f27baa0d4ef6ec789e3ae3a611f5651a4d6fdf9e87c316494c2d7ee9b1b8c825ebfad7524b1e10bc021f2cf5cc0bb76028c699f1db135c81b67e1c50c3534045a3728fb5591a9558281dfb93da3e5d66edfc0b47d97a08efba985b7c1abbab6271c480b4f89ff58c2b33e91f32ec3e29e0d2a0c5fca72dc6250454a822dfd866492a5d9e5a0d4f14dec9d7f96b854d054ea9a341312b88c8a5f2e6458aa9af11d4faaf7634cfc06cd03033ca6ec33b4f1944ec32c4998565ad36a05b495d846dd82fdc3a7b54934273766ec5cc092c0f7f2ca409136b9c64445b9b1dc1209185a3a027a2d34aa41e02d0a6102193f298483b82a750a9a6e4361ea3872f4422e3f2297d89a69ab34871bfa7c27d76470fc81274b9c16967a24a1f241863025c16aaaccdbe03ca12e73bd35dd4f1195a38e825a107402d8911a7b3e34e79b52d661db4b57c9f774ed25120fd8a9c75efec2b509be862af38f5f7d382659069888bb53b82df02d824cd915f43c8c38a58245ec2a180528897e68b71defb9ab86c800f13c7e6ca174b79cadf8cfa4451e495be34f3a3cfe702336083695a628ff579334fbece7a111d206e17e05ecd6c2228aefd6da8b42eddc79cfbebf6638391713bab2bab601365d2196b2ad400514edeab89586b8fda1b48a7fb081c30e2b45c5f58d683f704faeef054b10fc32df0181cdce0243147db3188284c5843675f976c26aebc7612917a301f9ef03d91d390d5828b40bda7a0cda2d1179668081c3219cd45e5d3cb498234f1ff9540115128a41bc97cc70c79209f442a3c2270e99ae5625522b3c297f800ef499883a969a4d584f94611c5cd342ddf2ec71c501ee168d55ee9df4f28d730db7a935bf684d5fb95da0aa2182171fa0f49f4818cb0431e3614ec9f63459a05b767aa0651199546a805a3fa279801f8e62f504e859688074ee94cbe65402a505b164399c0f6e2753e9698488200d7b9ca93fb1a78ce94ec2fb26547a9ba09fb861b1ee2a2ad7244db7028528ed98bd76d134cb4d9b797090827b379dfeef9127ef474a27ee80305029907af7fcd9fe1d6993bb8723ec413cc5214f3f1b3ac61bcf2ba1b7eb679db58587355fc783fb1d07ae74dc2feacbfb1bc069451e914441197e49f94179c5fbed6585170308dddcf0fc1b5d297f5c9cbbd9cc76b2a7cf045544cd0150831d5670aa6cc59a6ce17a47679dda58d5cce520e9fe0c40d3ff4d4a2ac3d6360e6f3dd8f1f5346f272f655f4dd96b70c2e81c853ddd5b4005c4558e43b0ddcc59869c03e551a2874ec4de905e05f33b83749fc25a41b49faea22f571ccc63e72c2d9a2374cfcf75b38fdd3c1a7ac214bab1ef81d99716d509237fc935786729c2d568daf04eedf90467ad982b5d64f22bc860cc23b3f9e07a46b6468589d996f76ccfcacf79b7b124e7d7cd9570397f81b52c3d11419cca03cb6c23566a8db9aedc280740743d1b950a74db2563dacf0f2240703b986bbcf91aadba57b399ca0aa35181d4be0af99900f4c2ec7c654f077f43542ce5d4b5e20e18fdfd2eea6ebb4d1a9f0efe4a29db3a43d9e98b32fac7458842481b85ed4d6edb595b40ab13562de5993cc478192b0100c6b0ab45a967ab339c363ea9cc82663f6ea34efe7e0b0494b441bea4ed49fa16f9407acf776aafbbee3f117b12175db9782898ac9d88dbc4342366ae87e28ca51bd8d1ce41fda98378c169b24ce8b1378661c9e30f74640f903c0b292de4aa280f114e336b6bb636b7a4e67337a96fde2838807efe469658bafbd62d89fff8a9ab4b7dd342276c5b6496a5cdba563aa93bf7217f9796e59e95c19961aa35a064abd4fdf766f871c74e6bcb1fddab5d6c36b94f9ea1f34cd952f55476047a6ffbe285a55f133aab35dcb972bcfa9ac0f04c1d046af57f6798d3df14e2aea40f77bcb98442d6bfe8024bee4e0974efe6f97f8b9166aa988ccb1f7797d309d86a6689de376095df5149a5f271d3095d6c1a7f00a9fccf6f5388a9214d41b2aa6f672b7a00787dda97c07e80b8714cbc5e5f5bc641cb4284c120564af4bbd7f381a52115f2e1725a7e0cae223fa772872fd6cfdfaf07ccb13b82857e05c8d96c5e00756fcd4aa5f790e94d6d974b3ef23a386bcfff1a9cf207ca2c09577dc20c88003c3e3bcbf272e668a30ca065cc3c2f5fb677af54ff6fc19fc024561b713a3366c3b6c9462a598667783cd87e7acdb5799a143c27ca4c615cc79d49c4243558f597842e31ba7a54190d06ff34f04b20a6816c6f3c46700a75f5466123d1e2628e85cc4673ecaaaba4ba156beef67a1032ce17374df1a2d7ff52c01b69ae8f64b21ed3565065cce8fd06a7e354cc247624ce4d67f17b4930d32e640d7b6c1a523ef6fb75f8f43ea2b7a59ef60323b0b35d545a647f33bae536df6ccae24c76f02838e6f94c82881d036871d0d20946deeaf071c10647a0300749629a48d27387e6877b25487f77f4c7b8b427c25b3f9bccb3c45e3b45ba9c553afc12849529093388d68f66853cadf5f94d7479951fc5f028c4eac954de371a8c19ab384858e14b289835f152a8f34a6139e6a3043261b9d89d99d8ba9e6916a37356065324e5c48ae857a793807328f1ae00816d9413813e17f32c8850c31f04d3248934f8f4dbe20f4fa163b2db6f0cab042b8a1c9bae85b73bde1ac249316653870624a6debc07cc1e9e36637a165b2ddff914fbfb9b7b6e620853b2a63bf25b2de7cf3c2068aa639c7b3c167f0d9c911108162d0aae4c0b566b685bd78686ca81a4a733386006e8ad3b2f1bcd31152d764fc233707fa3ca4d93e50f532c8b0044eaaa63bd58b927d256e5a8e9e609cb35a3963e9e06e72167e4a7c2f0ade8f5f5da6cba96c736c43ccc15ed8b0ad5f37d5f30e38864f9daa1d1fb466d0430edf95c7d16c4e7062bb66d13c2dad53ccbc12dbf782fa11ad7a002a28e2b78b866f2b00f5232d71995d84fd05b87a6843ace84f89d5d518479f2e4999b4aaf22492bd28de5944fbf69e3e59f6eb9761bb548f0b56458bb4391544f1125429b9362c68555bd835f554efd6637a139c16e3ec1f1d3da1078c043f3e8daa7b031a3a4e1f43e7df1831f99902c82a7cba332e1901e22efd2a1c5099fe2fb368c64440dc4f2ea88ab906a828f430603f0919be2a9881ec76606873e269eedf71b1ff1308714cf36e58f530a2ab360ce0c59c46e55110f20887b9621295da0167c184a1746a1cdf87d94f25d1a6c235a8aa63cef09299b2017fb21ab336086fb145a67a0e5b9d6311bb14bf317245a0859c57611c002a34c01c558c731fe0d53ca2447d7149391475ea72c30101f7a9745d43ce0394dffab1ef69b77d12e0a6ca0b2a296cf53be01d0d63813e07821479133eca6c2b0f243e5bd14aa3338b3c679458fc6ed9149a6af81438982a6e8047fb3d57a05cab7c7775becff27b7f490b7ed34c4352516c99eab6117eb97695dc0b1efb4265f8841ff2f9b12b6188d45b6d086677ac51727cbc4a114bb0395c695991f58294f1f7627215796609a055f4566e522f8ce2efd737dc2a5dc5d02681d664dd1299c10bac260edc5127e7606f9feb4f246244d3f8932df32ac55741f2418a96b1f5cdec896c99058c882c80ad10160be83b06cc3901ed3cee6528c443c3977ede0a7ed46a0cf8b99970c33bd24e4c5cafc7a6650a4baed3b2e1796f"}}}, 0xfca) 04:08:50 executing program 4: 04:08:50 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x0) lseek(r4, 0x0, 0x4) 04:08:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/19, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:50 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, 0x0, 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:51 executing program 4: 04:08:51 executing program 0: 04:08:51 executing program 5: socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:51 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x0) lseek(r4, 0x0, 0x4) [ 938.722914][ T28] kauditd_printk_skb: 4 callbacks suppressed [ 938.722927][ T28] audit: type=1804 audit(1596946131.010:218): pid=22584 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/649/bus" dev="sda1" ino=16252 res=1 errno=0 [ 938.758606][T22587] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:51 executing program 4: 04:08:51 executing program 0: [ 938.808342][T22595] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 938.827269][ T28] audit: type=1800 audit(1596946131.010:219): pid=22584 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16252 res=0 errno=0 [ 938.876103][ T28] audit: type=1804 audit(1596946131.139:220): pid=22598 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/650/bus" dev="sda1" ino=16311 res=1 errno=0 [ 938.909007][ T28] audit: type=1800 audit(1596946131.139:221): pid=22598 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16311 res=0 errno=0 [ 939.603019][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 940.633030][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 940.791680][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:54 executing program 5: socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:08:54 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:54 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x0) lseek(r4, 0x0, 0x4) 04:08:54 executing program 4: 04:08:54 executing program 0: 04:08:54 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240), 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) [ 941.674130][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:54 executing program 4: 04:08:54 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(0xffffffffffffffff, 0x0, 0x4) 04:08:54 executing program 0: [ 941.755968][ T28] audit: type=1804 audit(1596946134.039:222): pid=22612 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/651/bus" dev="sda1" ino=16240 res=1 errno=0 [ 941.784666][T22613] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:08:54 executing program 0: 04:08:54 executing program 4: 04:08:54 executing program 5: socket$netlink(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r2, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r2, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 941.834696][ T28] audit: type=1800 audit(1596946134.039:223): pid=22612 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16240 res=0 errno=0 04:08:54 executing program 4: [ 941.900837][ T28] audit: type=1804 audit(1596946134.129:224): pid=22625 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/652/bus" dev="sda1" ino=15788 res=1 errno=0 [ 941.918479][T22629] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 941.972835][ T28] audit: type=1800 audit(1596946134.139:225): pid=22625 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=15788 res=0 errno=0 [ 942.713088][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 943.753110][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 943.831290][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:57 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:08:57 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(0xffffffffffffffff, 0x0, 0x4) 04:08:57 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 04:08:57 executing program 0: 04:08:57 executing program 4: 04:08:57 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240), 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:08:57 executing program 0: [ 944.789507][T22641] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 944.803021][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:08:57 executing program 4: 04:08:57 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 04:08:57 executing program 0: [ 944.819432][ T28] audit: type=1804 audit(1596946137.099:226): pid=22642 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/653/bus" dev="sda1" ino=16239 res=1 errno=0 04:08:57 executing program 4: 04:08:57 executing program 0: [ 944.892902][ T28] audit: type=1800 audit(1596946137.099:227): pid=22642 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16239 res=0 errno=0 [ 944.935024][T22657] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 945.833085][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 946.871233][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 946.879378][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:00 executing program 4: 04:09:00 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(0xffffffffffffffff, 0x0, 0x4) 04:09:00 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 04:09:00 executing program 0: 04:09:00 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240), 0x0) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:09:00 executing program 0: 04:09:00 executing program 4: [ 947.827115][T22669] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 04:09:00 executing program 0: [ 947.870653][ T28] audit: type=1804 audit(1596946140.149:228): pid=22672 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/654/bus" dev="sda1" ino=16239 res=1 errno=0 04:09:00 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') mmap$snddsp_control(&(0x7f0000ffa000/0x3000)=nil, 0x7fffdf005000, 0x0, 0x2811, r0, 0x83000000) 04:09:00 executing program 4: r0 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f0000000080)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000200)=0x98) [ 947.905836][ T28] audit: type=1800 audit(1596946140.149:229): pid=22672 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16239 res=0 errno=0 [ 947.934720][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:00 executing program 0: r0 = getpid() r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0xe7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000000700000025000000000000009500002000000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r0, r1, 0x0, 0x0, 0x0}, 0x30) 04:09:00 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x0) [ 947.987224][T22688] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 948.062091][ T28] audit: type=1804 audit(1596946140.349:230): pid=22699 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/655/bus" dev="sda1" ino=16269 res=1 errno=0 [ 948.092891][ T28] audit: type=1800 audit(1596946140.349:231): pid=22699 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16269 res=0 errno=0 [ 948.952882][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 948.961712][T11912] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 948.970282][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 948.978727][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 949.911377][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 949.992969][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:03 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:03 executing program 4: r0 = socket$inet_sctp(0x2, 0x800000000000001, 0x84) sendto$inet(r0, &(0x7f0000a34fff)='H', 0x1, 0x0, &(0x7f0000030ff0)={0x2, 0x0, @local={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shutdown(r0, 0x1) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x7d, &(0x7f0000000040), &(0x7f0000000100)=0x10) 04:09:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 04:09:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x420000015001}) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000140)={'syzkaller1\x00', {0x7, 0x0, @local}}) write$tun(r2, &(0x7f0000000180)={@void, @val={0x3}, @mpls={[], @ipv4=@dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x84, 0x0, @remote, @dev}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "f426e6", 0x1, "b90003"}}}}}, 0x2e) 04:09:03 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x0) 04:09:03 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:09:03 executing program 4: r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000280)='/dev/video1\x00', 0x2, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000000)={0x0, 0x4}) [ 950.880522][T22708] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) [ 950.910973][ T28] audit: type=1804 audit(1596946143.189:232): pid=22712 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/656/bus" dev="sda1" ino=16239 res=1 errno=0 04:09:03 executing program 0: socket$inet6(0xa, 0x2, 0x0) r0 = creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) getsockopt$inet_dccp_buf(r0, 0x21, 0x4c, &(0x7f0000000080)=""/132, &(0x7f0000000000)=0x84) sendmmsg(r1, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 04:09:03 executing program 4: perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x11, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000200)=ANY=[], 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r3, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r3, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x53) [ 950.962371][ T28] audit: type=1800 audit(1596946143.189:233): pid=22712 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16239 res=0 errno=0 04:09:03 executing program 2: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fallocate(r1, 0x0, 0x0, 0x5000f4) r4 = open(&(0x7f0000000040)='./bus\x00', 0x24000, 0x0) sendfile(r0, r4, 0x0, 0x8400fffffff8) lseek(r4, 0x0, 0x0) 04:09:03 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x28}}, 0x0) [ 951.003436][T22728] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 951.033142][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 951.096570][ T28] audit: type=1804 audit(1596946143.379:234): pid=22739 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/657/bus" dev="sda1" ino=16330 res=1 errno=0 [ 951.112993][T22740] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 951.151990][ T28] audit: type=1800 audit(1596946143.399:235): pid=22739 uid=0 auid=0 ses=4 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=16330 res=0 errno=0 [ 952.072821][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 952.951373][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 953.113191][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:06 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x28}}, 0x0) 04:09:06 executing program 2: openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x6002, 0x0) 04:09:06 executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000180)={0x8, 0x1, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r3}) dup2(r4, r0) open(0x0, 0x0, 0x0) 04:09:06 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:09:06 executing program 4: prlimit64(0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x4000091005d7d, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvmmsg(0xffffffffffffffff, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000001140)=[{&(0x7f00000003c0)=""/150, 0x96}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='personality\x00') add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) exit(0x0) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, 0x0) preadv(r0, &(0x7f0000000500), 0x37d, 0x0, 0x0) futex(0x0, 0x0, 0x0, 0x0, 0x0, 0xbffffffe) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x7, 0x0, 0x4, 0x0, 0x0, 0x8}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) fcntl$setpipe(0xffffffffffffffff, 0x407, 0x0) vmsplice(r1, 0x0, 0x0, 0x0) 04:09:06 executing program 2: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='lowerdir=./bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f00000002c0)='./bus\x00') r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x1000) lseek(r0, 0x0, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = open(&(0x7f0000000240)='./bus\x00', 0x0, 0x0) sendfile(r0, r3, 0x0, 0x8000fffffffe) creat(&(0x7f0000000200)='./bus\x00', 0x0) 04:09:06 executing program 0: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000bc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487509101cba12c07d57d995b61e89a4530f923062242b416ae9eeefc0e9c60ebab1c17682dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837448a4ca03767c69ce5f2a2b7b96b0d0b4af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208e4557cd4ed88b37ab8674c499f5eb7b6bda92edf644dca2faffc836c98b58cf1fe50917b2c6b05e6001c29d7ca47dc62a087cc7f0e053927bc50e40a369aba3b08f0a8620c4d29eff8408ea28a6cb9fc8e7d360fced56ead5fa0c52f90bafb888ed8aa8d5d70cf2ec06edc22ca72157003b8beb850e2007f6118f6df8235d0fe1428c367c2d625414413dc04d025d4a6b727e1cd4bd9c6e123e37c81956901005352068bc40073b07ebe8e7023fb0ce22c76445275d13012e6d6e8304744704a88401b58461f89c9de98bbb0b91f080a0a6c0880e71efc8444c7a0bafa52c314250c709216f24d9e8ceb6ef708d56be4548dc36a359f0753174b766e0cfd836d81f7a18e02999483fc914f98eed61b12d87de304d73f4551301a24652a2c539c24af27a773bc206164fd64ed65fcc34c56040bf4c1315da2b2cbd54e4061eeef8aa908eae11a97af000000008b335accc588a66ce3155c7d14504a2c8e7f8ec8dd6ef48546127593b8b230c2496951629d7aab90cb7821e8aa04d014e935b4a10d5d8a4dc4ad752968981692612a6f7c93df32ea63b18ce9c3faa3e82ce9ce755b812732179b57c26791feb5bffd00119495faaeeaafeb8a06db79334b94c06e9c58bf51d551471ad77c4db23ab0a11fa42a3df2e91155d8c4c72cdbbbc08ca1b02c9c7869129f3335c0d88ba0455e75520a583fb71fea4688b0d4b07fb65c658ab8181e11ea9ed4430cac9da320b7228229778b93e30ebcdfc9e7abf1fbb802146c25ee958cec146b0f8c40e06f93b310f44b64b4c9dbc08836a7d7d4f1a422c9ec5c7cc0f459f80bc6403ed89a47373534822c3eedc3566062aaac6aac8e6fa89e950b0a37eb8fd5b1a60a3b07cc11669c14245ec90000000000000000002e4936d62ea967806def9c0f660e31ae510324f291619c9774012dc25becb0580b7769a045cf5d5247304b7bef6a670e9f210e767dd6b642f6471210b923195f440450d89b2087798b86eea72c95ee2917bd53d85587119c428c622335f7b720c5a2421ce526130214eaefbf157ffe18019629ee2fa725b1ffadad6b9031cb77bbd7664c225b374e1f685b69422f75ac59a5faece0bd56224de22a36e67399ac7ec683ef9754e545aa0d6dc13fca61a5e529db342b6b7c21ea0b27a2ac0203ad6ceca4e21ae99beccd9d8a1d88cd1c9285f9489f3ee451a2b09ca3864fb4db860a3ad8ae30e486f416223c3e73ccef12ff664eb3660c2756bc5981883f5ccbdea1e280d2cd8dd22316eb41b5374916b4616d517f38121f272ac5ffca6b5ae96d0000c9b214124c699d66cad430949bc59017726416fb7dab0c80c058dab92d6836b3d3a4baab45c25e9bcf3e80019f2f277bfd833fdeb63ffa2027b0e5576f23de92c4f431daef51ed007005bccf6236888b1b9c7b4f8e3928c15d8890b5d3d7c5c0b5c49ed87a6860a2e7a1aee429ead9461f411405cabc317d0f89cac733b82157cfa3acfae120a45a686c70b8f65adaf9fbc36a92bdbd86696b33b2a5ef8f75422f113dcd51acac11d7dc25baa2cd038a7713bffdf5e52e09e5c3a5a45faea786cc686cac8ac9b0250d67540ff2d3780940b07ca33f275ec87a37bd82c9785e354b1e0c0d71181fdbed87a8e330f3571511123ca3013b001e33f4f5fdf2a3afb959777c8c6a068eef797a6c851ec6d0c222f0bb81585ed37e77c776039957dc25afe90a5277e412270dad4d2d82de206cac3eb2bb81fd253154ddb22b050c465339fcf5c2a3b58447a74b9cddbe2fe9f532ffdd95f3d5f2dfdb34ff2ff350f650bfae6c5669bf4f90d478bd11ee7943255e9d1f790276b0290df22f9e2ccdd46da27fab23b59948d2a1573ccbd54254b274fceabba4328240492d3c53cb38e8e14171fe6ce82e5e19b3aef75645a2d244978849e5f89e549a20071b0a963fe0d45d9e02c8b56bb1ca0260"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0xff000000, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac141440e0", 0x0, 0x9}, 0x28) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) add_key$keyring(0x0, &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) add_key$user(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000340), 0x0, 0xfffffffffffffffe) keyctl$dh_compute(0x17, 0x0, &(0x7f0000000540)=""/243, 0xf3, &(0x7f0000000140)={0x0}) [ 953.923102][T22764] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x28}}, 0x0) [ 953.966067][ T28] audit: type=1804 audit(1596946146.249:236): pid=22767 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/659/bus/bus" dev="overlay" ino=16230 res=1 errno=0 04:09:06 executing program 0: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000bc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487509101cba12c07d57d995b61e89a4530f923062242b416ae9eeefc0e9c60ebab1c17682dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837448a4ca03767c69ce5f2a2b7b96b0d0b4af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208e4557cd4ed88b37ab8674c499f5eb7b6bda92edf644dca2faffc836c98b58cf1fe50917b2c6b05e6001c29d7ca47dc62a087cc7f0e053927bc50e40a369aba3b08f0a8620c4d29eff8408ea28a6cb9fc8e7d360fced56ead5fa0c52f90bafb888ed8aa8d5d70cf2ec06edc22ca72157003b8beb850e2007f6118f6df8235d0fe1428c367c2d625414413dc04d025d4a6b727e1cd4bd9c6e123e37c81956901005352068bc40073b07ebe8e7023fb0ce22c76445275d13012e6d6e8304744704a88401b58461f89c9de98bbb0b91f080a0a6c0880e71efc8444c7a0bafa52c314250c709216f24d9e8ceb6ef708d56be4548dc36a359f0753174b766e0cfd836d81f7a18e02999483fc914f98eed61b12d87de304d73f4551301a24652a2c539c24af27a773bc206164fd64ed65fcc34c56040bf4c1315da2b2cbd54e4061eeef8aa908eae11a97af000000008b335accc588a66ce3155c7d14504a2c8e7f8ec8dd6ef48546127593b8b230c2496951629d7aab90cb7821e8aa04d014e935b4a10d5d8a4dc4ad752968981692612a6f7c93df32ea63b18ce9c3faa3e82ce9ce755b812732179b57c26791feb5bffd00119495faaeeaafeb8a06db79334b94c06e9c58bf51d551471ad77c4db23ab0a11fa42a3df2e91155d8c4c72cdbbbc08ca1b02c9c7869129f3335c0d88ba0455e75520a583fb71fea4688b0d4b07fb65c658ab8181e11ea9ed4430cac9da320b7228229778b93e30ebcdfc9e7abf1fbb802146c25ee958cec146b0f8c40e06f93b310f44b64b4c9dbc08836a7d7d4f1a422c9ec5c7cc0f459f80bc6403ed89a47373534822c3eedc3566062aaac6aac8e6fa89e950b0a37eb8fd5b1a60a3b07cc11669c14245ec90000000000000000002e4936d62ea967806def9c0f660e31ae510324f291619c9774012dc25becb0580b7769a045cf5d5247304b7bef6a670e9f210e767dd6b642f6471210b923195f440450d89b2087798b86eea72c95ee2917bd53d85587119c428c622335f7b720c5a2421ce526130214eaefbf157ffe18019629ee2fa725b1ffadad6b9031cb77bbd7664c225b374e1f685b69422f75ac59a5faece0bd56224de22a36e67399ac7ec683ef9754e545aa0d6dc13fca61a5e529db342b6b7c21ea0b27a2ac0203ad6ceca4e21ae99beccd9d8a1d88cd1c9285f9489f3ee451a2b09ca3864fb4db860a3ad8ae30e486f416223c3e73ccef12ff664eb3660c2756bc5981883f5ccbdea1e280d2cd8dd22316eb41b5374916b4616d517f38121f272ac5ffca6b5ae96d0000c9b214124c699d66cad430949bc59017726416fb7dab0c80c058dab92d6836b3d3a4baab45c25e9bcf3e80019f2f277bfd833fdeb63ffa2027b0e5576f23de92c4f431daef51ed007005bccf6236888b1b9c7b4f8e3928c15d8890b5d3d7c5c0b5c49ed87a6860a2e7a1aee429ead9461f411405cabc317d0f89cac733b82157cfa3acfae120a45a686c70b8f65adaf9fbc36a92bdbd86696b33b2a5ef8f75422f113dcd51acac11d7dc25baa2cd038a7713bffdf5e52e09e5c3a5a45faea786cc686cac8ac9b0250d67540ff2d3780940b07ca33f275ec87a37bd82c9785e354b1e0c0d71181fdbed87a8e330f3571511123ca3013b001e33f4f5fdf2a3afb959777c8c6a068eef797a6c851ec6d0c222f0bb81585ed37e77c776039957dc25afe90a5277e412270dad4d2d82de206cac3eb2bb81fd253154ddb22b050c465339fcf5c2a3b58447a74b9cddbe2fe9f532ffdd95f3d5f2dfdb34ff2ff350f650bfae6c5669bf4f90d478bd11ee7943255e9d1f790276b0290df22f9e2ccdd46da27fab23b59948d2a1573ccbd54254b274fceabba4328240492d3c53cb38e8e14171fe6ce82e5e19b3aef75645a2d244978849e5f89e549a20071b0a963fe0d45d9e02c8b56bb1ca0260"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0xff000000, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac141440e0", 0x0, 0x9}, 0x28) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) add_key$keyring(0x0, &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, 0x0) add_key$user(0x0, &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000340), 0x0, 0xfffffffffffffffe) keyctl$dh_compute(0x17, 0x0, &(0x7f0000000540)=""/243, 0xf3, &(0x7f0000000140)={0x0}) [ 954.027915][T22780] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 954.054359][ T28] audit: type=1804 audit(1596946146.329:237): pid=22781 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/659/bus/bus" dev="overlay" ino=16230 res=1 errno=0 04:09:06 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3], 0x28}}, 0x0) [ 954.066008][T22767] overlayfs: filesystem on './file0' not supported as upperdir 04:09:06 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000040), 0x4) recvmmsg(r0, &(0x7f0000008880), 0x45b, 0x44000102, 0x0) [ 954.111999][ T28] audit: type=1804 audit(1596946146.379:238): pid=22781 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir287500113/syzkaller.ev3A7z/659/bus/bus" dev="overlay" ino=16230 res=1 errno=0 [ 954.163240][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 954.173216][T22792] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 954.194641][T22792] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 954.207952][T22796] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 955.192695][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 955.991353][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 956.233171][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:09 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:09 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$tmpfs(&(0x7f0000000100)='tmpfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='mpol=intevleavm=static:0']) 04:09:09 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3], 0x28}}, 0x0) 04:09:09 executing program 3: r0 = getpid() r1 = perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x0) 04:09:09 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r2, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @dev}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6fb14bccedfb718aef932f3889d1fdda5b9134015a860f5878c37ffe36e1165d14d435be5b317c6c8189767d2f97879f07a715bb7c169f46933d9338f4ab0483696f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8, 0x48000000}, 0x0) 04:09:09 executing program 0: r0 = socket$inet(0x2, 0x80001, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @dev}}}, 0x108) 04:09:09 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = eventfd(0x0) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000000)={r6}) r7 = eventfd(0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r6, 0x0, 0x2, r7}) 04:09:09 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3], 0x28}}, 0x0) 04:09:09 executing program 4: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) sendfile(r0, 0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x37cb1133) socket$inet(0x2, 0x3, 0x33) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8000}, 0x4) syz_genetlink_get_family_id$netlbl_unlabel(0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x0, 0x0}, 0x10) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000300)={&(0x7f00000000c0)=[0x0, 0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x88}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000200)={'veth1_to_batadv\x00', 0x0}) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000140)) 04:09:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) splice(r0, 0x0, r1, 0x0, 0x100000002, 0x0) [ 956.959788][T22809] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 956.984169][T22809] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:09 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r1, &(0x7f0000000000)='threaded\x00', 0x248800) 04:09:09 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) splice(r0, 0x0, r1, 0x0, 0x100000002, 0x0) [ 957.063181][T22833] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 957.100714][T22833] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 957.272977][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 958.313106][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 959.031330][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 959.352738][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:12 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB], 0x28}}, 0x0) 04:09:12 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) gettid() sendmsg$unix(r0, &(0x7f0000002780)={&(0x7f0000000000)=@abs={0x1}, 0x6e, 0x0}, 0x0) 04:09:12 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lookup_dcookie(0x0, 0x0, 0x0) 04:09:12 executing program 3: r0 = getpid() perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0) 04:09:12 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x11, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}}, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x53) 04:09:12 executing program 0: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x0, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(r0, 0xc0044dff, 0x0) 04:09:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB], 0x28}}, 0x0) 04:09:12 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0xb4, 0x4) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='htcp\x00', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2", 0xb0}], 0x1) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x2, 'xfrm0\x00', 0x3}, 0x18) r1 = semget(0x1, 0x2, 0x614) semctl$GETZCNT(r1, 0x4, 0xf, &(0x7f0000000100)=""/92) sendto$inet(r0, &(0x7f00000012c0)='\f', 0x2058, 0x3, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x240803, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x4000011) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) [ 959.999558][T22856] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 960.016666][T22856] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:12 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000bc0)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000008009500f10100000000487509101cba12c07d57d995b61e89a4530f923062242b416ae9eeefc0e9c60ebab1c17682dc2b9381b72b100d0682fd0a0c4906b29e220dc28dac72599456d4c4e6f638ac947b5e026a3287c84ccc727d6ef3834293812e927c01c7da1322da44c7f2ed1084aa2f56d1cb398dff1db3df9858837448a4ca03767c69ce5f2a2b7b96b0d0b4af216bd8ed42f7dd5adb8e49f4a94615e49c08c9a208e4557cd4ed88b37ab8674c499f5eb7b6bda92edf644dca2faffc836c98b58cf1fe50917b2c6b05e6001c29d7ca47dc62a087cc7f0e053927bc50e40a369aba3b08f0a8620c4d29eff8408ea28a6cb9fc8e7d360fced56ead5fa0c52f90bafb888ed8aa8d5d70cf2ec06edc22ca72157003b8beb850e2007f6118f6df8235d0fe1428c367c2d625414413dc04d025d4a6b727e1cd4bd9c6e123e37c81956901005352068bc40073b07ebe8e7023fb0ce22c76445275d13012e6d6e8304744704a88401b58461f89c9de98bbb0b91f080a0a6c0880e71efc8444c7a0bafa52c314250c709216f24d9e8ceb6ef708d56be4548dc36a359f0753174b766e0cfd836d81f7a18e02999483fc914f98eed61b12d87de304d73f4551301a24652a2c539c24af27a773bc206164fd64ed65fcc34c56040bf4c1315da2b2cbd54e4061eeef8aa908eae11a97af000000008b335accc588a66ce3155c7d14504a2c8e7f8ec8dd6ef48546127593b8b230c2496951629d7aab90cb7821e8aa04d014e935b4a10d5d8a4dc4ad752968981692612a6f7c93df32ea63b18ce9c3faa3e82ce9ce755b812732179b57c26791feb5bffd00119495faaeeaafeb8a06db79334b94c06e9c58bf51d551471ad77c4db23ab0a11fa42a3df2e91155d8c4c72cdbbbc08ca1b02c9c7869129f3335c0d88ba0455e75520a583fb71fea4688b0d4b07fb65c658ab8181e11ea9ed4430cac9da320b7228229778b93e30ebcdfc9e7abf1fbb802146c25ee958cec146b0f8c40e06f93b310f44b64b4c9dbc08836a7d7d4f1a422c9ec5c7cc0f459f80bc6403ed89a47373534822c3eedc3566062aaac6aac8e6fa89e950b0a37eb8fd5b1a60a3b07cc11669c14245ec90000000000000000002e4936d62ea967806def9c0f660e31ae510324f291619c9774012dc25becb0580b7769a045cf5d5247304b7bef6a670e9f210e767dd6b642f6471210b923195f440450d89b2087798b86eea72c95ee2917bd53d85587119c428c622335f7b720c5a2421ce526130214eaefbf157ffe18019629ee2fa725b1ffadad6b9031cb77bbd7664c225b374e1f685b69422f75ac59a5faece0bd56224de22a36e67399ac7ec683ef9754e545aa0d6dc13fca61a5e529db342b6b7c21ea0b27a2ac0203ad6ceca4e21ae99beccd9d8a1d88cd1c9285f9489f3ee451a2b09ca3864fb4db860a3ad8ae30e486f416223c3e73ccef12ff664eb3660c2756bc5981883f5ccbdea1e280d2cd8dd22316eb41b5374916b4616d517f38121f272ac5ffca6b5ae96d0000c9b214124c699d66cad430949bc59017726416fb7dab0c80c058dab92d6836b3d3a4baab45c25e9bcf3e80019f2f277bfd833fdeb63ffa2027b0e5576f23de92c4f431daef51ed007005bccf6236888b1b9c7b4f8e3928c15d8890b5d3d7c5c0b5c49ed87a6860a2e7a1aee429ead9461f411405cabc317d0f89cac733b82157cfa3acfae120a45a686c70b8f65adaf9fbc36a92bdbd86696b33b2a5ef8f75422f113dcd51acac11d7dc25baa2cd038a7713bffdf5e52e09e5c3a5a45faea786cc686cac8ac9b0250d67540ff2d3780940b07ca33f275ec87a37bd82c9785e354b1e0c0d71181fdbed87a8e330f3571511123ca3013b001e33f4f5fdf2a3afb959777c8c6a068eef797a6c851ec6d0c222f0bb81585ed37e77c776039957dc25afe90a5277e412270dad4d2d82de206cac3eb2bb81fd253154ddb22b050c465339fcf5c2a3b58447a74b9cddbe2fe9f532ffdd95f3d5f2dfdb34ff2ff350f650bfae6c5669bf4f90d478bd11ee7943255e9d1f790276b0290df22f9e2ccdd46da27fab23b59948d2a1573ccbd54254b274fceabba4328240492d3c53cb38e8e14171fe6ce82e5e19b3aef75645a2d244978849e5f89e549a20071b0a963fe0d45d9e02c8b56bb1ca0260"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x222}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xe80, 0xff000000, &(0x7f00000000c0)="b9ff03c6630d698cb89e0bf088ca1fffffff0e000000631177fbac141440e0", 0x0, 0x9}, 0x28) 04:09:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB], 0x28}}, 0x0) [ 960.066018][T22868] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 960.082986][T22868] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:12 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x28}}, 0x0) [ 960.128927][T22879] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 960.147472][T22879] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 960.394996][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 961.433576][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 962.071330][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 962.473267][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:15 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:15 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:09:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x28}}, 0x0) 04:09:15 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0xb4, 0x4) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='htcp\x00', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2", 0xb0}], 0x1) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x2, 'xfrm0\x00', 0x3}, 0x18) r1 = semget(0x1, 0x2, 0x614) semctl$GETZCNT(r1, 0x4, 0xf, &(0x7f0000000100)=""/92) sendto$inet(r0, &(0x7f00000012c0)='\f', 0x2058, 0x3, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x240803, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x4000011) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) 04:09:15 executing program 3: r0 = getpid() perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0) 04:09:15 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0xb4, 0x4) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='htcp\x00', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2", 0xb0}], 0x1) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x2, 'xfrm0\x00', 0x3}, 0x18) r1 = semget(0x1, 0x2, 0x614) semctl$GETZCNT(r1, 0x4, 0xf, &(0x7f0000000100)=""/92) sendto$inet(r0, &(0x7f00000012c0)='\f', 0x2058, 0x3, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x240803, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x4000011) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) 04:09:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00'], 0x28}}, 0x0) [ 963.037728][T22902] __nla_validate_parse: 2 callbacks suppressed [ 963.037738][T22902] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 963.061931][T22902] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:15 executing program 4: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0xb4, 0x4) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='htcp\x00', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2", 0xb0}], 0x1) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x2, 'xfrm0\x00', 0x3}, 0x18) r1 = semget(0x1, 0x2, 0x614) semctl$GETZCNT(r1, 0x4, 0xf, &(0x7f0000000100)=""/92) sendto$inet(r0, &(0x7f00000012c0)='\f', 0x2058, 0x3, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x240803, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x4000011) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) 04:09:15 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:09:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'], 0x28}}, 0x0) [ 963.160825][T22918] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 963.189808][T22918] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:15 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000000c0)=0xb4, 0x4) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='htcp\x00', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001780)="a45d4e26c6fadcbd663ccd6c0aca006b802c18d131b5427b3d4515dee8f10570a5923f3f543435278f94c3f8f0d4c35488ecfb1bd630b2e1e0e4247bb44938f03d603b27e44942ddcd3f11f086e6bf39ab074b690284b6d6aff6cc1e736b32f7d781c315bad312c6e8062089abe9838cd011d5227aa050589d2e5f34e10165336747bc2156f8e2570a4a76d4af1ef57edb31f57834ba2486c9f253a1737d59d15a11571414ec61c17dc20d9974e58cf2", 0xb0}], 0x1) recvmsg(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)}, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x2, 'xfrm0\x00', 0x3}, 0x18) r1 = semget(0x1, 0x2, 0x614) semctl$GETZCNT(r1, 0x4, 0xf, &(0x7f0000000100)=""/92) sendto$inet(r0, &(0x7f00000012c0)='\f', 0x2058, 0x3, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000380)='/dev/autofs\x00', 0x240803, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, 0x0, 0x4000011) setsockopt$inet_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) 04:09:15 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'], 0x28}}, 0x0) [ 963.260522][T22930] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 963.406773][T22940] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 963.522875][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 964.552967][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.111750][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 965.592975][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:18 executing program 4: sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x1) dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000280)=@assoc_value, &(0x7f0000002000)=0x8) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcf", 0x5}], 0x1, 0x1) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x0, 0x200, @dev, 0x6}, 0x1c) splice(r0, 0x0, r1, 0x0, 0x100000002, 0x0) 04:09:18 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:09:18 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'], 0x28}}, 0x0) 04:09:18 executing program 0: socket$inet6(0xa, 0x2, 0x0) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) socket$inet_udp(0x2, 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 04:09:18 executing program 3: r0 = getpid() perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x0, 0x8}}, r0, 0x0, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000240)=[{}], 0x1) semop(0x0, &(0x7f0000000240), 0x6) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x0) [ 966.048882][T22948] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:18 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$PIO_FONTX(r0, 0x4b6c, &(0x7f0000000680)={0x200, 0x0, &(0x7f0000000280)="14c94c50f5a7a19197ff13b9124068a73f8ff4d8cf16c13e16da1ab2286a3273262523b9820ca537ec6892d69b3ff2243b0c31aa891ee84eac37c53b3b6d18452b03644a6c6923343563616f5446a22a0653ace81a5397570cf87fd9dbc9e823efa06a3bfcf5f458a89f558f60ad5ea029174f6d14f970470eb2ca7abda89f05e63279074a2cbff9a3d34b4aa9df5449a7236de09ae6fa86dbefd73d6a8b4d0d4eb19ef5e974c5797d734ea17ebd299f0f20673bf211c39f4c9056daeab8877adc26f43ea11218eaa6123fc9f306cddc2e66d4c70cc72aaf42f039b52ab1af9aff2a1030f00eef697e3f10bca3586320a93f90e131ac5bcc4b3b56a044cd433ea6edbfeda8392f906e4c519e51f581cbc83d1816c2d93c11ab08d0af12965239be54dd2f69a486b775705ddfb96d827489f00f59d2d56f1d3d9ec3e447bd7054495e184829c02835440044845f61757b42a942e9ab0e7f624b71795fc29ed85eba7dbb79d54a7906c7377eac4f041b3ae17f1d37456f49faf0e56aac8b0ac0ce288c1cc0706c96fa78dee0b43874d93b3941fd7ab7f07f2ed124b5fc8fc5a2a7707cbd857f04a607c6ad2409e653bdbd78d9079e99e222605b480b00fd43384f3f6b01dfceb27332422c12dc29eacda41797459a5e0f663e474c155b831c792ab72bd06029fdf77b35ab52eeb5c99381300b891de03aecbdcfcfad8227cb206ed91896a1416d8c627b6092a3453907ea9c28ccc91044c1c73fc7a49bef0f76c5503151d84ec4720e07075744dbe61e86a8b81326a4a9fdc7924f24c88af3f29000c3dbaa7a2d1df46066d09ac8c1d1e933f4862950c79f58c889fe224309678a448ef938914da017615e2b8ba02b4617eeaf568a8f968890e0e2e9a6178278416005389f44eaa6366282bb05eb7d2ffbda5936a5df58bb42323d191b2250b9053e9d8b6ae4db24b49133930a4332f0a9fa1c64d8d8165cb3004587ffd3cf77ac5de31504938e3acb00b0d76cae5be362668ed915d83efa81e40da7cf84c9f0b4d6919e8fc61d0909129397be3bd766204e240c6a462484d36a0ce8bd7a03d6e132cf007391a6b46a301e712b40506a308f415489b3050cd9f3d13b7d5ccdb3e41190666ddc292e68d97e9198a1bceca42b24f95ea07873b4ff40bc82f68a811eb0b8e9033593137c06a30cc721ed149ccf91a50d57d6f96830b60715670bff78d7f3e12f6380580ea419274f17c5d430c75da5bc11cd5e4b1f320e3e22f364056cccdfc02f154dfe003dc1a31499f70232705e0b74b308e4d4266703c35bd2795af3a25f66088eff4276c2797d97ccfcae81863778633e70260a9256a91c91ab26b5963a22521c23ea7ff2d604ee09582b7a1a5a73dd882ab06a5c62776e290bee834f49826f397360c4c2df445e0429f5d40b5680454cda2ec88f2784dd7ed6"}) 04:09:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00'], 0x28}}, 0x0) 04:09:18 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x58, 0x0, &(0x7f0000000200)=[@free_buffer, @increfs, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x0, &(0x7f0000000280)='D'}) 04:09:18 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:09:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00'], 0x28}}, 0x0) [ 966.195906][T22977] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:18 executing program 4: r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0xfff, 0x0, 0x0, 0x0, 0x0, "0e89f581b4690d1a"}) ioctl$TIOCL_SELLOADLUT(r0, 0x541c, &(0x7f0000000080)={0x3}) 04:09:18 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32=r3, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00'], 0x28}}, 0x0) [ 966.246245][T22985] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:18 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) [ 966.310661][T22995] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 966.632876][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 967.673073][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 968.151445][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 968.722842][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:21 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:21 executing program 4: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = memfd_create(&(0x7f0000000340)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) write(r2, &(0x7f00000004c0)='1', 0x1) sendfile(r2, r2, &(0x7f0000000200), 0xff8) 04:09:21 executing program 0: socket$inet6(0xa, 0x2, 0x0) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) socket$inet_udp(0x2, 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 04:09:21 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) 04:09:21 executing program 3: socket$inet6(0xa, 0x2, 0x0) creat(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) socket$inet_udp(0x2, 0x2, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 04:09:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 969.130329][T23012] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 969.148758][T23012] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 969.211406][T23028] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 969.234742][T23028] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 969.284427][T23036] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 969.301049][T23036] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 969.405880][T23042] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) [ 969.541442][T23051] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:21 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/20, @ANYRES32, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:21 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) [ 969.710967][T23062] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 969.754578][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 970.803067][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.191339][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 971.832642][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:24 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xd0, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x4, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xea}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:24 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000580)={{0x0, 0x2, 0x3, 0x0, 'syz0\x00'}}) 04:09:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 04:09:24 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xf, 0xffffffffffffffff, 0x0) socket(0x11, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) socket(0x10, 0x0, 0x0) r0 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, 0x0) mq_timedreceive(r0, &(0x7f0000000180)=""/204, 0xcc, 0x0, 0x0) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) sigaltstack(&(0x7f0000455000/0x2000)=nil, 0x0) mremap(&(0x7f0000331000/0x3000)=nil, 0x4cb000, 0x600000, 0x3, &(0x7f00007fc000/0x600000)=nil) 04:09:24 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) 04:09:24 executing program 3: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000280)='./file1\x00', 0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000140)="25bca2740a0000002734fa0095e0612687ecb86a548802a902000000020000003cc00b0079a782d2250000000206e73ba8f4952bedc6760253ef", 0x3a, 0x400}], 0x0, &(0x7f0000000240)=ANY=[]) 04:09:24 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) recvmmsg(r1, &(0x7f0000000300), 0x64, 0x0, 0x0) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000000)=0x1, 0x4) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r2, 0x0, 0xffffffffffffffb5, 0x200007fe, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) [ 972.165140][T23081] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 972.305437][T23107] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 972.326650][T23107] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 972.336656][T23107] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready 04:09:24 executing program 3: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000380)={0x1f, 0x7, @fixed, 0x0, 0x2}, 0xe) 04:09:24 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 972.442360][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.451279][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.460549][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.469999][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.479177][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.487945][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 972.512826][T23107] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 972.524499][T23107] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 972.533859][T23107] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 974.952626][ T9199] net_ratelimit: 53 callbacks suppressed [ 974.952630][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:27 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x90, 0x90, 0x2, [@union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xaa}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:27 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:27 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x4, 0x0, &(0x7f0000000200)=[@exit_looper], 0x0, 0x0, 0x0}) 04:09:27 executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newlink={0x38, 0x10, 0xffffff1f, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ppp={{0x8, 0x1, 'ppp\x00'}, {0xc, 0x2, 0x0, 0x1, {0x8, 0x1, r1}}}}]}, 0x38}}, 0x0) 04:09:27 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) msgsnd(0x0, &(0x7f0000000000)={0x2}, 0x2000, 0x0) 04:09:27 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000100)={0x20}, 0x20) 04:09:27 executing program 0: pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) writev(r1, &(0x7f0000000080)=[{&(0x7f00000000c0)="580000001400", 0x6}], 0x1) close(r2) socket(0x10, 0x3, 0x6) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000380)="f98ac693ce6908", 0x7}, {&(0x7f0000000200)="cad9f6f14b6c3b4093dde79a3cdcf9f0797fd903b925b0396153edbff695da322a6e21944563309eaa12c3a9246dc44046cb71fc9d08e83a2c03e6c186bda8c676bf8b411bc334a072c17b", 0x4b}], 0x2) splice(r0, 0x0, r2, 0x0, 0x80000001, 0x0) 04:09:27 executing program 4: r0 = syz_open_dev$sndctrl(&(0x7f0000000040)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000580)={{0xa, 0x0, 0x0, 0x0, 'syz0\x00'}}) 04:09:27 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000180)={0x8, 0x1, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r3}) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0x5) 04:09:27 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$PIO_FONTX(r0, 0x4bfa, &(0x7f0000000680)={0x0, 0x0, 0x0}) 04:09:27 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 975.222650][T23135] __nla_validate_parse: 3 callbacks suppressed [ 975.222659][T23135] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 975.239086][T23139] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 975.263084][T23141] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. 04:09:27 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) sigaltstack(&(0x7f0000455000/0x2000)=nil, 0x0) mremap(&(0x7f0000331000/0x3000)=nil, 0x4cb000, 0x600000, 0x3, &(0x7f00007fc000/0x600000)=nil) [ 975.340945][T23154] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 975.993938][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 977.033229][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 977.271331][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 978.082818][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:30 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x90, 0x90, 0x2, [@union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xaa}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:30 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) dup(0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0}, 0x24008080) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, &(0x7f0000000040)) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x3b, &(0x7f00000004c0)=""/36, 0x0) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) splice(r0, 0x0, r1, 0x0, 0x100000002, 0x0) 04:09:30 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000", @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:30 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000023c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000000)="b9800000c035004000000f30d07531f5f50fdb090920e03500004000c4636569b3ce4b50330026660f3881694f0f0f5c193a9af342d8860080000066b82001c4220d2d4f5d2e66420fc73366ba2000ed", 0x50}], 0x1, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 04:09:30 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffffff144e0000ff000207835eebf116b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4e2540019ccbd9f6672837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab390c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000340)={0xa, 0x0, 0x0, @empty}, 0x1c) 04:09:30 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000100)={0x20}, 0x20) 04:09:30 executing program 4: sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000200), 0x8) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000140)=ANY=[], 0x28) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000640)=@raw={'raw\x00', 0x3c1, 0x3, 0x508, 0x268, 0x268, 0x0, 0x268, 0x268, 0x460, 0x460, 0x460, 0x460, 0x460, 0x3, 0x0, {[{{@uncond=[0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6], 0x0, 0x1f8, 0x240, 0x0, {}, [@common=@inet=@hashlimit2={{0x150, 'hashlimit\x00'}, {'hsr0\x00', {0x0, 0x7, 0x0, 0x0, 0x0, 0x5}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}, {{@ipv6={@remote, @mcast2, [], [], 'wg2\x00', 'ip6_vti0\x00'}, 0x0, 0xd0, 0x1f8, 0x0, {}, [@common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x0, 'system_u:object_r:update_modules_exec_t:s0\x00'}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x568) [ 978.223355][T23171] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 978.256853][T23175] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:30 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000", @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 978.271903][T23186] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 978.273360][T23175] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:30 executing program 0: 04:09:30 executing program 4: [ 978.322190][T23175] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 978.336779][T23175] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 978.348309][T23193] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 978.362674][T23175] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:30 executing program 0: mknod$loop(&(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0, 0x1) 04:09:30 executing program 4: r0 = socket(0x18, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x10, &(0x7f0000000000), 0x4) [ 978.395973][T23193] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:30 executing program 3: socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) dup(0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_PORTS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, 0x0}, 0x24008080) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, &(0x7f0000000040)) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) getsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x3b, &(0x7f00000004c0)=""/36, 0x0) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000300)={0xa, 0x0, 0x0, @dev, 0x6}, 0x1c) splice(r0, 0x0, r1, 0x0, 0x100000002, 0x0) [ 980.152889][T17953] net_ratelimit: 92 callbacks suppressed [ 980.152893][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 980.311892][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:33 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}, 0x210}, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x53) 04:09:33 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x90, 0x90, 0x2, [@union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xaa}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:33 executing program 4: sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)=@l2={0x1f, 0xffffdd86, @fixed}, 0x80, 0x0}, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={&(0x7f0000000040)=@nfc={0x27, 0x7}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000240)="0500010023000400fe", 0x9}], 0x1, 0x0, 0x0, 0x50}, 0x0) 04:09:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28000000100025080000", @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:33 executing program 3: 04:09:33 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000100)={0x20}, 0x20) [ 981.193411][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:33 executing program 3: 04:09:33 executing program 4: [ 981.285467][T23218] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:33 executing program 3: 04:09:33 executing program 4: 04:09:33 executing program 3: 04:09:33 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000", @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) [ 981.372609][T23226] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:33 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}, 0x210}, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x53) [ 981.475143][T23237] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 981.503156][T23237] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 982.233217][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 983.272918][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 983.351295][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:36 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:36 executing program 4: 04:09:36 executing program 3: 04:09:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000", @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:36 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:36 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x400000001, 0x70, 0x2005, 0x0, 0x0, 0x0, 0x0, 0x1, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_bp={0x0}, 0x210}, 0x0, 0xff7fffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x10b, 0x200007fe, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) sendto$inet(r2, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x53) 04:09:36 executing program 3: 04:09:36 executing program 3: [ 984.313569][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 984.337348][T23250] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:36 executing program 4: 04:09:36 executing program 3: [ 984.424877][T23256] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:36 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800000000000000", @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:36 executing program 4: [ 984.528321][T23266] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 984.546590][T23266] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 985.353190][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 986.391349][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 986.400300][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/18, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:39 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:39 executing program 3: 04:09:39 executing program 4: 04:09:39 executing program 0: 04:09:39 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:39 executing program 0: 04:09:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/18, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:39 executing program 4: [ 987.375050][T23277] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 987.402204][T23277] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:39 executing program 3: 04:09:39 executing program 0: 04:09:39 executing program 4: 04:09:39 executing program 0: [ 987.433163][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 987.451935][T23290] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 987.504019][T23298] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 988.473506][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 989.431257][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 989.513295][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:42 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:42 executing program 3: 04:09:42 executing program 4: 04:09:42 executing program 0: 04:09:42 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/18, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:42 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:42 executing program 0: 04:09:42 executing program 3: 04:09:42 executing program 4: [ 990.439035][T23306] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:42 executing program 3: 04:09:42 executing program 0: 04:09:42 executing program 4: [ 990.490490][T23316] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 990.555375][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 991.593058][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 992.471273][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 992.643068][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:45 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:45 executing program 3: 04:09:45 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/19, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:45 executing program 0: 04:09:45 executing program 4: 04:09:45 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read(0xffffffffffffffff, 0x0, 0x273) fanotify_mark(0xffffffffffffffff, 0x2000000000000011, 0x2, r0, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:45 executing program 3: 04:09:45 executing program 0: 04:09:45 executing program 3: 04:09:45 executing program 4: [ 993.487447][T23328] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:45 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read(0xffffffffffffffff, 0x0, 0x273) fanotify_mark(0xffffffffffffffff, 0x2000000000000011, 0x2, r0, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:45 executing program 0: [ 993.541405][T23336] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 993.673067][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 994.713135][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 995.511291][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 995.753197][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:48 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/19, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:48 executing program 4: 04:09:48 executing program 3: 04:09:48 executing program 0: 04:09:48 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) read(0xffffffffffffffff, 0x0, 0x273) fanotify_mark(0xffffffffffffffff, 0x2000000000000011, 0x2, r0, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:48 executing program 3: unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x22, &(0x7f0000000100)={'filter\x00'}, &(0x7f0000000180)=0x78) 04:09:48 executing program 2: r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) fanotify_mark(r0, 0x2000000000000011, 0x2, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:48 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x2000002, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x0) r3 = open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x0, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x200, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r3) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/95, 0x5f) perf_event_open(0x0, 0x0, 0x0, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) 04:09:48 executing program 0: clone(0x20002004ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) sigaltstack(&(0x7f0000455000/0x2000)=nil, 0x0) mremap(&(0x7f0000331000/0x3000)=nil, 0x4cb000, 0x600000, 0x3, &(0x7f00007fc000/0x600000)=nil) [ 996.512970][T23351] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 04:09:48 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000240)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r3, @ANYBLOB="00f0000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000250800"/19, @ANYRES32=r3, @ANYBLOB="000000000000000008000a0010"], 0x28}}, 0x0) 04:09:48 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x10) open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x80100, 0x0) poll(&(0x7f0000000300)=[{r2}, {}, {r2, 0x10}, {r1, 0x200}], 0x4, 0x1) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/95, 0x5f) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) [ 996.567887][T23351] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 996.650730][T23375] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 996.676170][T23375] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 996.802825][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 997.833183][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 998.551322][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 998.872941][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:51 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:51 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x2000002, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x0) r3 = open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x0, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0x200, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) dup2(0xffffffffffffffff, r3) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/95, 0x5f) perf_event_open(0x0, 0x0, 0x0, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) 04:09:51 executing program 0: pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) sendfile(r0, 0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x37cb1133) socket$inet(0x2, 0x3, 0x33) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000080)={0x0, 0x8000}, 0x4) syz_genetlink_get_family_id$netlbl_unlabel(0x0) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0xc60}]}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r2, &(0x7f0000000180)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) connect$inet(r2, &(0x7f0000000100)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r2, 0x0, 0x19404, 0x0) 04:09:51 executing program 3: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc08c5334, &(0x7f0000000040)={0x0, 0x0, 'client0\x00', 0x0, "2e844f5104efdee9", "b47177d464bcc7db865ea40a4e45f474a76ca7ebde972e65b1fc541ff1486aa0"}) 04:09:51 executing program 5: unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0x19, &(0x7f0000000100)={'filter\x00'}, &(0x7f0000000180)=0x78) 04:09:51 executing program 2: r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) fanotify_mark(r0, 0x2000000000000011, 0x2, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:51 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)) 04:09:51 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x10) open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x200, 0x0) r3 = open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) dup2(r3, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x80100, 0x0) poll(&(0x7f0000000300)=[{r2, 0x10}, {}, {r2, 0x10}, {r1, 0x200}], 0x4, 0x1) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/95, 0x5f) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x5, 0x0, 0x1, 0x0, 0x200000000003f, 0x288ad, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={0x0, 0x5}, 0x4000, 0x6, 0x5, 0x3, 0x0, 0x0, 0x6}, 0x0, 0x6, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) 04:09:51 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) 04:09:51 executing program 5: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0a85320, &(0x7f0000000040)={0x0, 0x0, 'client0\x00', 0x0, "2e844f5104efdee9", "b47177d464bcc7db865ea40a4e45f474a76ca7ebde972e65b1fc541ff1486aa0"}) 04:09:51 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x10) open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x200, 0x0) r3 = open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) dup2(r3, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x80100, 0x0) poll(&(0x7f0000000300)=[{r2, 0x10}, {r2, 0x10}, {r1, 0x200}], 0x3, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/95, 0x5f) perf_event_open(0x0, 0x0, 0x6, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) 04:09:51 executing program 5: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x2000002, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x10) open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x5, 0x0, 0x1, 0x0, 0x200000000003f, 0x288ad, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={0x0, 0x5}, 0x4000, 0x6, 0x5, 0x3, 0x0, 0x0, 0x6}, 0x0, 0x6, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) [ 999.913094][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1000.953168][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1001.591323][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1002.003811][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:54 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:54 executing program 3: mkdir(&(0x7f0000000340)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='fuse\x00', 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) preadv(r0, &(0x7f0000000740)=[{&(0x7f0000002900)=""/165, 0xa5}], 0x1, 0x0, 0x0) mknod$loop(&(0x7f00000001c0)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000000780), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1e}}, 0x50) read$FUSE(r0, &(0x7f0000001780), 0x1000) write$FUSE_ENTRY(r0, &(0x7f0000002840)={0x90, 0x0, 0x2}, 0x90) write$FUSE_ENTRY(r0, &(0x7f0000000380)={0x90, 0x0, 0x3, {0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}}}, 0x90) 04:09:54 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x10) open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x200, 0x0) r3 = open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) dup2(r3, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x80100, 0x0) poll(&(0x7f0000000300)=[{r2, 0x10}, {r2, 0x10}, {r1, 0x200}], 0x3, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/95, 0x5f) perf_event_open(0x0, 0x0, 0x6, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) 04:09:54 executing program 5: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x2000002, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x10) open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x5, 0x0, 0x1, 0x0, 0x200000000003f, 0x288ad, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={0x0, 0x5}, 0x4000, 0x6, 0x5, 0x3, 0x0, 0x0, 0x6}, 0x0, 0x6, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) 04:09:54 executing program 2: r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) fanotify_mark(r0, 0x2000000000000011, 0x2, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:09:54 executing program 0: r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc008551b, 0x0) 04:09:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000040)=0x6) ioctl$KVM_SET_CPUID(r2, 0xae80, 0x0) 04:09:54 executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x19, &(0x7f0000000040), 0x4) 04:09:54 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = open$dir(&(0x7f0000000140)='./file0\x00', 0x2, 0x10) open(0x0, 0x42202, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x200, 0x0) r3 = open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) dup2(r3, 0xffffffffffffffff) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0\x00', 0x0, 0x0) poll(&(0x7f0000000300)=[{r2, 0x10}, {}, {r2, 0x10}, {r1, 0x200}], 0x4, 0x1) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/95, 0x5f) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x0, 0x5, 0x0, 0x1, 0x0, 0x200000000003f, 0x288ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={0x0, 0x5}, 0x4000, 0x6, 0x5, 0x3, 0x0, 0x0, 0x6}, 0x0, 0x6, 0xffffffffffffffff, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {&(0x7f00000003c0)='7', 0x1}], 0x2) 04:09:54 executing program 4: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)) [ 1002.604459][T23427] fuse: Bad value for 'fd' [ 1002.611828][T23430] fuse: Bad value for 'fd' 04:09:54 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) 04:09:55 executing program 0: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'lo\x00'}) [ 1003.034018][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1004.083266][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1004.632009][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1005.123226][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:09:57 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:09:57 executing program 4: syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f00000003c0)='./file1\x00', 0xffffffff, 0x1, &(0x7f0000000080)=[{&(0x7f00000000c0)="040005090000000066617400040409000200027400f801", 0x17}], 0x0, &(0x7f00000004c0)=ANY=[]) chdir(&(0x7f0000000240)='./file1\x00') perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) open(0x0, 0x0, 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0x175d900f) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) 04:09:57 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000180)={0x8, 0x1, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r3}) dup2(r4, r0) 04:09:57 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x2000002, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) open$dir(0x0, 0x0, 0x0) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) open$dir(0x0, 0x0, 0x0) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}], 0x1) 04:09:57 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) 04:09:57 executing program 2: r0 = creat(0x0, 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:09:57 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/kcm\x00') ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x1}) 04:09:58 executing program 3: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0x402c5342, &(0x7f0000000040)={0x0, 0x0, 'client0\x00', 0x0, "2e844f5104efdee9", "b47177d464bcc7db865ea40a4e45f474a76ca7ebde972e65b1fc541ff1486aa0"}) 04:09:58 executing program 5: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0x404c534a, &(0x7f0000000040)={0x0, 0x0, 'client0\x00', 0x0, "2e844f5104efdee9", "b47177d464bcc7db865ea40a4e45f474a76ca7ebde972e65b1fc541ff1486aa0"}) 04:09:58 executing program 0: unshare(0x2c020400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$EBT_SO_GET_INIT_INFO(r1, 0x0, 0xf, &(0x7f0000000100)={'filter\x00'}, &(0x7f0000000180)=0x78) 04:09:58 executing program 3: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) r1 = openat$ion(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000180)={0x8, 0x1, 0x0, 0xffffffffffffffff}) r3 = dup(r2) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r3}) 04:09:58 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x69991}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0) [ 1005.824547][T23486] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1005.848761][T23486] device ipvlan2 entered promiscuous mode [ 1006.153744][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1007.193175][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1007.671257][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1008.242972][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:00 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:00 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000004e00)={&(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000b57000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000d90000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000915000/0x4000)=nil, 0x0}, 0x68) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='net/fib_triestat\x00') preadv(r2, &(0x7f00000017c0), 0x365, 0x0, 0x0) 04:10:00 executing program 0: syz_mount_image$btrfs(&(0x7f0000000300)='btrfs\x00', &(0x7f0000000340)='./file1\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000001a80)={[], [{@defcontext={'defcontext', 0x3d, 'user_u'}}, {@context={'context', 0x3d, 'user_u'}}]}) 04:10:00 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x69991}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}]}, 0x48}}, 0x0) 04:10:00 executing program 4: syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f00000003c0)='./file1\x00', 0xffffffff, 0x1, &(0x7f0000000080)=[{&(0x7f00000000c0)="040005090000000066617400040409000200027400f801", 0x17}], 0x0, &(0x7f00000004c0)=ANY=[]) chdir(&(0x7f0000000240)='./file1\x00') perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) open(0x0, 0x0, 0x0) write$cgroup_type(r0, &(0x7f0000000200)='threaded\x00', 0x175d900f) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) 04:10:00 executing program 2: r0 = creat(0x0, 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:01 executing program 0: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000440)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200047ad, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) 04:10:01 executing program 3: mkdir(&(0x7f0000000040)='./file0\x00', 0x134) mount(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x2000002, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x387}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = open$dir(0x0, 0x2, 0x10) r3 = open(&(0x7f0000000080)='./bus\x00', 0x42202, 0x0) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x200, 0x0) open$dir(&(0x7f0000000180)='./file0\x00', 0x7e, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) r4 = syz_open_dev$tty1(0xc, 0x4, 0x4) write$binfmt_elf64(r4, &(0x7f0000000400)={{0x1b, 0x5b, 0x50, 0x7, 0x0, 0x0, 0xf8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x38, 0x0, 0x1}, [{0x0, 0x9, 0xcc, 0x7fffffff, 0x8, 0x6, 0x1, 0x9}, {0x1, 0xe2d9, 0x0, 0x0, 0x5, 0x0, 0x0, 0x1}]}, 0xb0) ioctl$GIO_UNISCRNMAP(r4, 0x4b69, &(0x7f0000000780)=""/4096) splice(r2, 0x0, r3, 0x0, 0x200, 0x0) open$dir(0x0, 0x0, 0x0) dup2(0xffffffffffffffff, r3) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x5, 0x0, 0x1, 0x0, 0x200000000003f, 0x288ad, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x0, @perf_bp={0x0}, 0x4000, 0x6, 0x0, 0x3, 0x0, 0x0, 0x6}, 0x0, 0x6, r0, 0x2) writev(r1, &(0x7f00000001c0)=[{&(0x7f00000003c0)='7', 0x1}], 0x1) 04:10:01 executing program 5: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0x402c5342, &(0x7f0000000040)={0x0, 0x1f00, 'client0\x00', 0x0, "2e844f5104efdee9", "b47177d464bcc7db865ea40a4e45f474a76ca7ebde972e65b1fc541ff1486aa0"}) [ 1008.665689][T23496] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1008.687688][T23496] device ipvlan3 entered promiscuous mode 04:10:01 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r0, 0xc0045516, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) 04:10:01 executing program 0: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c43, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) creat(0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)=ANY=[@ANYBLOB="e00000027f0000010100000002"], 0x18) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) 04:10:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='net/kcm\x00') ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2, 0x0, 0x2, r3}) [ 1009.272891][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1010.313371][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1010.711398][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1011.352714][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:03 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:03 executing program 3: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0a85322, &(0x7f0000000040)={0x10, 0x0, 'client0\x00', 0x0, "2e844f5104efdee9", "b471f474a76ca7ebde972e65b1fc541ff1486aa00000000000001d00"}) 04:10:03 executing program 5: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) open$dir(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) open(0x0, 0x0, 0x0) open$dir(0x0, 0x0, 0x0) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}], 0x1) 04:10:03 executing program 0: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/kcm\x00') dup3(r1, r0, 0x0) 04:10:03 executing program 4: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snd/seq\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r0, 0xc0bc5351, &(0x7f0000000040)={0x40, 0x0, 'client0\x00', 0x0, "2e844f5104efdee9", "b471f474a76ca7ebde972e65b1fc541ff1486aa00000000000001d00"}) 04:10:03 executing program 2: r0 = creat(0x0, 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:04 executing program 4: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmstat\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0x100000064) 04:10:04 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x0, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r1, r0, 0x0) 04:10:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000032000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="b9800000c00f3235010000000f309a090000006500660f3882af724d00002ed8ddc74424008fc4bd87c7442402c43a727fc7442406000000000f011424f30f090f013a360f06c4c18d72d68366baa100ed", 0x51}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000bf7000)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x4, 0x0, 0x40000007, 0x0, 0x0, 0x0, 0x4cb]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 04:10:04 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x44, 0x0, &(0x7f00000000c0)=[@reply={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0}) 04:10:04 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_mr_cache\x00') preadv(r0, &(0x7f0000000080)=[{&(0x7f0000000140)=""/243, 0xf3}], 0x1, 0xffffffff, 0x0) 04:10:04 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='cpuset\x00', 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000002c0)='cpuset.sched_load_balance\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) socket(0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, 0x0) open$dir(0x0, 0x0, 0x0) open$dir(0x0, 0x7e, 0x0) writev(r1, &(0x7f00000001c0)=[{&(0x7f0000000280)='0', 0x1}, {0x0}], 0x2) [ 1012.403171][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1013.443518][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1013.751304][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1014.473577][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:07 executing program 5: r0 = socket$inet6(0xa, 0x2000000080803, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@empty, @in, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in6=@local, 0x0, 0x32}, 0x0, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0x1, 0x8464, 0x0, 0x0, 0xfffffffe}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) 04:10:07 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:07 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x6) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f00000002c0)=""/160) 04:10:07 executing program 0: unshare(0x44000600) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x4b47, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) 04:10:07 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:07 executing program 4: getpid() splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x100000, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, 0x0, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(0xffffffffffffffff, 0x0, 0x0) gettid() ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/vmallocinfo\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendfile(r2, r1, 0x0, 0x100000064) 04:10:07 executing program 5: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cpuinfo\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0x100000064) 04:10:07 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:07 executing program 3: r0 = socket$inet6(0xa, 0x2000000080803, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@empty, @in, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in, 0x0, 0x32}, 0x0, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x0, 0x0, 0x8464}}, 0xe8) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) [ 1014.769091][T23580] IPVS: ftp: loaded support on port[0] = 21 04:10:07 executing program 4: seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x6) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) ioctl$EVIOCGPHYS(r0, 0x80044584, &(0x7f00000002c0)=""/160) 04:10:07 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) listen(r0, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_emit_ethernet(0x4e, &(0x7f0000000080)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0c3ff2", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@sack={0x2, 0x4}]}}}}}}}}, 0x0) 04:10:07 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x2}], 0x0, 0x0, 0x0}) [ 1014.835239][T23580] IPVS: ftp: loaded support on port[0] = 21 04:10:07 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r9 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r9, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) [ 1014.899867][T17225] tipc: TX() has been purged, node left! [ 1015.037626][ T28] audit: type=1804 audit(1596946207.319:239): pid=23648 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=15858 res=1 errno=0 [ 1015.523542][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1015.632824][T17225] tipc: TX() has been purged, node left! [ 1016.553223][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1016.791359][ T5086] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1017.593067][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:10 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:10 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:10 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000001340)={{0x12, 0x1, 0x0, 0xed, 0x11, 0x5d, 0x40, 0x2001, 0x1a02, 0xf89b, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x2e, 0x5d, 0x8b}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000800)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x40, 0x13, 0x6, @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 04:10:10 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x6) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 04:10:10 executing program 5: unshare(0x44000600) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x0, 0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000100)) 04:10:10 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r9 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r9, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:10 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(0xffffffffffffffff, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:10 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r9 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r9, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) [ 1017.807489][T23656] IPVS: ftp: loaded support on port[0] = 21 04:10:10 executing program 5: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0xfffffe58) pwritev2(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="12", 0x1}], 0x1, 0x0, 0x0, 0x0) dup3(r1, r0, 0x0) [ 1017.875475][T23656] IPVS: ftp: loaded support on port[0] = 21 [ 1017.906731][ T28] audit: type=1804 audit(1596946210.189:240): pid=23702 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16251 res=1 errno=0 [ 1017.931760][ T7] tipc: TX() has been purged, node left! [ 1017.991891][ T28] audit: type=1804 audit(1596946210.269:241): pid=23718 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir857460139/syzkaller.mI8IX7/822/bus" dev="sda1" ino=16246 res=1 errno=0 04:10:10 executing program 5: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0xfffffe58) pwritev2(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="12", 0x1}], 0x1, 0x0, 0x0, 0x0) dup3(r1, r0, 0x0) 04:10:10 executing program 0: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$cgroup_type(r1, &(0x7f0000000080)='threaded\x00', 0xfffffe58) pwritev2(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="12", 0x1}], 0x1, 0x0, 0x0, 0x0) dup3(r1, r0, 0x0) 04:10:10 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(0xffffffffffffffff, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) [ 1018.643986][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1019.031993][ T7] tipc: TX() has been purged, node left! [ 1019.673346][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1019.832042][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1020.713191][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:13 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:13 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r9 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r9, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:13 executing program 3: getpid() splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x100000, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000140)='devlink\x00') sendmsg$DEVLINK_CMD_GET(0xffffffffffffffff, 0x0, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(0xffffffffffffffff, 0x0, 0x0) gettid() ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x8801) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/vmallocinfo\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendfile(r2, r1, 0x0, 0x100000064) 04:10:13 executing program 0: r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB="1201000039542f108c07021047e6000000010902240001000000000904db00010a04c80009210300000000010009050a"], 0x0) syz_usb_control_io$printer(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="0080ea00000084"], 0x0}, 0x0) 04:10:13 executing program 5: ioctl$TCSETXW(0xffffffffffffffff, 0x5435, &(0x7f0000000140)={0x0, 0x0, [], 0x98}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = fcntl$dupfd(r2, 0x0, r3) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x200000003, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r5, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r5, 0x0, 0x19401, 0x0) 04:10:13 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(0xffffffffffffffff, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:13 executing program 3: r0 = syz_open_dev$binderN(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x8, 0xfeffff, &(0x7f0000000200)=[@increfs={0x40046305}], 0x1, 0x0, &(0x7f0000000280)='D'}) [ 1020.843046][T23747] xt_CT: netfilter: NOTRACK target is deprecated, use CT instead or upgrade iptables 04:10:13 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x6) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f00000002c0)=""/160) clone(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) 04:10:13 executing program 3: unshare(0x44000600) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80284504, 0x0) [ 1020.946394][ T28] audit: type=1804 audit(1596946213.229:242): pid=23757 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16233 res=1 errno=0 [ 1021.031502][T23766] IPVS: ftp: loaded support on port[0] = 21 [ 1021.074392][T23766] IPVS: ftp: loaded support on port[0] = 21 04:10:13 executing program 3: unshare(0x44000600) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80284504, 0x0) [ 1021.122035][T11912] tipc: TX() has been purged, node left! [ 1021.155699][T23810] IPVS: ftp: loaded support on port[0] = 21 04:10:13 executing program 3: unshare(0x44000600) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80284504, 0x0) 04:10:13 executing program 3: unshare(0x44000600) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x80284504, 0x0) [ 1021.234035][T23832] IPVS: ftp: loaded support on port[0] = 21 [ 1021.313788][T23854] IPVS: ftp: loaded support on port[0] = 21 [ 1021.761489][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1021.842763][T11912] tipc: TX() has been purged, node left! [ 1021.849696][T11912] tipc: TX() has been purged, node left! [ 1021.856345][T11912] tipc: TX() has been purged, node left! [ 1021.862504][T11912] tipc: TX() has been purged, node left! [ 1022.803345][ T9199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1022.871340][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:16 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:16 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000080)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1}}]}}, &(0x7f0000000480)={0x0, 0x0, 0x7d, &(0x7f0000000140)={0x5, 0xf, 0x7d, 0x1, [@generic={0x78, 0x10, 0xa, "241a5be67492629353bbbcc8f6e16da29fb23c91dc2cf1855541a82951c8667fd299a4f105a9b3bc0706820ad78db9a947b408504745487b6d86b0efa0ba1985b09f36116c8a605ad8b7dbef34f3fe5ca3e24144547569c8de3ca4ceb8c5dced83885d5a0fe98c3ee3c1e6d31ee3c6bb6c98c3dbc0"}]}}) 04:10:16 executing program 3: unshare(0x44000600) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) 04:10:16 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x0, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:16 executing program 5: ioctl$TCSETXW(0xffffffffffffffff, 0x5435, &(0x7f0000000140)={0x0, 0x0, [], 0x98}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = fcntl$dupfd(r2, 0x0, r3) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x200000003, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r5, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r5, 0x0, 0x19401, 0x0) 04:10:16 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r9 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r9, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) [ 1023.833886][T23879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1023.872742][T23888] IPVS: ftp: loaded support on port[0] = 21 04:10:16 executing program 3: unshare(0x44000600) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) [ 1023.935893][T11912] tipc: TX() has been purged, node left! [ 1023.966931][T23921] IPVS: ftp: loaded support on port[0] = 21 04:10:16 executing program 3: unshare(0x44000600) syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) [ 1023.995462][ T28] audit: type=1804 audit(1596946216.279:243): pid=23924 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16232 res=1 errno=0 04:10:16 executing program 3: unshare(0x44000600) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80284504, 0x0) [ 1024.084293][T23947] IPVS: ftp: loaded support on port[0] = 21 04:10:16 executing program 3: unshare(0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80284504, 0x0) [ 1024.152766][T23969] IPVS: ftp: loaded support on port[0] = 21 04:10:16 executing program 3: unshare(0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80284504, 0x0) 04:10:16 executing program 3: unshare(0x0) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x80284504, 0x0) [ 1024.732131][T11912] tipc: TX() has been purged, node left! [ 1024.738476][T11912] tipc: TX() has been purged, node left! [ 1024.745796][T11912] tipc: TX() has been purged, node left! [ 1024.882922][T23879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1025.911522][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1025.922821][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:19 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:19 executing program 3: ioctl$TCSETXW(0xffffffffffffffff, 0x5435, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x3], 0x98}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = fcntl$dupfd(r2, 0x0, r3) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x200000003, 0x84) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) connect$inet(r5, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r5, 0x0, 0x19401, 0x0) 04:10:19 executing program 0: ioctl$TCSETXW(0xffffffffffffffff, 0x5435, &(0x7f0000000140)={0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x3], 0x98}) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = fcntl$dupfd(r2, 0x0, r3) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000180)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020000000000000000000000000000000000009802000098020000980700009802000098020000030080000000000000000000ffffffffe00000010000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000800000000000002726f7365300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000fb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000100000000000000000000000000000000ee00000000000000000000000000000000000000000000000000000000000000000000000000200000000000000500000000000400000000000000000000000000000070009000000000000000000000000000000000000000010020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) close(r5) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) socket$inet(0x2, 0x200000003, 0x84) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) bind$inet(r5, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r5, &(0x7f0000001280)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r5, 0x0, 0x19401, 0x0) 04:10:19 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x1909}, @qdisc_kind_options=@q_clsact={0xb, 0x1, 'clsact\x00'}]}, 0x38}, 0x1, 0x6000000000000000}, 0x0) 04:10:19 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x0, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:19 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:19 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r2, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0x1909}, @qdisc_kind_options=@q_clsact={0xb, 0x1, 'clsact\x00'}]}, 0x38}, 0x1, 0x6000000000000000}, 0x0) [ 1026.963115][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:19 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_read_part_table(0x0, 0xb784, &(0x7f0000000040)=[{&(0x7f0000000000)="020182ffffff0a000000ff45ac0000ffffffa500e93119000000000000068000000005000000e100e2ff877700720030070081ffffff00000000008000da55aa", 0x40, 0x1c0}]) [ 1027.015191][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.035002][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.050872][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.062882][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.072375][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.072655][ T28] audit: type=1804 audit(1596946219.359:244): pid=24018 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16252 res=1 errno=0 [ 1027.081909][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.110152][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.127373][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1027.155770][T24017] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:19 executing program 5: r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x6) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) ioctl$EVIOCGPHYS(r0, 0x80084502, &(0x7f00000002c0)=""/160) 04:10:19 executing program 5: getpid() socket$nl_generic(0x10, 0x3, 0x10) gettid() r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) gettid() perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/vmallocinfo\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendfile(r2, r1, 0x0, 0x100000064) 04:10:19 executing program 5: getpid() socket$nl_generic(0x10, 0x3, 0x10) gettid() r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, r0, 0x0, 0x0) gettid() perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/vmallocinfo\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendfile(r2, r1, 0x0, 0x100000064) 04:10:19 executing program 5: seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000000)) r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x6) write$binfmt_elf64(r0, &(0x7f00000000c0)=ANY=[], 0xffffffe8) ioctl$EVIOCGPHYS(r0, 0x80404507, &(0x7f00000002c0)=""/160) clone(0x0, 0x0, 0x0, 0x0, 0x0) 04:10:22 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:22 executing program 5: unshare(0x44000600) r0 = syz_open_dev$evdev(&(0x7f0000000040)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE_V2(r0, 0x400445a0, 0x0) 04:10:22 executing program 3: r0 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x6) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0xffffffe8) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$NLBL_MGMT_C_REMOVE(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@NLBL_MGMT_A_FAMILY={0x6}]}, 0x1c}}, 0x4000000) ioctl$F2FS_IOC_SET_PIN_FILE(r0, 0x4004f50d, 0x0) ioctl$EVIOCGSND(r0, 0x8040451a, &(0x7f0000000180)=""/4096) clone(0x0, 0x0, 0x0, 0x0, 0x0) 04:10:22 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x0, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:22 executing program 0: 04:10:22 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:22 executing program 0: 04:10:22 executing program 3: 04:10:22 executing program 3: [ 1029.985731][T24041] IPVS: ftp: loaded support on port[0] = 21 04:10:22 executing program 0: 04:10:22 executing program 3: [ 1030.060472][T24041] IPVS: ftp: loaded support on port[0] = 21 04:10:22 executing program 5: [ 1030.104640][ T28] audit: type=1804 audit(1596946222.389:245): pid=24092 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16273 res=1 errno=0 [ 1030.132792][T17185] tipc: TX() has been purged, node left! [ 1030.881479][T17185] tipc: TX() has been purged, node left! [ 1031.991491][ T12] net_ratelimit: 12 callbacks suppressed [ 1031.991496][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1032.152728][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:25 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:25 executing program 0: 04:10:25 executing program 5: 04:10:25 executing program 3: 04:10:25 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x0, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:25 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:25 executing program 3: 04:10:25 executing program 5: 04:10:25 executing program 0: 04:10:25 executing program 3: 04:10:25 executing program 5: 04:10:25 executing program 0: [ 1033.137476][ T28] audit: type=1804 audit(1596946225.419:246): pid=24121 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16239 res=1 errno=0 [ 1033.203344][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1034.233244][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1035.031395][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1035.272903][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:28 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:28 executing program 3: 04:10:28 executing program 5: 04:10:28 executing program 0: 04:10:28 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x0, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:28 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) sendfile(r5, 0xffffffffffffffff, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:28 executing program 5: 04:10:28 executing program 3: 04:10:28 executing program 0: 04:10:28 executing program 0: 04:10:28 executing program 5: 04:10:28 executing program 3: [ 1036.313305][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1037.353254][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1038.071326][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1038.402740][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:31 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:31 executing program 5: 04:10:31 executing program 0: 04:10:31 executing program 3: 04:10:31 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x0, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:31 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) sendfile(r5, 0xffffffffffffffff, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:31 executing program 5: 04:10:31 executing program 0: 04:10:31 executing program 3: 04:10:31 executing program 5: 04:10:31 executing program 0: 04:10:31 executing program 3: [ 1039.433999][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1040.473223][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1041.111349][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1041.513150][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:34 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:34 executing program 5: 04:10:34 executing program 3: 04:10:34 executing program 0: 04:10:34 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) fanotify_mark(r0, 0x2000000000000011, 0x2, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:10:34 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) sendfile(r5, 0xffffffffffffffff, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:34 executing program 0: 04:10:34 executing program 3: 04:10:34 executing program 5: 04:10:34 executing program 3: 04:10:34 executing program 0: 04:10:34 executing program 5: [ 1042.564348][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1043.592785][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1044.151779][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1044.633085][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:37 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:37 executing program 0: 04:10:37 executing program 3: 04:10:37 executing program 5: 04:10:37 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) fanotify_mark(r0, 0x2000000000000011, 0x2, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:10:37 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)) r6 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:37 executing program 3: 04:10:37 executing program 5: 04:10:37 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000340)={&(0x7f0000000080)=@in={0x10, 0x2}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=[@sndrcv={0x2c}, @dstaddrv6={0x1c, 0x84, 0xa, @rand_addr=' \x01\x00'}], 0x48}, 0x0) 04:10:37 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x19, &(0x7f0000000080), &(0x7f00000000c0)=0x8) 04:10:37 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x1, &(0x7f0000000000), &(0x7f0000000100)=0x10) 04:10:37 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000000), 0x8c) [ 1045.299474][ T28] audit: type=1804 audit(1596946237.579:247): pid=24201 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16082 res=1 errno=0 [ 1045.673072][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1046.713153][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1047.192180][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1047.753104][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:40 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:40 executing program 0: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) r1 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x105, &(0x7f00000016c0)={0x1, [0x0]}, &(0x7f0000001700)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x108, &(0x7f0000000080)={r2}, &(0x7f00000000c0)=0x18) 04:10:40 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xe, &(0x7f0000000000), &(0x7f0000000040)=0x8) 04:10:40 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000000), 0x8c) 04:10:40 executing program 2: creat(&(0x7f00000001c0)='./bus\x00', 0x0) r0 = fanotify_init(0x0, 0x0) read(r0, 0x0, 0x273) fanotify_mark(r0, 0x2000000000000011, 0x2, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r1, &(0x7f0000000100)={0x20}, 0x20) 04:10:40 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)) r6 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:40 executing program 5: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) setsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xffffffff}, 0x14) 04:10:40 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x18, &(0x7f0000000000), &(0x7f0000000040)=0x4) 04:10:40 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x16, &(0x7f00000000c0)={0x0, 0x7ff}, 0x8) 04:10:40 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0xa, &(0x7f0000000100), &(0x7f00000001c0)=0x98) 04:10:40 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0xf, &(0x7f0000000340), 0xc) 04:10:40 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) bind$inet(r0, &(0x7f0000000180)={0x10, 0x2}, 0x10) [ 1048.332193][ T28] audit: type=1804 audit(1596946240.619:248): pid=24234 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16209 res=1 errno=0 [ 1048.793190][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1049.832912][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1050.231420][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1050.883450][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:43 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r0, &(0x7f0000000080)={0x10, 0x2}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x10, 0x2}, 0x10) 04:10:43 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0xf, &(0x7f0000000340), 0xc) 04:10:43 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:43 executing program 5: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) r1 = dup2(r0, r0) sendmsg$inet_sctp(r1, &(0x7f00000004c0)={&(0x7f00000000c0)=@in={0x10, 0x2}, 0x10, 0x0, 0x0, 0x0, 0x1c}, 0x0) setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x1203, &(0x7f0000000140)=ANY=[], 0x3ef) 04:10:43 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(0x0, 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:43 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)) r6 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:43 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x103, &(0x7f0000000000)={0x0, 0x2, "79e8"}, &(0x7f0000000040)=0xa) 04:10:43 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0x101, &(0x7f0000000200), &(0x7f0000000340)=0xa0) 04:10:43 executing program 5: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) r1 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x23, &(0x7f0000000200), &(0x7f0000000180)=0x94) 04:10:43 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x900, &(0x7f00000001c0), &(0x7f0000000200)=0x8) 04:10:43 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xb, &(0x7f0000000000), 0x20) 04:10:43 executing program 5: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) r1 = dup2(r0, r0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x105, &(0x7f00000016c0)=ANY=[], &(0x7f0000001700)=0x8) r2 = socket$inet6_sctp(0x1c, 0x5, 0x84) r3 = dup2(r2, r2) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x105, &(0x7f00000016c0)={0x1, [0x0]}, &(0x7f0000001700)=0x8) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x19, &(0x7f0000000080), &(0x7f00000000c0)=0x8) 04:10:43 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000040)={0x10, 0x2}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x10, 0x2}, 0x10) [ 1051.373436][ T28] audit: type=1804 audit(1596946243.659:249): pid=24281 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16232 res=1 errno=0 [ 1051.922707][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1052.952977][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1053.271407][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1053.993131][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:46 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd4, 0xd4, 0x2, [@func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xee}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:46 executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0xa, &(0x7f00000000c0)={0x0, @in, 0x1}, 0xa0) 04:10:46 executing program 0: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000100)="2fe24de5c1", 0x5, 0x0, &(0x7f0000000180)={0x1c, 0x1c, 0x3}, 0x1c) shutdown(r0, 0x1) 04:10:46 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000040)={0x10, 0x2}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x10, 0x2}, 0x10) r1 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x3}, 0x1c) r2 = dup2(r1, r1) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x105, &(0x7f00000016c0)=ANY=[], &(0x7f0000001700)=0x8) r3 = socket$inet6_sctp(0x1c, 0x5, 0x84) r4 = dup2(r3, r3) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x105, &(0x7f00000016c0)={0x1, [0x0]}, &(0x7f0000001700)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x102, &(0x7f0000000080)={r5, 0x2, "748f"}, &(0x7f0000000140)=0xa) getsockopt$inet_sctp_SCTP_PR_STREAM_STATUS(r2, 0x84, 0x107, &(0x7f0000000180), &(0x7f00000001c0)=0x18) 04:10:46 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(0x0, 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:46 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:46 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x1, 0x84) r1 = dup2(r0, r0) sendmsg$inet_sctp(r1, &(0x7f00000004c0)={&(0x7f00000000c0)=@in={0x10, 0x2}, 0x10, 0x0, 0x0, 0x0, 0x1c}, 0x0) sendmsg$inet_sctp(r1, &(0x7f0000001680)={&(0x7f0000000000)=@in6={0x1c, 0x1c}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000080)='c', 0x1}], 0x1, &(0x7f0000001580)=[@sndrcv={0x2c}], 0x2c}, 0x0) 04:10:46 executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0xdd09}, 0x10) 04:10:46 executing program 5: r0 = socket$inet_sctp(0x2, 0x1, 0x84) connect(r0, &(0x7f0000000040)=@in={0x10, 0x2}, 0x10) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x15, &(0x7f0000000000), &(0x7f0000000040)=0x8) 04:10:46 executing program 5: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) r1 = dup2(r0, r0) connect$inet(r1, &(0x7f0000000080)={0x10, 0x2}, 0x10) 04:10:46 executing program 0: 04:10:46 executing program 3: [ 1054.408221][ T28] audit: type=1804 audit(1596946246.689:250): pid=24328 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16311 res=1 errno=0 [ 1055.044359][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1056.083472][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1056.311549][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1057.113233][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:49 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:49 executing program 0: 04:10:49 executing program 3: 04:10:49 executing program 5: 04:10:49 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(0x0, 0x0) write$FUSE_IOCTL(r2, &(0x7f0000000100)={0x20}, 0x20) 04:10:49 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:49 executing program 3: 04:10:49 executing program 0: 04:10:49 executing program 5: 04:10:49 executing program 3: 04:10:49 executing program 0: 04:10:49 executing program 5: [ 1057.433089][ T28] audit: type=1804 audit(1596946249.719:251): pid=24354 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16232 res=1 errno=0 [ 1058.153450][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1059.203076][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1059.352071][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1060.233197][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:52 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:52 executing program 3: 04:10:52 executing program 5: 04:10:52 executing program 0: 04:10:52 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000100)={0x20}, 0x20) 04:10:52 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:52 executing program 0: 04:10:52 executing program 5: 04:10:52 executing program 3: 04:10:52 executing program 0: 04:10:52 executing program 5: 04:10:52 executing program 0: [ 1060.472242][ T28] audit: type=1804 audit(1596946252.759:252): pid=24374 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16233 res=1 errno=0 [ 1061.273052][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1062.324730][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1062.391387][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:55 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:55 executing program 3: 04:10:55 executing program 5: 04:10:55 executing program 0: 04:10:55 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:55 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000100)={0x20}, 0x20) [ 1063.362985][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:55 executing program 3: 04:10:55 executing program 0: syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='huge=always']) r0 = creat(&(0x7f00000000c0)='./bus/file0\x00', 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r0, &(0x7f0000000300)={0xb, 0x10, 0xfa00, {0x0}}, 0x18) 04:10:55 executing program 5: dup(0xffffffffffffffff) syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='huge=always']) r0 = creat(&(0x7f00000000c0)='./bus/file0\x00', 0x0) fallocate(r0, 0x0, 0x0, 0x8800000) 04:10:55 executing program 3: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x0, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) 04:10:55 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:55 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = semget$private(0x0, 0x3, 0x0) semtimedop(r2, &(0x7f0000000140)=[{0x0, 0xfffc}], 0x1, &(0x7f0000efe000)={0x2000}) semctl$SETALL(r2, 0x0, 0x11, &(0x7f0000000000)=[0x800]) 04:10:55 executing program 3: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0xff0f) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000740)={0x0, 0x0, 0x2000, 0x1000, &(0x7f0000000000/0x1000)=nil}) pipe(&(0x7f00000000c0)) 04:10:55 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)={0x2c, r1, 0x42b, 0x0, 0x0, {{}, {}, {0x10, 0x17, {0x25}}}}, 0x2c}}, 0x0) 04:10:55 executing program 3: syz_read_part_table(0x0, 0x1, &(0x7f0000000040)=[{&(0x7f0000000000)="0201bfffffff0a000000ff45ac00000000000f00e931190000000000000680ffffffbf000000e100e2ff87770072003007000500000000000000008000da55", 0x3f, 0x1c0}]) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) [ 1063.537735][ T28] audit: type=1804 audit(1596946255.819:253): pid=24401 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16251 res=1 errno=0 04:10:55 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1063.584292][T24408] tipc: Enabling of bearer <:> rejected, illegal name [ 1063.595033][T24410] tipc: Enabling of bearer <:> rejected, illegal name 04:10:56 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(0xffffffffffffffff, &(0x7f0000000100)={0x20}, 0x20) 04:10:56 executing program 3: r0 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x894a, &(0x7f0000000140)={'gre0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @dev, @loopback}}}}) 04:10:56 executing program 5: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003200)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000140)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/115, 0x73}, {&(0x7f0000000380)=""/89, 0x59}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f0000000000)=""/18, 0x12}, {&(0x7f0000000ec0)=""/153, 0x99}, {&(0x7f0000001fc0)=""/236, 0xec}], 0x9}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) 04:10:56 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:56 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e2c, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x80fe) 04:10:56 executing program 5: readv(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000200), 0x8) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) [ 1064.379413][ T28] audit: type=1804 audit(1596946256.659:254): pid=24434 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16246 res=1 errno=0 [ 1064.403258][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1065.431515][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1065.443033][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:58 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:10:58 executing program 3: mkdir(&(0x7f0000000040)='./bus\x00', 0x0) unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000240)='./bus\x00', 0x15000123) 04:10:58 executing program 0: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41bd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e2c, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x80fe) 04:10:58 executing program 5: readv(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000200), 0x8) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) 04:10:58 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:10:58 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, 0x0, 0x0) [ 1066.473085][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:10:58 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) shmctl$SHM_INFO(0x0, 0xe, &(0x7f0000000380)=""/168) 04:10:58 executing program 3: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/18, 0x2}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:10:58 executing program 0: r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x3, 0x0, @dev}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[], 0x10b8, 0x48000000}, 0x0) 04:10:58 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, 0x0, &(0x7f0000000200)=0xf5) 04:10:59 executing program 5: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) signalfd4(r0, &(0x7f0000000000), 0x8, 0x80000) [ 1066.646023][ T28] audit: type=1804 audit(1596946258.929:255): pid=24456 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16272 res=1 errno=0 04:10:59 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) [ 1067.512983][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1068.471428][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1068.553034][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:01 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:01 executing program 3: unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) 04:11:01 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f00000000c0)={0x0, 0x0, 0x3, &(0x7f0000000040)="cd17c2"}) ioctl$KVM_NMI(r2, 0xae9a) mlock(&(0x7f0000001000/0x3000)=nil, 0x3000) ioctl$KVM_RUN(r2, 0xae80, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) 04:11:01 executing program 0: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 04:11:01 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, 0x0, 0x0) 04:11:01 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:01 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:01 executing program 3: unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) 04:11:01 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x40d}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x4, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:01 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:01 executing program 3: unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) [ 1069.604049][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:02 executing program 3: unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) [ 1069.676827][ T28] audit: type=1804 audit(1596946261.959:256): pid=24489 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=15789 res=1 errno=0 [ 1070.643102][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1071.511460][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1071.673412][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:04 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:04 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:04 executing program 3: unshare(0x400) inotify_add_watch(0xffffffffffffffff, 0x0, 0x720001a2) 04:11:04 executing program 5: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x2000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum={0x0, 0x0, 0x0, 0xc}]}}, &(0x7f0000000140)=""/168, 0x26, 0xa8, 0x8}, 0x20) 04:11:04 executing program 2: r0 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) r1 = fanotify_init(0x0, 0x0) read(r1, 0x0, 0x273) fanotify_mark(r1, 0x2000000000000011, 0x2, r0, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) write$FUSE_IOCTL(r2, 0x0, 0x0) 04:11:04 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:04 executing program 3: unshare(0x400) inotify_add_watch(0xffffffffffffffff, 0x0, 0x720001a2) 04:11:04 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = eventfd(0xa1f) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r2}) 04:11:04 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:04 executing program 5: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x24, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) 04:11:04 executing program 3: unshare(0x400) inotify_add_watch(0xffffffffffffffff, 0x0, 0x720001a2) [ 1072.633664][T24508] BPF:[1] FUNC (anon) [ 1072.637933][T24508] BPF:type_id=4 [ 1072.643043][T24508] BPF: [ 1072.646495][T24508] BPF:Invalid name [ 1072.650404][T24508] BPF: [ 1072.650404][T24508] 04:11:05 executing program 3: r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) [ 1072.723391][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1072.741094][ T28] audit: type=1804 audit(1596946265.019:257): pid=24527 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16228 res=1 errno=0 [ 1073.753243][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1074.551384][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1074.803717][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:07 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:07 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:07 executing program 3: r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) 04:11:07 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x105082) r1 = memfd_create(&(0x7f0000000100)='\xbb\x02\xb1\x91^\x00\x00\x01\x00\x00\x00\x00\x00\x00\xfa\xe3\xa0\xd42\x90YJ\x89]\xad\x01\xc3\\:;\x99\xbck\xf9=\xfa\xe8HB\xf7\x92\x16\xbc\x11\xc4\xff\xa1\xea\xf9l', 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) write(r0, &(0x7f0000000000), 0x52698b21) 04:11:07 executing program 2: r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000003200)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f0000000140)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/115, 0x73}, {&(0x7f0000000380)=""/89, 0x59}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f0000000000)=""/18, 0x12}, {&(0x7f0000000ec0)=""/153, 0x99}, {&(0x7f0000001fc0)=""/236, 0xec}], 0xa}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x3, 0x0, 0x0) 04:11:07 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:07 executing program 3: r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) 04:11:07 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:08 executing program 5: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup2(r0, r1) 04:11:08 executing program 2: 04:11:08 executing program 3: unshare(0x0) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) 04:11:08 executing program 2: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newqdisc={0x54, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa, 0x1, 'codel\x00'}, {0x24, 0x2, [@TCA_CODEL_LIMIT={0x8}, @TCA_CODEL_ECN={0x8}, @TCA_CODEL_INTERVAL={0x8}, @TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x54}}, 0x0) [ 1075.777253][ T28] audit: type=1804 audit(1596946268.059:258): pid=24558 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=15831 res=1 errno=0 [ 1075.833582][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1076.883142][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1077.591362][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1077.912620][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:10 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {0x0}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:10 executing program 5: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2}, 0x10, 0x0}, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) 04:11:10 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:10 executing program 3: unshare(0x0) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) 04:11:10 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, &(0x7f0000000180)={0x8, 0x1, 0x0, 0xffffffffffffffff}) dup(r1) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r0, 0xc00c642e, 0x0) open(0x0, 0x0, 0x0) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0x5) 04:11:10 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:11 executing program 3: unshare(0x0) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x720001a2) 04:11:11 executing program 5: r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f00000002c0)={&(0x7f0000000080)=@nameseq={0x1e, 0x2}, 0x10, 0x0}, 0x0) r3 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41, 0x0, 0x2}, 0x10) 04:11:11 executing program 2: r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1c}}}, 0x80, &(0x7f0000001640)=[{&(0x7f0000000ac0)="ee", 0xb08}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040000002b24ec10064b6fb14bccedfb718aef932f3889d1fdda5b9134015a860f5878c37ffe36e1165d14d435be5b317c6c8189767d2f97879f07a715bb7c169f46933d9338f4ab0483696f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8, 0x48000000}, 0x700) 04:11:11 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto(0xffffffffffffffff, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:11 executing program 3: unshare(0x400) inotify_init() inotify_add_watch(0xffffffffffffffff, 0x0, 0x720001a2) 04:11:11 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f00000000c0)={0x0, 0x0, 0x3, &(0x7f0000000040)="cd17c2"}) ioctl$KVM_NMI(r2, 0xae9a) mlock(&(0x7f0000001000/0x3000)=nil, 0x3000) ioctl$KVM_RUN(r2, 0xae80, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 1078.792139][ T28] audit: type=1804 audit(1596946271.079:259): pid=24585 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16065 res=1 errno=0 [ 1078.952689][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1079.993003][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1080.631499][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1080.639969][T11912] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1080.649896][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1080.658626][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1081.033434][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:14 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:14 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto(0xffffffffffffffff, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:14 executing program 3: unshare(0x400) inotify_init() inotify_add_watch(0xffffffffffffffff, 0x0, 0x720001a2) 04:11:14 executing program 2: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0xff0f) 04:11:14 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) ioctl$BLKPG(0xffffffffffffffff, 0x1269, &(0x7f00000000c0)={0x0, 0x0, 0x3, &(0x7f0000000040)="cd17c2"}) ioctl$KVM_NMI(r2, 0xae9a) mlock(&(0x7f0000001000/0x3000)=nil, 0x3000) ioctl$KVM_RUN(r2, 0xae80, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) 04:11:14 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:14 executing program 3: unshare(0x400) inotify_init() inotify_add_watch(0xffffffffffffffff, 0x0, 0x720001a2) 04:11:14 executing program 2: open(0x0, 0x42, 0x0) accept$unix(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) 04:11:14 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendto(0xffffffffffffffff, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:14 executing program 5: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$tmpfs(&(0x7f00000002c0)='tmpfs\x00', &(0x7f0000000400)='./bus\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='huge=always']) r2 = creat(&(0x7f00000000c0)='./bus/file0\x00', 0x0) fallocate(r2, 0x0, 0x0, 0x8800000) 04:11:14 executing program 3: unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x0) 04:11:14 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x2) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) [ 1081.832693][ T28] audit: type=1804 audit(1596946274.119:260): pid=24617 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16230 res=1 errno=0 [ 1082.073019][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1083.114136][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1083.672208][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1084.152901][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:17 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:17 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) dup(r0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:17 executing program 5: r0 = creat(&(0x7f0000000280)='./file0\x00', 0x1) write$binfmt_script(r0, &(0x7f0000000380)=ANY=[@ANYBLOB='#! ./file0 '], 0x191) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) close(r0) execve(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) 04:11:17 executing program 3: unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x0) 04:11:17 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:17 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x2) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) 04:11:17 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) dup(r0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:17 executing program 3: unshare(0x400) r0 = inotify_init() inotify_add_watch(r0, 0x0, 0x0) 04:11:17 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:17 executing program 5: 04:11:17 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) dup(r0) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1084.891088][ T28] audit: type=1804 audit(1596946277.169:261): pid=24647 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16252 res=1 errno=0 04:11:17 executing program 5: [ 1085.591075][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1086.641413][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1086.711474][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1087.671400][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:20 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:20 executing program 0: socket$unix(0x1, 0x5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:20 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:20 executing program 5: 04:11:20 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x2) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) 04:11:20 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:20 executing program 5: 04:11:20 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:20 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:20 executing program 0: socket$unix(0x1, 0x5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:20 executing program 5: 04:11:20 executing program 0: socket$unix(0x1, 0x5, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1087.927508][ T28] audit: type=1804 audit(1596946280.209:262): pid=24672 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16251 res=1 errno=0 [ 1088.715016][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1089.751474][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1089.759624][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:23 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:23 executing program 5: 04:11:23 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:23 executing program 0: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:23 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) r2 = openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x2) ioctl$USBDEVFS_GET_SPEED(r2, 0x551f) 04:11:23 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) [ 1090.801447][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:23 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:23 executing program 5: 04:11:23 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:23 executing program 0: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1090.984814][ T28] audit: type=1804 audit(1596946283.269:263): pid=24699 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16255 res=1 errno=0 04:11:23 executing program 5: 04:11:23 executing program 5: 04:11:23 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) [ 1091.849219][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1092.791468][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1092.871498][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:26 executing program 0: r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:26 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:26 executing program 5: 04:11:26 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:26 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x2) 04:11:26 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x46000) lseek(0xffffffffffffffff, 0x4200, 0x0) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:26 executing program 5: 04:11:26 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:26 executing program 0: r0 = socket$unix(0x1, 0x0, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:26 executing program 5: [ 1093.922860][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:26 executing program 0: r0 = socket$unix(0x1, 0x0, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:26 executing program 5: [ 1094.018826][ T28] audit: type=1804 audit(1596946286.299:264): pid=24727 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16237 res=1 errno=0 04:11:26 executing program 0: r0 = socket$unix(0x1, 0x0, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1094.951483][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1095.831406][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1096.001560][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:29 executing program 5: 04:11:29 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x2, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:29 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:29 executing program 0: socket$unix(0x1, 0x5, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:29 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) openat$mice(0xffffffffffffff9c, &(0x7f0000000000)='/dev/input/mice\x00', 0x2) 04:11:29 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x46000) lseek(0xffffffffffffffff, 0x4200, 0x0) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:29 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:29 executing program 5: 04:11:29 executing program 0: socket$unix(0x1, 0x5, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:29 executing program 5: 04:11:29 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) [ 1097.033110][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1097.049730][ T28] audit: type=1804 audit(1596946289.329:265): pid=24752 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16312 res=1 errno=0 04:11:29 executing program 5: 04:11:29 executing program 0: socket$unix(0x1, 0x5, 0x0) r0 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1098.071461][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1098.871431][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1099.112545][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:32 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:32 executing program 5: 04:11:32 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:32 executing program 3: bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:32 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:32 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x46000) lseek(0xffffffffffffffff, 0x4200, 0x0) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r7, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:32 executing program 5: 04:11:32 executing program 3: bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:32 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:32 executing program 5: 04:11:32 executing program 3: bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:32 executing program 5: [ 1100.086603][ T28] audit: type=1804 audit(1596946292.369:266): pid=24776 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16272 res=1 errno=0 [ 1100.151518][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1101.191446][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1101.911559][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1102.231549][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:35 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:35 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:35 executing program 3: r0 = socket(0x0, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:35 executing program 5: 04:11:35 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:35 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:35 executing program 5: 04:11:35 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:35 executing program 3: r0 = socket(0x0, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:35 executing program 5: 04:11:35 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:35 executing program 5: socket$kcm(0x11, 0x0, 0x300) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x42, &(0x7f0000000000), 0x58) unlink(&(0x7f0000000000)='./file0\x00') [ 1103.132384][ T28] audit: type=1804 audit(1596946295.419:267): pid=24801 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16272 res=1 errno=0 [ 1103.273169][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1104.311593][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1104.951389][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1105.351487][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:38 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$IPSET_CMD_DEL(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000000b0601020000000000000000000000000500010006fe00000900020073797a30000000001c00078018000180"], 0x44}}, 0x0) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0xfd53) splice(r1, 0x0, r0, 0x0, 0x400000, 0x0) 04:11:38 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(0x0, 0x40) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:38 executing program 3: r0 = socket(0x0, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:38 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x0) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:38 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:38 executing program 3: r0 = socket(0x11, 0x0, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:38 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x0, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:38 executing program 5: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000200), 0x8) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000140)=ANY=[], 0x28) socket$inet6_tcp(0xa, 0x1, 0x0) 04:11:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:38 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x0, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:38 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:38 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x0, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1106.152320][ T28] audit: type=1804 audit(1596946298.439:268): pid=24835 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16251 res=1 errno=0 04:11:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='westwood\x00', 0x9) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:38 executing program 3: r0 = socket(0x11, 0x0, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:38 executing program 5: r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$inet6_opts(r0, 0x29, 0x37, &(0x7f0000000200), 0x8) sendmmsg(r0, &(0x7f0000006d00)=[{{0x0, 0x1002000, 0x0, 0x0, 0x0, 0x0, 0xb605}}], 0xc6, 0x0) setsockopt$inet6_opts(r0, 0x29, 0x3b, &(0x7f0000000140)=ANY=[], 0x28) socket$inet6_tcp(0xa, 0x1, 0x0) 04:11:38 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x0, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1106.391557][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:39 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc, 0x1, 'macvlan\x00'}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x6}]}}}]}, 0x3c}}, 0x0) 04:11:39 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:39 executing program 3: r0 = socket(0x11, 0x0, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:39 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x0, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:39 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x48}}, 0x0) [ 1107.033950][T24868] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1107.046787][T24868] device ipvlan4 entered promiscuous mode [ 1107.103954][ T28] audit: type=1804 audit(1596946299.389:269): pid=24874 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16246 res=1 errno=0 [ 1107.431520][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1107.991474][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1108.471651][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:41 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:41 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:41 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x0, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:41 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x48}}, 0x0) 04:11:41 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:41 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000980), 0x10a9) r4 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r4, 0x4, 0x46000) lseek(r4, 0x4200, 0x0) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r4, r7, 0x0, 0x8400fffffffb) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000100), 0x8080ffffff7e) 04:11:41 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) [ 1109.237758][T24882] netlink: 'syz-executor.5': attribute type 5 has an invalid length. 04:11:41 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(0xffffffffffffffff, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1109.286712][T24882] device ipvlan4 entered promiscuous mode [ 1109.331145][ T28] audit: type=1804 audit(1596946301.609:270): pid=24896 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16272 res=1 errno=0 04:11:41 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:41 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(0xffffffffffffffff, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:41 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(0xffffffffffffffff, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:41 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, 0x0, 0x0) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) [ 1109.511537][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1110.551567][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1111.031426][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1111.601504][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:44 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x48}}, 0x0) 04:11:44 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:44 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, 0x0, 0x0) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:44 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000980), 0x10a9) r4 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r4, 0x4, 0x46000) lseek(r4, 0x4200, 0x0) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r4, r7, 0x0, 0x8400fffffffb) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000100), 0x8080ffffff7e) 04:11:44 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:44 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1112.268436][T24916] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1112.296648][T24916] device ipvlan4 entered promiscuous mode 04:11:44 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, 0x0, 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:44 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee), 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:44 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, 0x0, 0x0) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) [ 1112.380095][ T28] audit: type=1804 audit(1596946304.659:271): pid=24929 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=15857 res=1 errno=0 04:11:44 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x48}}, 0x0) 04:11:44 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee), 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1112.517406][T24939] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1112.529194][T24939] device ipvlan4 entered promiscuous mode [ 1112.631536][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1113.671444][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1114.071473][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1114.721417][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1114.729839][ T21] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1114.738371][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1114.748025][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:47 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:47 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:47 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee), 0x0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:47 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:47 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000980), 0x10a9) r4 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r4, 0x4, 0x46000) lseek(r4, 0x4200, 0x0) r5 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r6, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x10000}]) r7 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r4, r7, 0x0, 0x8400fffffffb) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000100), 0x8080ffffff7e) 04:11:47 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:47 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:47 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r2, r2) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:47 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef00", 0x9, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1115.317539][T24952] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1115.333807][T24952] device ipvlan4 entered promiscuous mode 04:11:47 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:47 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef00", 0x9, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1115.421227][ T28] audit: type=1804 audit(1596946307.699:272): pid=24972 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16179 res=1 errno=0 [ 1115.441262][T24969] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1115.454971][T24969] device ipvlan5 entered promiscuous mode [ 1115.831556][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1116.871470][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1117.111452][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1117.921700][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:50 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:50 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:50 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef00", 0x9, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r2, r2) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:50 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:50 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:50 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000", 0xe, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:50 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:50 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) dup2(r2, r2) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) [ 1118.361282][T24985] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1118.376844][T24985] device ipvlan6 entered promiscuous mode 04:11:50 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000", 0xe, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:50 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, 0x0, &(0x7f0000000000)) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) [ 1118.442798][T24999] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1118.454188][T24999] device ipvlan7 entered promiscuous mode 04:11:50 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000", 0xe, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1118.476717][ T28] audit: type=1804 audit(1596946310.759:273): pid=25004 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16230 res=1 errno=0 [ 1118.951441][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1119.992567][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1120.151536][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1121.041482][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:53 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xffffffffffffffff, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:53 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, 0x0, &(0x7f0000000000)) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:53 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b000000000000", 0x10, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:53 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:53 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:53 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, 0x0, &(0x7f0000000000)) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:53 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b000000000000", 0x10, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1121.385099][T25015] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1121.398849][T25015] device ipvlan8 entered promiscuous mode 04:11:53 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) [ 1121.448920][T25028] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1121.463389][T25028] device ipvlan9 entered promiscuous mode 04:11:53 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:53 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b000000000000", 0x10, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1121.503026][ T28] audit: type=1804 audit(1596946313.789:274): pid=25034 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16230 res=1 errno=0 [ 1121.521933][T25036] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1121.535538][T25036] device ipvlan10 entered promiscuous mode [ 1122.071537][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1123.111455][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1123.192064][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1124.151572][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:56 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:56 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:56 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000", 0x11, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:56 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') syz_genetlink_get_family_id$nl80211(0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:56 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:56 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:56 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000", 0x11, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1124.411461][T25050] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1124.437056][T25050] device ipvlan11 entered promiscuous mode 04:11:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:56 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x0, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:56 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:56 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000", 0x11, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) [ 1124.538024][ T28] audit: type=1804 audit(1596946316.819:275): pid=25064 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16230 res=1 errno=0 [ 1124.562368][T25067] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1124.573776][T25067] device ipvlan12 entered promiscuous mode [ 1124.670243][T25076] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1124.698939][T25076] device ipvlan13 entered promiscuous mode [ 1125.201615][T17953] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.231423][T18133] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1126.239532][T23878] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1127.272722][T13201] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog 04:11:59 executing program 1: prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80100900, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000002, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)="0f34", 0x2}], 0x1, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xdc, 0xdc, 0x2, [@func_proto={0x0, 0x8, 0x0, 0xd, 0x0, [{}, {}, {}, {}, {}, {}, {}, {}]}, @union={0x0, 0x5, 0x0, 0x5, 0x0, 0x0, [{}, {}, {}, {}, {}]}, @struct={0x0, 0x5, 0x0, 0x4, 0x0, 0x0, [{}, {}, {}, {}, {}]}]}}, 0x0, 0xf6}, 0x20) process_vm_writev(0x0, &(0x7f0000000080)=[{0x0}, {0x0}, {&(0x7f00000003c0)=""/102400, 0x19000}], 0x3, 0x0, 0x0, 0x0) tkill(r0, 0x40) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) 04:11:59 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x0, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:59 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) 04:11:59 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x42, 0x0) accept$unix(r0, &(0x7f0000000300), &(0x7f0000000140)=0x6e) ioctl$SNDCTL_DSP_RESET(r0, 0x5000, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='uid_map\x00') r1 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, [], 0x1c}, 0xd}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)='\n', 0xfffffdef, 0x40080, 0x0, 0x1f4) 04:11:59 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x10000, 0x7ff, 0xc5}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x4, 0x3, 0xfffffffffffffffe}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x0) io_setup(0x1ff, &(0x7f00000004c0)=0x0) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r8 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) sendfile(r5, r8, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 04:11:59 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:59 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000000)=0x14) r2 = socket(0x0, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0xd0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9, 0x1, 'gred\x00'}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x0, 0x0, 0x2}}]}}]}, 0x44}}, 0x0) 04:11:59 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup2(r1, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) [ 1127.475513][T25089] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1127.506209][T25089] device ipvlan14 entered promiscuous mode 04:11:59 executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x374, &(0x7f0000000700)=[{&(0x7f0000000040)=""/95, 0x14b}, {&(0x7f0000000140)=""/85, 0x97d}, {&(0x7f0000000fc0)=""/4096, 0xf2}, {&(0x7f0000000400)=""/115, 0x2ce}, {&(0x7f0000000380)=""/89, 0x3dd}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x4}, {&(0x7f0000000000)=""/18, 0xa}, {&(0x7f0000000ec0)=""/153, 0x60}, {&(0x7f0000001fc0)=""/236, 0x600}], 0x81, &(0x7f0000000600)=""/191, 0x41}}], 0x40000df, 0x0, &(0x7f0000000340)={0x77359400}) 04:11:59 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) [ 1127.556513][T25099] netlink: 'syz-executor.5': attribute type 5 has an invalid length. [ 1127.567595][T25099] device ipvlan15 entered promiscuous mode [ 1127.583207][ T28] audit: type=1804 audit(1596946319.869:276): pid=25101 uid=0 auid=0 ses=4 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="bus" dev="sda1" ino=16330 res=1 errno=0 04:12:00 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=@newlink={0x48, 0x10, 0x705, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x63565}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb, 0x1, 'ipvlan\x00'}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x5, @empty=[0x4]}, @IFLA_MASTER={0x8}]}, 0x48}}, 0x0) [ 1127.695712][T25106] ================================================================== [ 1127.703831][T25106] BUG: KCSAN: data-race in __delete_from_page_cache / ext4_writepages [ 1127.711960][T25106] [ 1127.714288][T25106] write to 0xffff8881214a0940 of 8 bytes by task 25101 on cpu 1: [ 1127.722028][T25106] __delete_from_page_cache+0x293/0x390 [ 1127.727573][T25106] invalidate_complete_page2+0x126/0x2a0 [ 1127.733227][T25106] invalidate_inode_pages2_range+0x465/0x780 [ 1127.739217][T25106] iomap_dio_rw+0x503/0x980 [ 1127.743710][T25106] ext4_file_write_iter+0xd71/0x1000 [ 1127.748986][T25106] do_iter_readv_writev+0x32e/0x3d0 [ 1127.754174][T25106] do_iter_write+0x112/0x4b0 [ 1127.758754][T25106] vfs_iter_write+0x4c/0x70 [ 1127.763252][T25106] iter_file_splice_write+0x41a/0x770 [ 1127.768619][T25106] direct_splice_actor+0x95/0x160 [ 1127.773637][T25106] splice_direct_to_actor+0x365/0x660 [ 1127.779008][T25106] do_splice_direct+0xf2/0x170 [ 1127.783767][T25106] do_sendfile+0x56a/0xba0 [ 1127.788179][T25106] __x64_sys_sendfile64+0xf2/0x130 [ 1127.793284][T25106] do_syscall_64+0x39/0x80 [ 1127.797692][T25106] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1127.803565][T25106] [ 1127.805888][T25106] read to 0xffff8881214a0940 of 8 bytes by task 25106 on cpu 0: [ 1127.813521][T25106] ext4_writepages+0x145/0x1ef0 [ 1127.818365][T25106] do_writepages+0x7b/0x150 [ 1127.822863][T25106] __filemap_fdatawrite_range+0x19b/0x1d0 [ 1127.828692][T25106] file_write_and_wait_range+0x9f/0x120 [ 1127.834254][T25106] ext4_sync_file+0xfc/0x6e0 [ 1127.838844][T25106] vfs_fsync_range+0x107/0x120 [ 1127.843600][T25106] ext4_buffered_write_iter+0x369/0x3b0 [ 1127.849136][T25106] ext4_file_write_iter+0x57b/0x1000 [ 1127.854417][T25106] do_iter_readv_writev+0x32e/0x3d0 [ 1127.859608][T25106] do_iter_write+0x112/0x4b0 [ 1127.864217][T25106] vfs_iter_write+0x4c/0x70 [ 1127.868716][T25106] iter_file_splice_write+0x41a/0x770 [ 1127.874074][T25106] direct_splice_actor+0x95/0x160 [ 1127.879122][T25106] splice_direct_to_actor+0x365/0x660 [ 1127.884474][T25106] do_splice_direct+0xf2/0x170 [ 1127.889216][T25106] do_sendfile+0x56a/0xba0 [ 1127.893641][T25106] __x64_sys_sendfile64+0xa9/0x130 [ 1127.898767][T25106] do_syscall_64+0x39/0x80 [ 1127.903164][T25106] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1127.909030][T25106] [ 1127.911333][T25106] Reported by Kernel Concurrency Sanitizer on: [ 1127.917468][T25106] CPU: 0 PID: 25106 Comm: syz-executor.4 Not tainted 5.8.0-syzkaller #0 [ 1127.925766][T25106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1127.935806][T25106] ================================================================== [ 1127.943849][T25106] Kernel panic - not syncing: panic_on_warn set ... [ 1127.950408][T25106] CPU: 0 PID: 25106 Comm: syz-executor.4 Not tainted 5.8.0-syzkaller #0 [ 1127.958703][T25106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1127.968757][T25106] Call Trace: [ 1127.972100][T25106] dump_stack+0x10f/0x19d [ 1127.976450][T25106] panic+0x207/0x64a [ 1127.980354][T25106] ? vprintk_emit+0x44a/0x4f0 [ 1127.985030][T25106] kcsan_report+0x684/0x690 [ 1127.989536][T25106] ? kcsan_setup_watchpoint+0x41e/0x4a0 [ 1127.995063][T25106] ? ext4_writepages+0x145/0x1ef0 [ 1128.000081][T25106] ? do_writepages+0x7b/0x150 [ 1128.004757][T25106] ? __filemap_fdatawrite_range+0x19b/0x1d0 [ 1128.010624][T25106] ? file_write_and_wait_range+0x9f/0x120 [ 1128.016316][T25106] ? ext4_sync_file+0xfc/0x6e0 [ 1128.021064][T25106] ? vfs_fsync_range+0x107/0x120 [ 1128.025981][T25106] ? ext4_buffered_write_iter+0x369/0x3b0 [ 1128.031699][T25106] ? ext4_file_write_iter+0x57b/0x1000 [ 1128.037131][T25106] ? do_iter_readv_writev+0x32e/0x3d0 [ 1128.042503][T25106] ? do_iter_write+0x112/0x4b0 [ 1128.047247][T25106] ? vfs_iter_write+0x4c/0x70 [ 1128.051905][T25106] ? iter_file_splice_write+0x41a/0x770 [ 1128.057445][T25106] ? direct_splice_actor+0x95/0x160 [ 1128.062630][T25106] ? splice_direct_to_actor+0x365/0x660 [ 1128.068167][T25106] ? do_splice_direct+0xf2/0x170 [ 1128.073086][T25106] ? do_sendfile+0x56a/0xba0 [ 1128.078628][T25106] ? __x64_sys_sendfile64+0xa9/0x130 [ 1128.083906][T25106] ? do_syscall_64+0x39/0x80 [ 1128.088481][T25106] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1128.095221][T25106] ? scsi_queue_rq+0x1169/0x1430 [ 1128.100161][T25106] kcsan_setup_watchpoint+0x41e/0x4a0 [ 1128.105565][T25106] ? ext4_readpage+0x1a0/0x1a0 [ 1128.110305][T25106] ext4_writepages+0x145/0x1ef0 [ 1128.115139][T25106] ? __this_cpu_preempt_check+0x18/0x20 [ 1128.120698][T25106] ? percpu_counter_add_batch+0x112/0x130 [ 1128.126442][T25106] ? __this_cpu_preempt_check+0x18/0x20 [ 1128.131963][T25106] ? __add_wb_stat+0x4c/0x60 [ 1128.136530][T25106] ? __xa_set_mark+0x324/0x330 [ 1128.142228][T25106] ? __rcu_read_unlock+0x4b/0x260 [ 1128.147236][T25106] ? __mark_inode_dirty+0xde/0x7e0 [ 1128.152325][T25106] ? mark_buffer_dirty+0x14b/0x260 [ 1128.157427][T25106] ? block_write_end+0x180/0x220 [ 1128.162356][T25106] ? ext4_readpage+0x1a0/0x1a0 [ 1128.167104][T25106] do_writepages+0x7b/0x150 [ 1128.171624][T25106] ? generic_write_end+0x146/0x220 [ 1128.176712][T25106] ? _raw_spin_unlock+0x2e/0x50 [ 1128.181547][T25106] __filemap_fdatawrite_range+0x19b/0x1d0 [ 1128.187242][T25106] file_write_and_wait_range+0x9f/0x120 [ 1128.192768][T25106] ext4_sync_file+0xfc/0x6e0 [ 1128.197345][T25106] ? tsan.module_ctor+0x10/0x10 [ 1128.202182][T25106] vfs_fsync_range+0x107/0x120 [ 1128.206940][T25106] ext4_buffered_write_iter+0x369/0x3b0 [ 1128.212474][T25106] ext4_file_write_iter+0x57b/0x1000 [ 1128.217741][T25106] ? aa_file_perm+0x129/0xe00 [ 1128.222457][T25106] ? find_get_entry+0x2ed/0x320 [ 1128.227283][T25106] do_iter_readv_writev+0x32e/0x3d0 [ 1128.232470][T25106] do_iter_write+0x112/0x4b0 [ 1128.237923][T25106] ? kmalloc_array+0x2d/0x40 [ 1128.242499][T25106] ? splice_from_pipe_next+0x217/0x260 [ 1128.248048][T25106] vfs_iter_write+0x4c/0x70 [ 1128.252549][T25106] iter_file_splice_write+0x41a/0x770 [ 1128.257922][T25106] ? splice_from_pipe+0xc0/0xc0 [ 1128.262767][T25106] direct_splice_actor+0x95/0x160 [ 1128.267782][T25106] splice_direct_to_actor+0x365/0x660 [ 1128.273127][T25106] ? do_splice_direct+0x170/0x170 [ 1128.278136][T25106] do_splice_direct+0xf2/0x170 [ 1128.282884][T25106] ? check_preemption_disabled+0xf0/0x140 [ 1128.288590][T25106] do_sendfile+0x56a/0xba0 [ 1128.292984][T25106] __x64_sys_sendfile64+0xa9/0x130 [ 1128.298069][T25106] do_syscall_64+0x39/0x80 [ 1128.302476][T25106] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1128.308339][T25106] RIP: 0033:0x45ce69 [ 1128.312206][T25106] Code: 2d b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb b5 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 1128.331806][T25106] RSP: 002b:00007f9280109c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1128.340209][T25106] RAX: ffffffffffffffda RBX: 0000000000026bc0 RCX: 000000000045ce69 [ 1128.348153][T25106] RDX: 0000000020000100 RSI: 0000000000000006 RDI: 0000000000000006 [ 1128.356096][T25106] RBP: 000000000118c148 R08: 0000000000000000 R09: 0000000000000000 [ 1128.364039][T25106] R10: 00008080ffffff7e R11: 0000000000000246 R12: 000000000118c10c [ 1128.371989][T25106] R13: 00007fff5d6ca95f R14: 00007f928010a9c0 R15: 000000000118c10c [ 1128.381023][T25106] Kernel Offset: disabled [ 1128.385441][T25106] Rebooting in 86400 seconds..