# https://syzkaller.appspot.com/bug?id=1557fb40b5ed0a1ed2ba18268e04da194674d770
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":8,"sandbox":"namespace","fault_call":-1,"tun":true,"tmpdir":true,"cgroups":true,"netdev":true,"resetnet":true,"segv":true,"waitrepeat":true}
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0)
mprotect(&(0x7f0000000000/0x600000)=nil, 0x600000, 0xa)
ioctl$TCGETA(r0, 0x8004552d, &(0x7f0000000180))
syz_open_dev$sndseq(&(0x7f0000000000)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, &(0x7f0000000080))
r1 = epoll_create(0x100000001)
r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$TIOCMBIS(r2, 0x5416, &(0x7f0000000000)=0x101)
epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f00000000c0))
socket$inet6(0xa, 0x1, 0x0)
ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000300))
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x1, 0x7, &(0x7f0000000040)=[0x0, 0x0], 0x2}, 0x20)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, 0xffffffffffffffff, &(0x7f000000d000))
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x5, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x80000001}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000280)={0x8, [0x2, 0x1, 0x1f, 0x6, 0x8, 0x4, 0xefbb, 0x2]}, &(0x7f00000002c0)=0x14)
r3 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82)
r4 = memfd_create(&(0x7f0000000140)="000000000000000000000000000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30544d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6287c64dbea37a", 0x0)
pwritev(r4, &(0x7f0000000340)=[{&(0x7f0000000080)}], 0x1, 0x81806)
write$P9_RFSYNC(r3, &(0x7f0000000380)={0x7, 0x33, 0x2}, 0x7)
socket$inet6(0xa, 0x0, 0x0)
r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup\x00', 0x200002, 0x0)
r6 = openat$cgroup_int(r5, &(0x7f0000000180)='memory.high\x00', 0x2, 0x0)
write$cgroup_int(r6, &(0x7f0000000000), 0x0)
ioctl$LOOP_CHANGE_FD(r3, 0x4c00, r4)
sendfile(r3, r3, &(0x7f0000000240)=0x300, 0x20000102000007)
r7 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r7, 0x8912, &(0x7f0000000280))
syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xaa}, @random="a29ab0893fde", [], {@ipv6={0x86dd, {0x0, 0x6, '?:T', 0x14, 0x2f, 0x0, @remote={0xfe, 0x80, [], 0xbb}, @mcast2={0xff, 0x2, [], 0x1}, {[], @tcp={{0x0, 0x883e, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, &(0x7f00000004c0))
sendmmsg(r7, &(0x7f0000008f40)=[{{&(0x7f0000000000)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000500)}, {&(0x7f0000000080)="eee2d9c52ca85977f8e7d68abcfc43a27bda49d7aa10", 0x16}, {&(0x7f00000000c0)}], 0x3, &(0x7f0000001500)=[{0x80, 0x11e, 0x2, "8d5dfe72aa5956dfb7a732f332a73ef6117a8b88f79d964284520112fec9ff31fcfcc668f28d1f5254adaced7240b0dae8bc01f0aa207db7a0a5c5971e15c58e31c58a434a3a0c126b8954f3990c3bb59b80306084b510352fe3fa0d29d4c55f372f08da6032bc0c7424a4"}, {0x10, 0x11d, 0x6}, {0x10, 0x10d, 0x4}, {0x10, 0x10d, 0xea0a}, {0x10, 0x117, 0x80000000}, {0x10, 0x119, 0x7}, {0x10, 0x13a, 0x1}, {0x10, 0x19f, 0x100000000}, {0x10, 0x102, 0x3bcb}, {0x10, 0x0, 0x7a}], 0x110, 0x10}, 0x7}, {{&(0x7f00000002c0)=@generic={0x19, "8132ffec7d1a5eb8fa6d10fd3d13673628c2eb9769318ce7e4423b6d6c0324a6a47c9e69539eb4dfbc560fdf6eca646a1dcd60f8cad05b6dd4658553af778a1ed6a70aee72259fb6e13df43e61ae94bc729854e722bb6c3a4d85acdc1075ad77af7a82af9f780608df0a8ac04b93822f44c661193065c79a6c6b138bf4d3"}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000340)}, {&(0x7f0000001bc0)}, {&(0x7f0000001cc0)}, {&(0x7f0000000440)}], 0x4, &(0x7f0000001dc0)=[{0x10, 0x110, 0x7fffffff}, {0x10, 0x10b, 0x4}, {0x18, 0x108, 0x7d7, "b14086631688d13d"}, {0x10, 0xff219077627d7f7, 0x1ff}, {0x10, 0x112, 0x9}], 0x58, 0x40}, 0x20}, {{&(0x7f0000002180)=@un=@file={0x0, './file0\x00'}, 0x80, &(0x7f00000024c0)=[{&(0x7f0000002200)}, {&(0x7f0000002300)}, {&(0x7f0000002400)}], 0x3, &(0x7f0000002500)=[{0x10, 0x10b, 0x2}, {0x10, 0x39}], 0x20, 0x44}, 0x8}, {{&(0x7f0000002640)=@pptp={0x18, 0x2, {0x3, @dev={0xac, 0x14, 0x14, 0x11}}}, 0x80, &(0x7f0000004840)=[{&(0x7f00000026c0)}, {&(0x7f00000027c0)}, {&(0x7f00000037c0)}, {&(0x7f00000047c0)}], 0x4, &(0x7f0000004880)=[{0x10, 0x11f, 0x2}, {0x10, 0x115, 0x400}, {0x10, 0x101, 0x4}, {0x60, 0x116, 0xfffffffffffff3cc, "5222f686f469b1eaf64fac87ff9d45739156386fbd61f470add5a4a5cc4a4416423714032d9694be86b3d3a02b66718d416304359b186ff7e4585266c14a5e957c1fb2f5d4d3aee7022d59a7e22d85e4"}, {0x10, 0x1ff, 0x7fff}, {0x10, 0x117, 0x5}], 0xb0, 0x4000000}, 0xf092}, {{&(0x7f0000004c00)=@llc={0x1a, 0x32f, 0x100000000, 0x4, 0x800, 0x8, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x80, &(0x7f0000004ec0)=[{&(0x7f0000004c80)}, {&(0x7f0000004d00)}, {&(0x7f0000004dc0)}], 0x3, &(0x7f0000004f00)=[{0x10, 0xff, 0x40}], 0x10, 0x200000c0}, 0x7f20000000000}, {{&(0x7f0000004f80)=@un=@file={0x0, './file0\x00'}, 0x80, &(0x7f0000005280)=[{&(0x7f0000005000)="325363f1814e7c9e6f23c233522b95cca1ce7ca8ca3273db8d50b84add7c22e149c0d4d4c9e27fc94c4e508bdda1f9d9a8ff478d", 0x34}, {&(0x7f0000005040)}, {&(0x7f0000005080)}, {&(0x7f0000005100)}, {&(0x7f0000005180)}], 0x5, &(0x7f0000005300)=[{0x10, 0x18f, 0x7}, {0x78, 0x11, 0x7, "6989c6522d45dd93a1dc20d5c658f170034dd4d78ac1b5bd0a1930099510fb8448aecba06f1c32f1a40fd113ddaa7573eb8ce7312d57656fa70d4400b30e94597f900b281cd9fdd62d69240594fa3ab81a7e19271e97c55be34fab70d04c7afab0de18c0"}, {0x10, 0x88, 0x4}], 0x98, 0x8004}, 0x2}, {{0x0, 0x0, &(0x7f0000007700)=[{&(0x7f00000054c0)}, {&(0x7f0000005500)}, {&(0x7f0000006500)}, {&(0x7f00000065c0)}, {&(0x7f0000006600)}, {&(0x7f0000006700)}], 0x6, &(0x7f0000007780)=[{0x10, 0x112, 0x6}], 0x10, 0x90}, 0x800}, {{&(0x7f0000007880)=@l2={0x1f, 0xdb0, {0xfffffffffffffffa, 0x858, 0x8, 0x5, 0x7f, 0x3f}, 0xff, 0x20}, 0x80, &(0x7f0000007c40)=[{&(0x7f0000007900)}, {&(0x7f0000007a00)}, {&(0x7f0000007b00)}, {&(0x7f0000007b40)}], 0x4, &(0x7f0000007c80)=[{0x10, 0x105, 0x20}, {0x10, 0x1ff, 0x5}, {0x10, 0x0, 0x8}, {0xa0, 0x1ff, 0x6, "56fcd327fcde9356e8a6513c71aaed46943d1fb29a36bfe637fce015cc46484c0339b771f491b98bfef4fd91a14b4bbadaa0dd1bca64830b0c9cdc25c52f62e249087e6d3b30a8b49c4224aa9311b201f4a19d80925f025cf4e55da3f3396d301ccf88e52e72919cea9747dc384e2577fdc0862e8692f0b6cb226a09b2a344786f5b37d2a5b205fb7b327d7ed8ab"}, {0x10, 0x107, 0x4}, {0xd8, 0x11, 0x9, "9ea2b7d4ff526e8e8d9008a298121193978f3a297336a0c320cabc641baac0155fb0bbbab7ca858de6ee300e0896715c267d1719d9775cbe146a6ebe51ffa56b3491069182cae7f4ecd5780403ec287994d4346f0a799c3ae0a6d4ad0097ff2c6fa2c23d4735f034b848d55df9a4fe4b8ac536838748648dcaab33a85a66c2dee3e6200081a944deba337deeb4c10329d0e67965be380b5509ccf8391ead6ab3355422538355263c9e82de4885d134e6ab528d7655e91ad564f0a539222a2eca7a08d0"}], 0x1b8, 0x40}, 0x1}], 0x8, 0x10)
r8 = getpgrp(0xffffffffffffffff)
openat$vcs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vcs\x00', 0x2, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='cpuacct.usage_sys\x00', 0xffffffffffffff9c}, 0x10)
openat$autofs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/autofs\x00', 0x402000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000300)='/dev/hwrng\x00', 0x0, 0x0)
pipe(&(0x7f0000000380)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
r10 = openat$cgroup_ro(r9, &(0x7f00000003c0)='cpuacct.usage_percpu_user\x00', 0x0, 0x0)
perf_event_open(&(0x7f00000000c0)={0x7, 0x70, 0x764, 0xffffffff, 0x14, 0x3, 0x0, 0x200, 0x40, 0x4, 0x2c, 0x1, 0x1f, 0x7818, 0x2, 0x0, 0x4d, 0x7fffffff, 0x3, 0x4, 0x9, 0x5, 0x0, 0xff, 0x10ae, 0x855b, 0x0, 0x1f, 0x5, 0x8, 0x2, 0x0, 0x0, 0x200, 0x5, 0x8, 0xbc, 0x1, 0x0, 0x2, 0x2, @perf_bp={&(0x7f0000000000), 0x3}, 0x400, 0x1, 0x0, 0x6, 0xe04, 0xffff, 0xbd1}, r8, 0x5, r10, 0xa)
r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f00000001c0)={"0000bd68000000010000000000000084", 0x2})
dup2(0xffffffffffffffff, r11)
r12 = socket$inet6(0xa, 0x5, 0x0)
ioctl$FICLONE(r12, 0x40049409, r12)
setsockopt$inet_int(r12, 0x0, 0xf, &(0x7f0000d10ffc)=0x3, 0x4)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r12, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2}, @in={0x2, 0x0, @loopback=0x7f000001}], 0x20)
r13 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r13, 0x6, 0x19, &(0x7f0000000040)=0x9, 0x4)
setsockopt$inet6_tcp_TCP_MD5SIG(r13, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x0, 0x0, @loopback={0x0, 0x1}}}, 0x0, 0x4, 0x0, "bb3e3c09b49a97d5c8a15f5ed755689b13698a6f0e57992796f65ed15cc179711461f1616ca2a4eb03e92e99fca3bc38549aa1c684ed4775b99d7f1d49893b8dd323ec537e8ba6672ce33ededba8bf7d"}, 0xd8)
setsockopt$inet6_tcp_int(r13, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x151)
connect$inet6(r13, &(0x7f0000000140)={0xa, 0x0, 0x0, @ipv4={[], [0xff, 0xff], @dev={0xac, 0x14, 0x14, 0x17}}}, 0x1c)
ioctl$sock_SIOCBRDELBR(r13, 0x89a1, &(0x7f0000000180)='vcan0\x00')
setsockopt$inet6_IPV6_ADDRFORM(r13, 0x29, 0x1, &(0x7f0000000240)=0x2, 0x4)
setsockopt$inet6_tcp_TCP_ULP(r13, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r13, 0x11a, 0x1, &(0x7f0000000100)={0x303, 0x33}, 0x28)
sendto$inet6(r13, &(0x7f00000005c0), 0xfffffdef, 0x40, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xbb}}, 0x1c)
r14 = timerfd_create(0x0, 0x0)
clock_gettime(0x0, &(0x7f00000000c0)={<r15=>0x0, <r16=>0x0})
timerfd_settime(r14, 0x4000000000000203, &(0x7f0000000140)={{r15, r16+10000000}, {0x77359400}}, &(0x7f0000000100))
ioctl$SG_GET_ACCESS_COUNT(r14, 0x2289, &(0x7f0000000080))
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f00000001c0)={<r17=>0xffffffffffffffff}, 0x13f, 0x8}}, 0x20)
write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, &(0x7f0000000240)={0x7, 0x8, 0xfa00, {r17, 0x8}}, 0x10)
timerfd_gettime(r14, &(0x7f0000000040))
r18 = socket(0xc, 0x12, 0x80000000)
getsockopt$IPT_SO_GET_INFO(r18, 0x0, 0x40, &(0x7f0000001440)={'security\x00'}, &(0x7f00000014c0)=0x54)
unshare(0x400)
r19 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendto$inet6(r19, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback={0x0, 0x1}}, 0x1c)
ioctl(0xffffffffffffffff, 0x80044100, &(0x7f0000001f64))
listen(0xffffffffffffffff, 0x0)
r20 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x2801, 0x0)
ioctl$sock_inet_SIOCSARP(r20, 0x8955, &(0x7f0000000140)={{0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x16}}, {0x7, @remote={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0xbb}}, 0x20, {0x2, 0x4e23, @loopback=0x7f000001}, 'ipddp0\x00'})
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file0/file0\x00', 0x0)
read(0xffffffffffffffff, &(0x7f0000000280)=""/1, 0x1)
syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x9, 0x103800)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0)
fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff)
getxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)=@random={'os2.', 'wlan1]@\x00'}, &(0x7f00000002c0)=""/132, 0x84)
close(0xffffffffffffffff)
rt_sigpending(&(0x7f00000002c0), 0x8)