# https://syzkaller.appspot.com/bug?id=10cd2ff2ccd320618b127ec50ea6e5a55461cd76
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":6,"sandbox":"none","fault_call":-1,"tun":true,"tmpdir":true,"cgroups":true,"netdev":true,"resetnet":true,"segv":true}
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x88, r1, 0x1, 0x0, 0x0, {0x3, 0x1200}, [@TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1f}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x800}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER={0x48, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8001}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x14, 0x2, @in={0x2, 0x4e21, @remote}}}}]}]}, 0x88}}, 0x10)
r2 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r3 = epoll_create(0x143)
r4 = epoll_create(0x20)
r5 = epoll_create(0x7fffffff)
epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r5, &(0x7f000000e000))
epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r2, &(0x7f000000d000))
epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, 0x0)
r6 = epoll_create(0x4)
epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r2, &(0x7f0000000080))
r7 = epoll_create(0x5)
epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r3, &(0x7f0000c7f000))
epoll_create(0x3)
epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000d5dff4))
socket$nl_generic(0x10, 0x3, 0x10)
r8 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r9 = userfaultfd(0x0)
ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0xc})
r10 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
r11 = openat$dlm_control(0xffffffffffffff9c, 0x0, 0x2880, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r11, 0x84, 0x13, &(0x7f0000000180)=0xb7, 0x4)
add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb)
setsockopt$inet6_MRT6_DEL_MFC(r10, 0x29, 0xd1, &(0x7f0000000000)={{0xa, 0x0, 0x0, @dev}, {0xa, 0x0, 0x0, @mcast2}}, 0x4)
setsockopt$inet6_MRT6_ADD_MIF(r10, 0x29, 0xca, 0x0, 0x0)
fgetxattr(r8, &(0x7f0000000000)=@known='system.posix_acl_access\x00', &(0x7f0000000080), 0x0)
ioctl$UFFDIO_REGISTER(r9, 0xc020aa00, 0x0)
read(r8, &(0x7f0000465f8e)=""/114, 0x37)
readv(r9, &(0x7f00000006c0)=[{&(0x7f0000000280)=""/71, 0x47}], 0x1)
syz_init_net_socket$ax25(0x3, 0x3, 0x0)
r12 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r12, 0x6, 0xd, 0x0, 0x0)
bind$inet(r12, &(0x7f00000003c0)={0x2, 0x200000000004e23, @rand_addr=0x2}, 0x10)
openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0)
recvmsg(r12, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100)
write$binfmt_elf64(r12, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd)
mknod(&(0x7f0000000140)='./file0\x00', 0x10001040, 0x0)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0xffffffffffffff27}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='/\x02roup.stap\x00', 0x2761, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x3, &(0x7f0000001fd8)=@framed={{0xffffffb7, 0x0, 0x0, 0x0, 0x0, 0x44}}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48)
r13 = socket(0xa, 0x1, 0x0)
setsockopt$inet6_group_source_req(r13, 0x29, 0x2e, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0x2, 0x0, 0x0, @empty}}}, 0x108)
r14 = socket(0x0, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
setsockopt$packet_int(r14, 0x107, 0x0, 0x0, 0x0)
ioctl$ASHMEM_GET_PROT_MASK(0xffffffffffffffff, 0x7706, 0x0)
syz_open_dev$swradio(0x0, 0xffffffffffffffff, 0x2)
sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
bind$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x14)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0)
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480))
setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0)
setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xcb, &(0x7f0000000080), 0x4)
io_submit(0x0, 0x1, &(0x7f0000001540)=[0x0])
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r15 = socket$inet(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r15, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x0, 'lblc\x00', 0x2, 0x7b, 0x2a}, 0x2c)
r16 = syz_open_dev$video4linux(&(0x7f0000000080)='/dev/v4l-subdev#\x00', 0x3, 0x0)
ioctl$VIDIOC_SUBDEV_S_EDID(r16, 0x80885659, 0x0)
mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0)
r17 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0)
lseek(r17, 0x2, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000140)='/dev/kvm\x00', 0x0, 0x0)
r18 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0)
r19 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0xa3d9, 0x80)
ioctl$BLKPG(r19, 0x1269, 0x0)
ioctl$KVM_NMI(r18, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000001000/0x2000)=nil})
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000003400)={{{@in6=@ipv4, @in=@remote}}, {{@in=@local}, 0x0, @in=@local}}, 0x0)
sendmsg$unix(0xffffffffffffffff, 0x0, 0x20000805)
unshare(0x8020000)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x200000, 0x0)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
setns(0xffffffffffffffff, 0x0)
clone(0x10062101, 0x0, 0x0, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getpid()
r20 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r21 = ioctl$KVM_CREATE_VM(r20, 0xae01, 0x0)
r22 = ioctl$KVM_CREATE_VCPU(r21, 0xae41, 0x0)
r23 = socket$pppoe(0x18, 0x1, 0x0)
syz_kvm_setup_cpu$x86(r23, r22, &(0x7f0000036000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r24 = socket$inet(0x2, 0x3, 0x1)
setsockopt$IP_VS_SO_SET_ADD(r24, 0x0, 0x482, &(0x7f0000000000)={0x84, @multicast2, 0x0, 0x0, 'lblc\x00', 0x2, 0x7b, 0x2a}, 0x2c)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
mkdir(&(0x7f0000000180)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='devtmpfs\x00', 0x0, 0x0)
r25 = inotify_init()
inotify_add_watch(r25, &(0x7f0000000080)='./file0\x00', 0x2000040000002)
r26 = socket$inet(0x2, 0x4000000000000001, 0x0)
getsockopt$inet_tcp_int(r26, 0x6, 0xc, 0x0, &(0x7f00000000c0))
bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xa, 0x4, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x50}]}, &(0x7f0000000000)='GPL\x00', 0x1, 0x3f9, &(0x7f00001a7f05)=""/251}, 0x48)
r27 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000)='/dev/nullb0\x00', 0x4002, 0x0)
io_setup(0x5b3, &(0x7f0000000040)=<r28=>0x0)
io_submit(r28, 0x1, &(0x7f0000001540)=[&(0x7f0000000180)={0x0, 0x0, 0xf0000000000002, 0x1, 0x0, r27, 0x0}])
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
socket$inet(0x2, 0x3, 0x1)
syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x6, 0x80)
socket$unix(0x1, 0x4, 0x0)
socket$tipc(0x1e, 0x2, 0x0)
r29 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
wait4(0x0, 0x0, 0x80000000, 0x0)
exit_group(0x0)
ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f0000001540)={0x3, 0x10000, 0x7, {0xc, @sliced={0x0, [0x0, 0x533, 0x5, 0x9, 0x7ff, 0x6, 0x1, 0x1000, 0x0, 0x9, 0x0, 0x0, 0x401, 0x2, 0x3, 0x0, 0xffffffffffffffff, 0xffffffff, 0x3f, 0x6, 0xafa, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x9, 0x81, 0x0, 0x10001, 0x0, 0x80, 0x0, 0x88, 0x0, 0x0, 0x0, 0x1293ba14, 0x3], 0x6}}})
r30 = socket$inet(0x2, 0x80001, 0x0)
unshare(0x44000000)
ioctl$EVIOCGREP(0xffffffffffffffff, 0x80084503, &(0x7f0000000000)=""/223)
socket$inet6(0xa, 0x400000000001, 0xffffffff7fffffff)
ioctl$CAPI_GET_SERIAL(r29, 0xc0044308, &(0x7f0000000140)=0x400)
syz_open_dev$cec(0x0, 0xffffffffffffffff, 0x2)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r31 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r31, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0)
bind$inet(r30, &(0x7f0000000080)={0x2, 0x4e20, @loopback}, 0x10)
ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0)
ioctl$KVM_GET_CPUID2(0xffffffffffffffff, 0xc008ae91, 0x0)