# https://syzkaller.appspot.com/bug?id=949ecf93b67ab1df8f890571d24ef9db50872c96
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":6,"slowdown":1,"sandbox":"none","fault_call":-1,"tun":true,"netdev":true,"resetnet":true,"cgroups":true,"binfmt_misc":true,"close_fds":true,"usb":true,"vhci":true,"wifi":true,"ieee802154":true,"sysctl":true,"tmpdir":true,"segv":true}
socket$inet6_mptcp(0xa, 0x1, 0x106)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001240)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000171000/0x2000)=nil, 0x2000, 0x0, 0x28011, r0, 0xcdc0e000)
connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0)
r1 = accept4$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2711, @local}, 0x10, 0x80800)
setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r1, 0x28, 0x2, &(0x7f0000000080)=0x2, 0x8)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x400086)
getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0xb, &(0x7f0000000240)=""/149, &(0x7f0000000140)=0x95)
r2 = accept4$bt_l2cap(r0, 0x0, &(0x7f00000000c0), 0x800)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='freezer.self_freezing\x00', 0x0, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000880)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000840)={&(0x7f0000000340)=@newchain={0x4fc, 0x64, 0xa11, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xf, 0x2}, {0xfff2, 0xb}, {0xfff1, 0x5}}, [@filter_kind_options=@f_tcindex={{0xc, 0x1, 'tcindex\x00'}, {0x478, 0x2, [@TCA_TCINDEX_CLASSID={0x8, 0x5, {0xfff3, 0x7}}, @TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_FALL_THROUGH={0x8}, @TCA_TCINDEX_POLICE={0x454, 0x6, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x7ff, 0x92, 0x20, 0x8000, 0x7, 0x7fff, 0x1, 0x80000000, 0x0, 0x9b, 0x0, 0xda5, 0x7, 0x6, 0x7, 0x2, 0x1, 0x80000000, 0x401, 0x5, 0x6, 0x3, 0x43e6, 0x0, 0xffffffff, 0x3, 0x5, 0x80000000, 0x9, 0x9, 0x40, 0xe, 0x1, 0x8, 0x3, 0x80000000, 0x400, 0x6, 0x4, 0x2, 0x980, 0xffffffff, 0x5, 0x4, 0x4, 0x1, 0x4, 0xfffffffa, 0x0, 0x2, 0xcb9, 0x0, 0x4, 0x80000004, 0x3, 0x7, 0xa7, 0x8001, 0x3, 0x1, 0x2, 0x7fff, 0x5, 0x4, 0x1, 0x82a, 0x4a01, 0x20, 0x4, 0x6, 0x6, 0x7, 0x8000, 0x8, 0x8000, 0x6, 0x1ff, 0x7ff, 0x7, 0x20, 0x4d6527bf, 0xfff, 0x8, 0x3, 0xb1bf, 0xa15, 0xffffffff, 0x5, 0x6, 0x2, 0x53, 0x8, 0x8, 0x3dc, 0x9, 0x0, 0x7bb4, 0x8c, 0xfff, 0x1000, 0x401e15cd, 0x800, 0x40, 0x7, 0xf02, 0x10000, 0x9a6e, 0x20, 0x9, 0x1, 0x3, 0x9, 0x2, 0x100, 0xbd, 0x9, 0x9ec, 0x8000, 0x80, 0x9, 0x8000, 0x3, 0x4, 0x81, 0x10001, 0x3, 0x0, 0x56c, 0x5, 0x1, 0x5, 0x4, 0x2, 0xfffff001, 0x0, 0x0, 0x1, 0x9, 0x3f, 0x7, 0x2, 0x0, 0x96, 0x80000000, 0x1000, 0xff, 0x7477, 0x5, 0x800, 0x3, 0x1, 0x4, 0x8, 0x5, 0x6, 0xefcf, 0xffffffff, 0x7ff, 0x7, 0x1, 0x5, 0x20, 0x1dfb, 0x7f, 0x2, 0xb9e, 0x200, 0x200, 0x2, 0x7fffffff, 0x20, 0xdb62, 0x7fffffff, 0xfffffbff, 0x101, 0xfffff800, 0x4, 0x3, 0x5, 0x1ff, 0x1, 0x0, 0x7, 0x3f, 0x5, 0x9, 0x80000001, 0x6, 0x8001, 0x7, 0x7, 0x5f, 0x1, 0x1, 0x8, 0xffffffff, 0x772, 0x4, 0x7, 0xfff, 0x4, 0x5, 0x53, 0x4, 0xe3db, 0x1, 0x5, 0x5, 0x6, 0x6, 0x3, 0x10001, 0x401, 0x40, 0x7, 0x101, 0x81, 0x0, 0x4, 0x9, 0x8000, 0x7, 0x10000, 0xef, 0xd185, 0x9, 0x8, 0x10000, 0xb5, 0x100, 0x7ff, 0x80, 0x7fff, 0x1, 0x80000001, 0xe34, 0x2, 0x2, 0x7, 0x0, 0x100, 0x9, 0x7f, 0x6, 0xc1a, 0x4, 0x4, 0x7, 0x3ff, 0x2, 0x2, 0x5, 0x8, 0xff, 0xc5800000, 0x400]}, @TCA_POLICE_RESULT={0x8, 0x5, 0x1000}, @TCA_POLICE_TBF={0x3c, 0x1, {0x2d64, 0x8, 0x7ff, 0x400, 0x6, {0x80, 0x2, 0x200, 0x1f, 0x33a, 0x9}, {0x3, 0x0, 0x5, 0x400, 0x1f, 0x81}, 0xfffffffa, 0x800000, 0x2}}, @TCA_POLICE_RESULT={0x8, 0x5, 0x40}]}, @TCA_TCINDEX_HASH={0x8, 0x1, 0x2e31}]}}, @filter_kind_options=@f_flow={{0x9, 0x1, 'flow\x00'}, {0x14, 0x2, [@TCA_FLOW_DIVISOR={0x8, 0x8, 0xf9}, @TCA_FLOW_KEYS={0x8, 0x1, 0x14f4}]}}, @TCA_RATE={0x6, 0x5, {0x5}}, @filter_kind_options=@f_u32={{0x8, 0x1, 'u32\x00'}, {0xc, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x3}]}}, @TCA_CHAIN={0x8, 0xb, 0x8000}, @TCA_RATE={0x6, 0x5, {0x4, 0x9}}, @TCA_RATE={0x6, 0x5, {0x1, 0x81}}]}, 0x4fc}, 0x1, 0x0, 0x0, 0x8000}, 0x4004881)
sendfile(r2, 0xffffffffffffffff, 0x0, 0x200)
unshare(0x40000000)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x400086)