# https://syzkaller.appspot.com/bug?id=ac2a50583e1c2b45a166efa7824b09e5b6d2c7e7
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":6,"sandbox":"none","fault_call":-1,"tun":true,"tmpdir":true,"cgroups":true,"netdev":true,"resetnet":true,"segv":true}
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x1, 0xfffffffffffffffd, 0xffffffff, 0x0, 0x1, 0x0, 0x40000000000000, 0x1f})
r1 = syz_open_pts(r0, 0x0)
io_setup(0xff, &(0x7f0000000100)=<r2=>0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x20000, 0x0)
io_cancel(r2, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0xffffffffffffffff, r1, &(0x7f0000000140), 0x0, 0x4b, 0x0, 0x0, 0xffffffffffffff9c}, &(0x7f00000002c0))
ioctl$TCSETSW(r1, 0x5437, &(0x7f0000002000)={0x0, 0x7f, 0x0, 0x0, 0x0, 0x7a22, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2000000000})
syz_open_pts(r0, 0x0)
ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x1, 0x7, 0x1bb6, 0x8, 0xfff, 0x20b41040, 0x3ff, 0x0, 0x6a75, 0x3, 0x4, 0x1})