# https://syzkaller.appspot.com/bug?id=1e850009fca0b64ce49dc16499bda4f7de0ab1a5
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":1,"sandbox":"","fault_call":-1,"tmpdir":true}
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x1, 0xfffffffffffffffd, 0xffffffff, 0x0, 0x1, 0x0, 0x40000000000000, 0x1f})
r1 = syz_open_pts(r0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x20000, 0x0)
io_cancel(0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0xffffffffffffffff, r1, &(0x7f0000000140), 0x0, 0x4b, 0x0, 0x0, 0xffffffffffffff9c}, &(0x7f00000002c0))
ioctl$TCSETSW(r1, 0x5437, &(0x7f0000002000)={0x0, 0x7f, 0x0, 0x0, 0x0, 0x7a22, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2000000000})
syz_open_pts(r0, 0x0)
ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x1, 0x7, 0x1bb6, 0x8, 0xfff, 0x20b41040, 0x3ff, 0x0, 0x6a75, 0x3, 0x4, 0x1})