# https://syzkaller.appspot.com/bug?id=b63199b1d9c34642bf30e532e30263d276d96824
# See https://goo.gl/kgGztJ for information about syzkaller reproducers.
#{"threaded":true,"collide":true,"repeat":true,"procs":1,"sandbox":"","fault_call":-1}
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000400)={'gre0\x00', 0x200})
ioctl$TIOCLINUX2(0xffffffffffffffff, 0x541c, &(0x7f0000000240)={0x2, 0xf800000000000000, 0xeb2, 0x5, 0x0, 0x8})
io_submit(0x0, 0x1, &(0x7f0000000cc0)=[&(0x7f0000000c80)={0x0, 0x0, 0x0, 0x7, 0x3, r0, &(0x7f0000000bc0), 0x0, 0x0, 0x0, 0x2}])
ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x1)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000700)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000480)=[@flat={0x73622a85, 0x0, 0x0, 0x4}], &(0x7f0000000600)=[0x0]}}}], 0x0, 0x0, &(0x7f00000007c0)})