r0 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0)
splice(r0, &(0x7f00000001c0)=0x5c1, 0xffffffffffffffff, 0x0, 0x1, 0x4)
r1 = perf_event_open(&(0x7f0000001d80)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xa01}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8)
r2 = syz_mount_image$ext4(0x0, &(0x7f0000000280)='./file0\x00', 0x40ffffffffffff, 0x0, 0x0, 0x9048, 0x0)
r3 = mmap$IORING_OFF_SQES(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x2010, 0xffffffffffffffff, 0x10000000)
io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xbb1c9ef561a5e0cf, 0x6000, @fd, 0x7f, 0x0, 0x0, 0x2, 0x0, {0x1}}, 0x0)
r4 = creat(&(0x7f00000007c0)='./file0/../file0\x00', 0x4)
pwrite64(r4, &(0x7f0000000140)="af", 0x1, 0x0)
openat(r4, &(0x7f0000000080)='./file1\x00', 0xc0000, 0x80)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
dup2(r2, r5)
mount$9p_unix(&(0x7f00000002c0)='./file0/../file0\x00', &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x1001000, 0x0)
r6 = eventfd(0x0)
io_uring_enter(r4, 0x2510, 0x3b00, 0x0, &(0x7f00000000c0)={[0x4efc26cb]}, 0x8)
ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(0xffffffffffffffff, 0xc0189373, &(0x7f0000000880)=ANY=[@ANYBLOB="0100000001000000180000000afa91692ce65e11a0f766aa8f31912fbf7db594ec0bb1304f212385bc0ecf8845ca6a814b11320e58d5d029bc939a4ea1977c18c704a7268661c0ec1dbf9f31d3afefe7dd8c1a1f4cad7fbaf5b546e25c1ad59eafb90f7161559ed22492237336f5942de5a4af436fc6935039", @ANYRES32=r6, @ANYBLOB="00000001000000002e2f66696c653200"])
syz_io_uring_submit(0x0, r3, &(0x7f0000000040)=@IORING_OP_TEE={0x21, 0x2, 0x0, @fd, 0x0, 0x0, 0x7, 0x2, 0x1}, 0x52)
ioctl$BTRFS_IOC_FS_INFO(r1, 0x8400941f, &(0x7f0000000380))
mount$bind(&(0x7f0000000180)='./file1\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x20, 0x0)
mount$bind(&(0x7f0000000100)='./file1\x00', &(0x7f0000000240)='./file1\x00', &(0x7f0000000840), 0x0, 0x0)