syzbot

BUG: KASAN: slab-out-of-bounds in keychord_write+0x78e/0x7d0 drivers/input/misc/keychord.c:271 at addr ffff8801cc3bc6ce
Read of size 2 by task syz-executor0/3367
CPU: 0 PID: 3367 Comm: syz-executor0 Not tainted 4.9.39-g5b07c2d #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ce0e7b70 ffffffff81eacd59 ffff8801dac01b40 ffff8801cc3bc6c0
 ffff8801cc3bc6d0 ffffed00398778d9 ffff8801cc3bc6ce ffff8801ce0e7b98
 ffffffff81546bfc ffffed00398778d9 ffff8801dac01b40 0000000000000000
Call Trace:
 [<ffffffff81eacd59>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eacd59>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81546bfc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff81546ead>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff81546ead>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81546ead>] kasan_report.part.1+0x20d/0x4e0 mm/kasan/report.c:309
 [<ffffffff815471d9>] kasan_report mm/kasan/report.c:328 [inline]
 [<ffffffff815471d9>] __asan_report_load2_noabort+0x29/0x30 mm/kasan/report.c:328
 [<ffffffff82b4975e>] keychord_write+0x78e/0x7d0 drivers/input/misc/keychord.c:271
 [<ffffffff81572d6b>] __vfs_write+0xfb/0x660 fs/read_write.c:510
 [<ffffffff81576df0>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<ffffffff8157a724>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff8157a724>] SyS_write+0xd4/0x1a0 fs/read_write.c:599
 [<ffffffff839658c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801cc3bc6c0, in cache kmalloc-16 size: 16
Allocated:
PID = 3367
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 __kmalloc+0x128/0x320 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 keychord_write+0x6d/0x7d0 drivers/input/misc/keychord.c:241
 __vfs_write+0xfb/0x660 fs/read_write.c:510
 vfs_write+0x170/0x4e0 fs/read_write.c:560
 SYSC_write fs/read_write.c:607 [inline]
 SyS_write+0xd4/0x1a0 fs/read_write.c:599
 entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 1884
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 fsnotify_oldname_free include/linux/fsnotify.h:311 [inline]
 vfs_rename2+0x4f7/0x1800 fs/namei.c:4524
 SYSC_renameat2 fs/namei.c:4649 [inline]
 SyS_renameat2 fs/namei.c:4538 [inline]
 SYSC_rename fs/namei.c:4689 [inline]
 SyS_rename+0x677/0x7b0 fs/namei.c:4687
 entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801cc3bc580: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
 ffff8801cc3bc600: fb fb fc fc 00 00 fc fc fb fb fc fc fb fb fc fc
>ffff8801cc3bc680: f