==================================================================
BUG: KASAN: slab-out-of-bounds in keychord_write+0x78e/0x7d0 drivers/input/misc/keychord.c:271 at addr ffff8801d0efd1ce
Read of size 2 by task syz-executor7/9141
CPU: 0 PID: 9141 Comm: syz-executor7 Not tainted 4.9.39-g5b07c2d #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801ce86fb70 ffffffff81eacd59 ffff8801dac01b40 ffff8801d0efd1c0
 ffff8801d0efd1d0 ffffed003a1dfa39 ffff8801d0efd1ce ffff8801ce86fb98
 ffffffff81546bfc ffffed003a1dfa39 ffff8801dac01b40 0000000000000000
Call Trace:
 [<ffffffff81eacd59>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eacd59>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81546bfc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff81546ead>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff81546ead>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81546ead>] kasan_report.part.1+0x20d/0x4e0 mm/kasan/report.c:309
 [<ffffffff815471d9>] kasan_report mm/kasan/report.c:328 [inline]
 [<ffffffff815471d9>] __asan_report_load2_noabort+0x29/0x30 mm/kasan/report.c:328
 [<ffffffff82b4975e>] keychord_write+0x78e/0x7d0 drivers/input/misc/keychord.c:271
 [<ffffffff81572d6b>] __vfs_write+0xfb/0x660 fs/read_write.c:510
 [<ffffffff81576df0>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<ffffffff8157a724>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff8157a724>] SyS_write+0xd4/0x1a0 fs/read_write.c:599
 [<ffffffff839658c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Object at ffff8801d0efd1c0, in cache kmalloc-16 size: 16
Allocated:
PID = 9141
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 __kmalloc+0x128/0x320 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 keychord_write+0x6d/0x7d0 drivers/input/misc/keychord.c:241
 __vfs_write+0xfb/0x660 fs/read_write.c:510
 vfs_write+0x170/0x4e0 fs/read_write.c:560
 SYSC_write fs/read_write.c:607 [inline]
 SyS_write+0xd4/0x1a0 fs/read_write.c:599
 entry_SYSCALL_64_fastpath+0x23/0xc6
Freed:
PID = 6
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 ops_free net/core/net_namespace.c:126 [inline]
 ops_free_list.part.8+0x1ff/0x330 net/core/net_namespace.c:148
 ops_free_list net/core/net_namespace.c:146 [inline]
 cleanup_net+0x3b3/0x600 net/core/net_namespace.c:458
 process_one_work+0x774/0x15c0 kernel/workqueue.c:2096
 worker_thread+0x125/0x1020 kernel/workqueue.c:2230
 kthread+0x265/0x300 kernel/kthread.c:211
 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:433
Memory state around the buggy address:
 ffff8801d0efd080: fb fb fc fc fb fb fc fc 00 00 fc fc 00 00 fc fc
 ffff8801d0efd100: 00 00 fc fc 00 00 fc fc fb fb fc fc fb fb fc fc
>ffff8801d0efd180: fb fb fc fc fb fb fc fc 00 04 fc fc fb fb fc fc
                                              ^
 ffff8801d0efd200: fb fb fc fc fb fb fc fc fb fb fc fc fb fb fc fc
 ffff8801d0efd280: fb fb fc fc 00 00 fc fc fb fb fc fc 00 00 fc fc
==================================================================
keychord: invalid keycode count 0
nla_parse: 37 callbacks suppressed
netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor0'.
random: crng init done
sd 0:0:1:0: [sg0] tag#720 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK
sd 0:0:1:0: [sg0] tag#720 CDB: Test Unit Ready
sd 0:0:1:0: [sg0] tag#720 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#720 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#720 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#720 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#720 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK
sd 0:0:1:0: [sg0] tag#395 CDB: Test Unit Ready
sd 0:0:1:0: [sg0] tag#395 CDB[00]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 CDB[10]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 CDB[20]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 CDB[30]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 CDB[40]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#395 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#720 CDB[50]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#720 CDB[60]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
sd 0:0:1:0: [sg0] tag#720 CDB[70]: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00