program:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2)
write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, 0x0, 0x0)
write$USERIO_CMD_SEND_INTERRUPT(r0, 0x0, 0x0)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000208)={0x2, 0xfa}, 0xd)
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x1000410, &(0x7f0000000000)={[{@errors_remount}, {@grpquota}]}, 0x4, 0x510, &(0x7f0000001a00)="$eJzs3c9vG1kdAPDvOHGSzbqbLvQACNiyLBRU1fnR3agqB9oLCFWVEBUnDm1I3CiKXUdxUprQQ3rkjkQlTvAncOOA1BNI3LjBjUuRQCpQgRokDl7NeJq4SdykbRI39ucjTWbem0m+72X63vO8xn4B9K2zEbEREUMRcSsixvL8JN/iSmtLr3v29P7s5tP7s0k0mzf+lWTn07xo+57Uu/nPHImIH3w34sfJ7riNtfXFmWq1spynx1dqS+ONtfULC4U8Z2p6cnri0sVPpg6trh/UfvPkOwvXfvi7337p8Z82vvnTtFiln53KzrXX4zC1ql6MUlveYERcO4pgXTKY//vh5Elb22ci4sOs/Y/FQHY3AYBe1myORXOsPQ0A9Lr0+b8USaGczwWUolAol1tzeGditFCtN1bOj9VX78xFNod1OoqF2wvVykQ+V3g6ikmansyOt9NTO9IXI+L9iPj58DtZujxbr85184UPAPSxd3eM//8dbo3/AECPG3nF6/2JAACcfK86/gMAJ5/xHwD6zyuM/6b+AaBHeP4HgP5j/AeA/rPv+P/geMoBAByL71+/nm7Nzfzzr+furq1+q3T3wlylsViurc6WZ+vLS+X5en2+WinPNpv7/bxqvb40+fFWsrG2frNWX72zcnOhNjNfuVkpHnF9AID9vf/Bo78kEbFx+Z1si7a1HIzV0NsKr/VdZ8b/8PdDLwpwzAa6XQCga/Z+P88eC/YBPecAz/imAaDH7Tfid/wToYcWf4WT6tznzf9Dv3q9+X+gF7ze/P+3D70cwPHzeV7Qv5rNxJr/ANBnzPEDb/T//wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCnStmWFMrZWuAb6ddCuRxxKiJORzG5vVCtTETEexHx5+HicJqe7HahAYA3VPhHkq//dW7so9LOs0PJ/4azfUT85Jc3fnFvZmVleTLN//dW/srDPH9qqBsVAADaXdmd1Rqn833bg/yzp/dnn2/HWcQnV1uLi6ZxN/OtdWYwBrP9SBQjYvQ/SZ5uSV+vDBxC/I0HEfG57frfa4tQyuZAWiuf7oyfxj51BPG3f/874xdeiF/IzqX7Yva7+OwhlAX6zaOrrX4yb3tpE8vbXyHOZvu92/9I1kO9uef93+au/q+w1f8N7IqfZG3+7Fb65SV58vHvv7crsznWOvcg4guDe8VPtuInHfrfjw5Yx79+8csfdjrX/FXEudg7fkst62bHV2pL44219QsLtZn5ynzlztTU9OT0xKWLn0yNZ3PUra9/3CvGPy+ff69T/LT+ox3ij+xT/68dsP6//v+tH33lJfG/8dW97/+Zl8RPx8SvHzD+zOiVjst3p/HnOtT/hfsfu+t//oDxH/9tfe6AlwIAx6Cxtr44U61Wlvc5SF9r7ndNDx4Mvx3FONqD2Ih4C4qRHwzFW1GMfj4YTG9Bt3sm4KhtN/pulwQAAAAAAAAAAAAAAOiksba+OBxH+3aibtcRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA3vVpAAAA//9gQM2x")
socket$rds(0x15, 0x5, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
r1 = io_uring_setup(0x1b7f, &(0x7f0000000040)={0x0, 0xc89f, 0x8, 0x0, 0x20002f7})
r2 = socket$inet(0x2, 0x80001, 0x84)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x2, 0x9}}, 0x20)
getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8)
fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb)
io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000214)={0x2, 0xfa}, 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000220)={0x2, 0xfa}, 0x2)
[ 94.881047][ T5278] Bluetooth: hci0: command tx timeout
[ 95.031215][ T5314] misc userio: Invalid payload size
[ 95.035446][ T5314] misc userio: Invalid payload size
[ 95.038102][ T5314] misc userio: Invalid payload size
[ 95.097877][ T5314] loop0: detected capacity change from 0 to 512
[ 95.176480][ T5314] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 95.190282][ T5314] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[ 95.673453][ T9] atkbd serio2: Failed to enable keyboard on
[ 95.679640][ T9] input: AT Raw Set 2 keyboard as /devices/serio2/input/input5
[ 95.903155][ T5295] ==================================================================
[ 95.906675][ T5295] BUG: KASAN: slab-use-after-free in atkbd_event_work+0x592/0x650
[ 95.910160][ T5295] Read of size 4 at addr ffff888012cf0164 by task kworker/0:5/5295
[ 95.913571][ T5295]
[ 95.914646][ T5295] CPU: 0 UID: 0 PID: 5295 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 95.914660][ T5295] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.914668][ T5295] Workqueue: events atkbd_event_work
[ 95.914687][ T5295] Call Trace:
[ 95.914695][ T5295]
[ 95.914700][ T5295] dump_stack_lvl+0xe8/0x150
[ 95.914714][ T5295] print_address_description+0x55/0x1e0
[ 95.914726][ T5295] ? atkbd_event_work+0x592/0x650
[ 95.914737][ T5295] print_report+0x58/0x70
[ 95.914747][ T5295] kasan_report+0x117/0x150
[ 95.914760][ T5295] ? atkbd_event_work+0x592/0x650
[ 95.914772][ T5295] atkbd_event_work+0x592/0x650
[ 95.914785][ T5295] ? __pfx_atkbd_event_work+0x10/0x10
[ 95.914797][ T5295] ? rcu_is_watching+0x16/0xb0
[ 95.914807][ T5295] ? process_scheduled_works+0x97a/0x1630
[ 95.914818][ T5295] process_scheduled_works+0xc3d/0x1630
[ 95.914835][ T5295] ? __pfx_process_scheduled_works+0x10/0x10
[ 95.914846][ T5295] ? assign_work+0x3cf/0x5d0
[ 95.914856][ T5295] worker_thread+0xa47/0xfb0
[ 95.914870][ T5295] ? __kthread_parkme+0x71/0x1f0
[ 95.914884][ T5295] kthread+0x38b/0x480
[ 95.914896][ T5295] ? __pfx_worker_thread+0x10/0x10
[ 95.914905][ T5295] ? __pfx_kthread+0x10/0x10
[ 95.914917][ T5295] ret_from_fork+0x514/0xb70
[ 95.914931][ T5295] ? __pfx_ret_from_fork+0x10/0x10
[ 95.914942][ T5295] ? __switch_to+0xc89/0x1420
[ 95.914953][ T5295] ? __pfx_kthread+0x10/0x10
[ 95.914965][ T5295] ret_from_fork_asm+0x1a/0x30
[ 95.914982][ T5295]
[ 95.914985][ T5295]
[ 95.979326][ T5295] Allocated by task 9:
[ 95.981163][ T5295] kasan_save_track+0x3e/0x80
[ 95.983234][ T5295] __kasan_kmalloc+0x93/0xb0
[ 95.985250][ T5295] __kmalloc_cache_noprof+0x331/0x660
[ 95.987560][ T5295] input_allocate_device+0x4e/0x2a0
[ 95.989771][ T5295] atkbd_connect+0xb1/0x9c0
[ 95.991758][ T5295] serio_driver_probe+0x82/0xa0
[ 95.993879][ T5295] really_probe+0x254/0xae0
[ 95.995908][ T5295] __driver_probe_device+0x1e8/0x360
[ 95.998204][ T5295] driver_probe_device+0x4f/0x240
[ 96.000372][ T5295] __device_attach_driver+0x270/0x410
[ 96.002628][ T5295] bus_for_each_drv+0x258/0x2f0
[ 96.004703][ T5295] __device_attach+0x2c4/0x450
[ 96.006791][ T5295] device_initial_probe+0xa1/0xd0
[ 96.008874][ T5295] bus_probe_device+0x12a/0x220
[ 96.010971][ T5295] device_add+0x7d7/0xb80
[ 96.012845][ T5295] serio_handle_event+0x9f2/0xd20
[ 96.014886][ T5295] process_scheduled_works+0xc3d/0x1630
[ 96.017209][ T5295] worker_thread+0xa47/0xfb0
[ 96.019256][ T5295] kthread+0x38b/0x480
[ 96.021056][ T5295] ret_from_fork+0x514/0xb70
[ 96.023117][ T5295] ret_from_fork_asm+0x1a/0x30
[ 96.025243][ T5295]
[ 96.026269][ T5295] Freed by task 5313:
[ 96.027958][ T5295] kasan_save_track+0x3e/0x80
[ 96.029933][ T5295] kasan_save_free_info+0x40/0x50
[ 96.032012][ T5295] __kasan_slab_free+0x5c/0x80
[ 96.033996][ T5295] kfree+0x1c5/0x640
[ 96.035698][ T5295] input_dev_release+0xab/0xc0
[ 96.037744][ T5295] device_release+0xc4/0x1f0
[ 96.039707][ T5295] kobject_put+0x222/0x550
[ 96.041750][ T5295] atkbd_disconnect+0xb5/0x110
[ 96.043762][ T5295] serio_driver_remove+0x85/0xa0
[ 96.045929][ T5295] device_release_driver_internal+0x48b/0x880
[ 96.048515][ T5295] serio_unregister_port+0x128/0x150
[ 96.050863][ T5295] userio_char_release+0x80/0xc0
[ 96.053091][ T5295] __fput+0x418/0xa50
[ 96.054915][ T5295] task_work_run+0x1d9/0x270
[ 96.056979][ T5295] exit_to_user_mode_loop+0x204/0x770
[ 96.059372][ T5295] do_syscall_64+0x328/0x520
[ 96.061423][ T5295] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.064034][ T5295]
[ 96.065072][ T5295] The buggy address belongs to the object at ffff888012cf0000
[ 96.065072][ T5295] which belongs to the cache kmalloc-4k of size 4096
[ 96.070776][ T5295] The buggy address is located 356 bytes inside of
[ 96.070776][ T5295] freed 4096-byte region [ffff888012cf0000, ffff888012cf1000)
[ 96.076571][ T5295]
[ 96.077671][ T5295] The buggy address belongs to the physical page:
[ 96.079919][ T5295] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12cf0
[ 96.082663][ T5295] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 96.085331][ T5295] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 96.087938][ T5295] page_type: f5(slab)
[ 96.089579][ T5295] raw: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122
[ 96.092741][ T5295] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 96.096181][ T5295] head: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122
[ 96.099493][ T5295] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 96.103028][ T5295] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 96.106514][ T5295] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 96.109884][ T5295] page dumped because: kasan: bad access detected
[ 96.112432][ T5295] page_owner tracks the page as allocated
[ 96.114720][ T5295] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4705, tgid 4705 (udevadm), ts 36933287076
[ 96.122091][ T5295] post_alloc_hook+0x1f9/0x250
[ 96.124062][ T5295] get_page_from_freelist+0x2209/0x2280
[ 96.126488][ T5295] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 96.128923][ T5295] allocate_slab+0x7c/0x5e0
[ 96.130961][ T5295] refill_objects+0x2d5/0x350
[ 96.132981][ T5295] __pcs_replace_empty_main+0x2c3/0x6b0
[ 96.135620][ T5295] __kmalloc_noprof+0x489/0x720
[ 96.138099][ T5295] tomoyo_realpath_from_path+0xef/0x640
[ 96.140991][ T5295] tomoyo_path_perm+0x283/0x560
[ 96.143611][ T5295] security_inode_getattr+0x12b/0x310
[ 96.146451][ T5295] __x64_sys_newfstat+0x133/0x270
[ 96.149083][ T5295] do_syscall_64+0x166/0x520
[ 96.151420][ T5295] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.153979][ T5295] page last free pid 4701 tgid 4701 ts 36818955597 stack trace:
[ 96.157099][ T5295] __free_frozen_pages+0xc93/0xd90
[ 96.159336][ T5295] __slab_free+0x274/0x2c0
[ 96.161288][ T5295] qlist_free_all+0x99/0x100
[ 96.163228][ T5295] kasan_quarantine_reduce+0x148/0x160
[ 96.165379][ T5295] __kasan_slab_alloc+0x22/0x80
[ 96.167246][ T5295] kmem_cache_alloc_noprof+0x2a4/0x5f0
[ 96.169289][ T5295] do_getname+0x2e/0x250
[ 96.171063][ T5295] do_sys_openat2+0xcc/0x200
[ 96.173268][ T5295] __x64_sys_openat+0x138/0x170
[ 96.175433][ T5295] do_syscall_64+0x166/0x520
[ 96.177375][ T5295] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.179880][ T5295]
[ 96.180951][ T5295] Memory state around the buggy address:
[ 96.183391][ T5295] ffff888012cf0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.186886][ T5295] ffff888012cf0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.190253][ T5295] >ffff888012cf0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.193631][ T5295] ^
[ 96.196509][ T5295] ffff888012cf0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.199966][ T5295] ffff888012cf0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 96.203247][ T5295] ==================================================================
[ 96.237606][ T5295] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 96.240709][ T5295] CPU: 0 UID: 0 PID: 5295 Comm: kworker/0:5 Not tainted syzkaller #0 PREEMPT(full)
[ 96.244642][ T5295] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.248777][ T5295] Workqueue: events atkbd_event_work
[ 96.250964][ T5295] Call Trace:
[ 96.252563][ T5295]
[ 96.253865][ T5295] vpanic+0x56d/0xa60
[ 96.255626][ T5295] ? __pfx_vpanic+0x10/0x10
[ 96.257641][ T5295] panic+0xc5/0xd0
[ 96.259310][ T5295] ? __pfx_panic+0x10/0x10
[ 96.261299][ T5295] ? preempt_schedule_thunk+0x16/0x40
[ 96.263682][ T5295] ? atkbd_event_work+0x592/0x650
[ 96.265764][ T5295] ? preempt_schedule_thunk+0x16/0x40
[ 96.268008][ T5295] ? atkbd_event_work+0x592/0x650
[ 96.270266][ T5295] check_panic_on_warn+0x89/0xb0
[ 96.272505][ T5295] ? atkbd_event_work+0x592/0x650
[ 96.274743][ T5295] end_report+0x73/0x170
[ 96.276643][ T5295] ? atkbd_event_work+0x592/0x650
[ 96.278873][ T5295] kasan_report+0x128/0x150
[ 96.280894][ T5295] ? atkbd_event_work+0x592/0x650
[ 96.283146][ T5295] atkbd_event_work+0x592/0x650
[ 96.285030][ T5295] ? __pfx_atkbd_event_work+0x10/0x10
[ 96.286963][ T5295] ? rcu_is_watching+0x16/0xb0
[ 96.288844][ T5295] ? process_scheduled_works+0x97a/0x1630
[ 96.291045][ T5295] process_scheduled_works+0xc3d/0x1630
[ 96.293347][ T5295] ? __pfx_process_scheduled_works+0x10/0x10
[ 96.295969][ T5295] ? assign_work+0x3cf/0x5d0
[ 96.297674][ T5295] worker_thread+0xa47/0xfb0
[ 96.299640][ T5295] ? __kthread_parkme+0x71/0x1f0
[ 96.301846][ T5295] kthread+0x38b/0x480
[ 96.303529][ T5295] ? __pfx_worker_thread+0x10/0x10
[ 96.305683][ T5295] ? __pfx_kthread+0x10/0x10
[ 96.307592][ T5295] ret_from_fork+0x514/0xb70
[ 96.309572][ T5295] ? __pfx_ret_from_fork+0x10/0x10
[ 96.311667][ T5295] ? __switch_to+0xc89/0x1420
[ 96.313605][ T5295] ? __pfx_kthread+0x10/0x10
[ 96.315466][ T5295] ret_from_fork_asm+0x1a/0x30
[ 96.317385][ T5295]
[ 96.318977][ T5295] Kernel Offset: disabled
[ 96.320666][ T5295] Rebooting in 86400 seconds..