program:
r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000040)={0x1, 0x1}, 0x2)
write$USERIO_CMD_REGISTER(r0, &(0x7f0000000080), 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, 0x0, 0x0)
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000240)={[{@nojournal_checksum}, {@grpjquota}, {@bh}]}, 0x1, 0x4c8, &(0x7f0000000540)="$eJzs3c1vG2UaAPDHdpMmaXb7satV25W2lXal7oca50OrJsCFE3CohKjEBaQSEjeUOHEUO6WJekjh1gMHBAIJceDOX8CFnqiQUM9wRxxQEZQgARKSkcd2mw87NZDaKPP7SW7ed2bq530zel6P35nJBJBap2v/ZCKGI+J2RByuV7ducLr+Y+NuLjbuXpvJRLV64ZtMsl2t3ty0+f8ORcR6RAxExDNPRLyY2Rm3vLo2P10sFpYb9XxlYSlfXl07e3lheq4wV1gcmzw3NTU5OjE+tWd9vfH6yzfOf/hU/wc/vHbn1hsff1Rr1nBj3eZ+7KV61/vi6KZlByLisYcRrAdyjf4M9roh/Ca1/feXRvl2HI5csjeBNKhWq9WfqwfbrV6vAvtWNjkGzmRHIqJezmZHRurH8H+NoWyxVK7871JpZXG2fqx8JPqyly4XC6ON7wpHoi9Tq48l5fv18W31iYjkGPjN3GBSH5kpFWe7O9QB2xzalv/f5+r5D6SEr/yQXg/M/+HutAPoPp//kF7yH9LrV+T/+sNsB9B9Pv8hveQ/pJf8h/Takv/V3rUD6D6f/5Be8h9S6enz52uvavP+99krqyvzpStnZwvl+ZGFlZmRmdLy0shcqTSX3LOz8KD3K5ZKS2P/j5Wr+UqhXMmXV9cuLpRWFisXk/v6Lxb6utIroBNHT938PBMR648MJq+a/sY6uQr7W7WaiV7fgwz0Rq7XAxDQM6b+IL18xwda/IneLQbarVja+7YA3ZHtdQOAnjlzwvk/SCvz/5Be5v8hvRzjA+b/IX3M/0N6Dbd5/tefNj27azQi/hwRn+X6Djaf9QXsB9mvMo3j/zOH/7XjQR/9mR+TUwT9EfHKuxfevjpdqSyP1ZZ/e2955Z3G8vFetB/oVDNPm3kMAKTXxt1rM81XN+N+/Xj9IoSd8Q805iYHknOUQxuZLdcqZPbo2oX16xFxvFX8TON55/UzH0MbuR3xjzV+ZupvkbT3QPLc9O7EP7Ep/j82xT/5u38rkA43a+PPaKv8yyY5Hffyb+v4M7xH1060H/+y98a/XKvxry/iVIcxXnrv1S/bxr8ecbJl/Ga8gWR82R6/1rYzHca/8/yzf2u3rvp+/X1axW+qlfKVhaV8eXXtbPJ35OYKi2OT56amJkcnxqfyyRx1vjlTndiyax49/umt3fo/1Cb+bv2vLftPh/3/6e+fPHd6l/j//mfr/X9sl/iDEfHfDuN/N/7FC+3W1eLPtul/dpf4tWUTHcYvv/XkwQ43BQC6oLy6Nj9dLBaWFRRaFQbiD9EMhW4Xej0yAQ/b/aTvdUsAAAAAAAAAAACATrW9DHgwIvbocuJe9xEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYD/4JQAA//+TK9Rn")
syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x0)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000204)={0x2, 0xfa}, 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000208)={0x2, 0xfa}, 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000214)={0x2, 0xfa}, 0x2)
write$USERIO_CMD_SEND_INTERRUPT(r0, 0x0, 0x0)
[ 132.892448][ T4642] Bluetooth: hci0: command tx timeout
[ 133.010465][ T5327] misc userio: Invalid payload size
[ 133.038161][ T5327] loop0: detected capacity change from 0 to 512
[ 133.064685][ T5327] EXT4-fs: Ignoring removed bh option
[ 133.101905][ T5327] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled
[ 133.123477][ T5327] EXT4-fs (loop0): ext4_check_descriptors: Inode table for group 0 not in group (block 0)!
[ 133.163997][ T5327] EXT4-fs (loop0): group descriptors corrupted!
[ 133.341371][ T5328] misc userio: Invalid payload size
[ 133.755756][ T1362] atkbd serio2: Failed to enable keyboard on
[ 133.781757][ T1362] input: AT Raw Set 2 keyboard as /devices/serio2/input/input5
[ 134.001224][ T10] ==================================================================
[ 134.004866][ T10] BUG: KASAN: slab-use-after-free in atkbd_event_work+0x592/0x650
[ 134.008376][ T10] Read of size 4 at addr ffff8880127bc164 by task kworker/0:1/10
[ 134.011728][ T10]
[ 134.012906][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 134.012922][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 134.012930][ T10] Workqueue: events atkbd_event_work
[ 134.012949][ T10] Call Trace:
[ 134.012956][ T10]
[ 134.012961][ T10] dump_stack_lvl+0xe8/0x150
[ 134.012977][ T10] print_address_description+0x55/0x1e0
[ 134.012991][ T10] ? atkbd_event_work+0x592/0x650
[ 134.013002][ T10] print_report+0x58/0x70
[ 134.013014][ T10] kasan_report+0x117/0x150
[ 134.013030][ T10] ? atkbd_event_work+0x592/0x650
[ 134.013045][ T10] atkbd_event_work+0x592/0x650
[ 134.013060][ T10] ? __pfx_atkbd_event_work+0x10/0x10
[ 134.013072][ T10] ? rcu_is_watching+0x16/0xb0
[ 134.013084][ T10] ? process_scheduled_works+0x97a/0x1630
[ 134.013096][ T10] process_scheduled_works+0xc3d/0x1630
[ 134.013114][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 134.013127][ T10] ? assign_work+0x3cf/0x5d0
[ 134.013140][ T10] worker_thread+0xa47/0xfb0
[ 134.013158][ T10] kthread+0x38b/0x480
[ 134.013173][ T10] ? __pfx_worker_thread+0x10/0x10
[ 134.013184][ T10] ? __pfx_kthread+0x10/0x10
[ 134.013198][ T10] ret_from_fork+0x514/0xb70
[ 134.013213][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 134.013226][ T10] ? __switch_to+0xc89/0x1420
[ 134.013239][ T10] ? __pfx_kthread+0x10/0x10
[ 134.013252][ T10] ret_from_fork_asm+0x1a/0x30
[ 134.013271][ T10]
[ 134.013275][ T10]
[ 134.195387][ T10] Allocated by task 1362:
[ 134.197813][ T10] kasan_save_track+0x3e/0x80
[ 134.213784][ T10] __kasan_kmalloc+0x93/0xb0
[ 134.215628][ T10] __kmalloc_cache_noprof+0x331/0x660
[ 134.218587][ T10] input_allocate_device+0x4e/0x2a0
[ 134.221781][ T10] atkbd_connect+0xb1/0x9c0
[ 134.224416][ T10] serio_driver_probe+0x82/0xa0
[ 134.227415][ T10] really_probe+0x254/0xae0
[ 134.242463][ T10] __driver_probe_device+0x1e8/0x360
[ 134.244607][ T10] driver_probe_device+0x4f/0x240
[ 134.246694][ T10] __device_attach_driver+0x270/0x410
[ 134.248974][ T10] bus_for_each_drv+0x258/0x2f0
[ 134.251406][ T10] __device_attach+0x2c4/0x450
[ 134.254017][ T10] device_initial_probe+0xa1/0xd0
[ 134.271088][ T10] bus_probe_device+0x12a/0x220
[ 134.273462][ T10] device_add+0x7d7/0xb80
[ 134.276080][ T10] serio_handle_event+0x9f2/0xd20
[ 134.293541][ T10] process_scheduled_works+0xc3d/0x1630
[ 134.296802][ T10] worker_thread+0xa47/0xfb0
[ 134.298836][ T10] kthread+0x38b/0x480
[ 134.318457][ T10] ret_from_fork+0x514/0xb70
[ 134.321333][ T10] ret_from_fork_asm+0x1a/0x30
[ 134.336946][ T10]
[ 134.338279][ T10] Freed by task 5326:
[ 134.345013][ T10] kasan_save_track+0x3e/0x80
[ 134.346936][ T10] kasan_save_free_info+0x40/0x50
[ 134.349024][ T10] __kasan_slab_free+0x5c/0x80
[ 134.351007][ T10] kfree+0x1c5/0x640
[ 134.367039][ T10] input_dev_release+0xab/0xc0
[ 134.370099][ T10] device_release+0xc4/0x1f0
[ 134.372383][ T10] kobject_put+0x222/0x550
[ 134.374862][ T10] atkbd_disconnect+0xb5/0x110
[ 134.377937][ T10] serio_driver_remove+0x85/0xa0
[ 134.385411][ T10] device_release_driver_internal+0x48b/0x880
[ 134.392581][ T10] serio_unregister_port+0x128/0x150
[ 134.396541][ T10] userio_char_release+0x80/0xc0
[ 134.399792][ T10] __fput+0x418/0xa50
[ 134.402266][ T10] task_work_run+0x1d9/0x270
[ 134.405164][ T10] exit_to_user_mode_loop+0x204/0x770
[ 134.408766][ T10] do_syscall_64+0x328/0x520
[ 134.411954][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 134.415960][ T10]
[ 134.417822][ T10] The buggy address belongs to the object at ffff8880127bc000
[ 134.417822][ T10] which belongs to the cache kmalloc-4k of size 4096
[ 134.457512][ T10] The buggy address is located 356 bytes inside of
[ 134.457512][ T10] freed 4096-byte region [ffff8880127bc000, ffff8880127bd000)
[ 134.464315][ T10]
[ 134.465362][ T10] The buggy address belongs to the physical page:
[ 134.468013][ T10] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127b8
[ 134.488049][ T10] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 134.491971][ T10] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 134.496663][ T10] page_type: f5(slab)
[ 134.499332][ T10] raw: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122
[ 134.504858][ T10] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 134.509752][ T10] head: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122
[ 134.514985][ T10] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[ 134.519050][ T10] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 134.522516][ T10] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[ 134.527463][ T10] page dumped because: kasan: bad access detected
[ 134.531485][ T10] page_owner tracks the page as allocated
[ 134.535204][ T10] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4693, tgid 4693 (udevd), ts 36084718544
[ 134.548897][ T10] post_alloc_hook+0x1f9/0x250
[ 134.552590][ T10] get_page_from_freelist+0x2209/0x2280
[ 134.556657][ T10] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 134.560463][ T10] allocate_slab+0x7c/0x5e0
[ 134.563579][ T10] refill_objects+0x2d5/0x350
[ 134.566767][ T10] __pcs_replace_empty_main+0x2c3/0x6b0
[ 134.570100][ T10] __kmalloc_noprof+0x489/0x720
[ 134.572869][ T10] tomoyo_realpath_from_path+0xef/0x640
[ 134.575983][ T10] tomoyo_check_open_permission+0x229/0x470
[ 134.579497][ T10] security_file_open+0xa9/0x240
[ 134.582644][ T10] do_dentry_open+0x4a0/0x1380
[ 134.585666][ T10] vfs_open+0x3b/0x340
[ 134.588077][ T10] path_openat+0x1443/0x1d60
[ 134.590885][ T10] do_file_open+0x23e/0x4a0
[ 134.593922][ T10] do_sys_openat2+0x115/0x200
[ 134.596680][ T10] __x64_sys_openat+0x138/0x170
[ 134.599922][ T10] page last free pid 4694 tgid 4694 ts 35597761408 stack trace:
[ 134.604456][ T10] __free_frozen_pages+0xc93/0xd90
[ 134.607719][ T10] __slab_free+0x274/0x2c0
[ 134.610407][ T10] qlist_free_all+0x99/0x100
[ 134.613164][ T10] kasan_quarantine_reduce+0x148/0x160
[ 134.616483][ T10] __kasan_slab_alloc+0x22/0x80
[ 134.620605][ T10] __kmalloc_cache_noprof+0x2af/0x660
[ 134.623813][ T10] kernfs_fop_open+0x3ac/0xce0
[ 134.626619][ T10] do_dentry_open+0x816/0x1380
[ 134.629368][ T10] vfs_open+0x3b/0x340
[ 134.634839][ T10] path_openat+0x1443/0x1d60
[ 134.638038][ T10] do_file_open+0x23e/0x4a0
[ 134.642263][ T10] do_sys_openat2+0x115/0x200
[ 134.645022][ T10] __x64_sys_openat+0x138/0x170
[ 134.648552][ T10] do_syscall_64+0x166/0x520
[ 134.651896][ T10] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 134.659242][ T10]
[ 134.670529][ T10] Memory state around the buggy address:
[ 134.673125][ T10] ffff8880127bc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.677187][ T10] ffff8880127bc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.681387][ T10] >ffff8880127bc100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.686889][ T10] ^
[ 134.691168][ T10] ffff8880127bc180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.695730][ T10] ffff8880127bc200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 134.699328][ T10] ==================================================================
[ 134.769864][ T10] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 134.774231][ T10] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full)
[ 134.780464][ T10] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 134.786343][ T10] Workqueue: events atkbd_event_work
[ 134.788508][ T10] Call Trace:
[ 134.790533][ T10]
[ 134.792230][ T10] vpanic+0x56d/0xa60
[ 134.794511][ T10] ? __pfx_vpanic+0x10/0x10
[ 134.797124][ T10] panic+0xc5/0xd0
[ 134.801374][ T10] ? __pfx_panic+0x10/0x10
[ 134.805052][ T10] ? preempt_schedule_thunk+0x16/0x40
[ 134.807381][ T10] ? atkbd_event_work+0x592/0x650
[ 134.810718][ T10] ? preempt_schedule_thunk+0x16/0x40
[ 134.814360][ T10] ? atkbd_event_work+0x592/0x650
[ 134.817191][ T10] check_panic_on_warn+0x89/0xb0
[ 134.820009][ T10] ? atkbd_event_work+0x592/0x650
[ 134.822842][ T10] end_report+0x73/0x170
[ 134.825329][ T10] ? atkbd_event_work+0x592/0x650
[ 134.830113][ T10] kasan_report+0x128/0x150
[ 134.833101][ T10] ? atkbd_event_work+0x592/0x650
[ 134.837599][ T10] atkbd_event_work+0x592/0x650
[ 134.840361][ T10] ? __pfx_atkbd_event_work+0x10/0x10
[ 134.843436][ T10] ? rcu_is_watching+0x16/0xb0
[ 134.846189][ T10] ? process_scheduled_works+0x97a/0x1630
[ 134.849493][ T10] process_scheduled_works+0xc3d/0x1630
[ 134.852362][ T10] ? __pfx_process_scheduled_works+0x10/0x10
[ 134.854786][ T10] ? assign_work+0x3cf/0x5d0
[ 134.857268][ T10] worker_thread+0xa47/0xfb0
[ 134.860416][ T10] kthread+0x38b/0x480
[ 134.863404][ T10] ? __pfx_worker_thread+0x10/0x10
[ 134.866430][ T10] ? __pfx_kthread+0x10/0x10
[ 134.869169][ T10] ret_from_fork+0x514/0xb70
[ 134.872886][ T10] ? __pfx_ret_from_fork+0x10/0x10
[ 134.876089][ T10] ? __switch_to+0xc89/0x1420
[ 134.878493][ T10] ? __pfx_kthread+0x10/0x10
[ 134.880496][ T10] ret_from_fork_asm+0x1a/0x30
[ 134.885700][ T10]
[ 134.887868][ T10] Kernel Offset: disabled
[ 134.890613][ T10] Rebooting in 86400 seconds..