================================================================== BUG: KASAN: use-after-free in get_max_inline_xattr_value_size+0x387/0x530 fs/ext4/inline.c:62 Read of size 4 at addr ffff888104bab084 by task kworker/1:1/88 CPU: 1 PID: 88 Comm: kworker/1:1 Not tainted 5.15.78-syzkaller-00911-gc73b4619ad86 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: events p9_write_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description+0x87/0x3d0 mm/kasan/report.c:256 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x1a6/0x1f0 mm/kasan/report.c:452 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 get_max_inline_xattr_value_size+0x387/0x530 fs/ext4/inline.c:62 ext4_get_max_inline_size+0x142/0x200 fs/ext4/inline.c:113 ext4_try_to_write_inline_data+0xdd/0x11e0 fs/ext4/inline.c:677 ext4_write_begin+0x23b/0x1360 fs/ext4/inode.c:1172 ext4_da_write_begin+0x4ac/0xbf0 fs/ext4/inode.c:2979 generic_perform_write+0x2cd/0x5d0 mm/filemap.c:3825 ext4_buffered_write_iter+0x49b/0x630 fs/ext4/file.c:271 ext4_file_write_iter+0x448/0x1cc0 __kernel_write+0x5ad/0xa60 fs/read_write.c:539 kernel_write+0x221/0x550 fs/read_write.c:568 p9_fd_write net/9p/trans_fd.c:431 [inline] p9_write_work+0x5b9/0xd00 net/9p/trans_fd.c:482 process_one_work+0x6db/0xc00 kernel/workqueue.c:2313 worker_thread+0xb3e/0x1340 kernel/workqueue.c:2460 kthread+0x41c/0x500 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Allocated by task 1: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] __kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:466 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook mm/slab.h:550 [inline] slab_alloc_node mm/slub.c:3236 [inline] slab_alloc mm/slub.c:3244 [inline] kmem_cache_alloc+0x189/0x2f0 mm/slub.c:3249 acpi_ps_alloc_op+0x18d/0x38d acpi_ps_create_op+0x3f4/0xc67 drivers/acpi/acpica/psobject.c:321 acpi_ps_parse_loop+0x635/0x1bd8 drivers/acpi/acpica/psloop.c:306 acpi_ps_parse_aml+0x1d8/0x955 drivers/acpi/acpica/psparse.c:475 acpi_ps_execute_method+0x5ad/0x6c4 drivers/acpi/acpica/psxface.c:190 acpi_ns_evaluate+0x637/0xa0c drivers/acpi/acpica/nseval.c:205 acpi_ut_evaluate_object+0x14d/0x479 drivers/acpi/acpica/uteval.c:60 acpi_rs_get_method_data+0xaa/0x149 drivers/acpi/acpica/rsutils.c:650 acpi_walk_resources+0x161/0x21d drivers/acpi/acpica/rsxface.c:616 acpi_pci_link_get_current+0x218/0x490 drivers/acpi/pci_link.c:256 acpi_pci_link_add+0x16f/0x3c0 drivers/acpi/pci_link.c:731 acpi_scan_attach_handler drivers/acpi/scan.c:2133 [inline] acpi_bus_attach+0x823/0xc90 drivers/acpi/scan.c:2181 acpi_bus_attach+0x32c/0xc90 drivers/acpi/scan.c:2202 acpi_bus_attach+0x32c/0xc90 drivers/acpi/scan.c:2202 acpi_bus_scan+0x10a/0x200 drivers/acpi/scan.c:2374 acpi_scan_init+0x261/0x7a6 drivers/acpi/scan.c:2549 acpi_init+0x143/0x1f6 drivers/acpi/bus.c:1346 do_one_initcall+0x1b5/0x600 init/main.c:1306 do_initcall_level+0x192/0x2f0 init/main.c:1379 do_initcalls+0x50/0x94 init/main.c:1395 do_basic_setup+0x81/0x8a init/main.c:1414 kernel_init_freeable+0x2c2/0x3f8 init/main.c:1619 kernel_init+0x1d/0x2a0 init/main.c:1510 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff888104bab058 which belongs to the cache Acpi-Parse of size 56 The buggy address is located 44 bytes inside of 56-byte region [ffff888104bab058, ffff888104bab090) The buggy address belongs to the page: page:ffffea000412eac0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888104bab478 pfn:0x104bab flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 ffffea000412e9c0 0000001300000013 ffff88810004d800 raw: ffff888104bab478 00000000802e0000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1340346636, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1ab/0x1b0 mm/page_alloc.c:2495 prep_new_page mm/page_alloc.c:2501 [inline] get_page_from_freelist+0x38b/0x400 mm/page_alloc.c:4281 __alloc_pages+0x3a8/0x7c0 mm/page_alloc.c:5548 allocate_slab+0x62/0x580 mm/slub.c:1928 new_slab mm/slub.c:1991 [inline] ___slab_alloc+0x2e2/0x6f0 mm/slub.c:3024 __slab_alloc+0x4a/0x90 mm/slub.c:3111 slab_alloc_node mm/slub.c:3202 [inline] slab_alloc mm/slub.c:3244 [inline] kmem_cache_alloc+0x205/0x2f0 mm/slub.c:3249 acpi_ps_alloc_op+0x18d/0x38d acpi_ps_create_op+0x3f4/0xc67 drivers/acpi/acpica/psobject.c:321 acpi_ps_parse_loop+0x635/0x1bd8 drivers/acpi/acpica/psloop.c:306 acpi_ps_parse_aml+0x1d8/0x955 drivers/acpi/acpica/psparse.c:475 acpi_ps_execute_method+0x5ad/0x6c4 drivers/acpi/acpica/psxface.c:190 acpi_ns_evaluate+0x637/0xa0c drivers/acpi/acpica/nseval.c:205 acpi_evaluate_object+0x58d/0xac6 drivers/acpi/acpica/nsxfeval.c:354 acpi_evaluate_integer+0x112/0x230 drivers/acpi/utils.c:260 acpi_bus_get_status_handle drivers/acpi/bus.c:83 [inline] acpi_bus_get_status+0x14e/0x250 drivers/acpi/bus.c:112 page_owner free stack trace missing Memory state around the buggy address: ffff888104baaf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888104bab000: fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb fb >ffff888104bab080: fb fb fc fc fc fc fb fb fb fb fb fb fb fc fc fc ^ ffff888104bab100: fc fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb ffff888104bab180: fb fb fb fc fc fc fc fb fb fb fb fb fb fb fc fc ================================================================== EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr EXT4-fs error (device loop0): ext4_xattr_ibody_find:2201: inode #18: comm kworker/1:1: corrupted in-inode xattr