==================================================================
BUG: KASAN: slab-out-of-bounds in _copy_to_iter+0xd18/0x1140 lib/iov_iter.c:527
Write of size 12 at addr ffff8880239fd487 by task kworker/0:4/3790

CPU: 0 PID: 3790 Comm: kworker/0:4 Not tainted 6.1.0-rc6-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Workqueue: events p9_read_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x15e/0x461 mm/kasan/report.c:395
 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x141/0x190 mm/kasan/generic.c:189
 memcpy+0x3d/0x60 mm/kasan/shadow.c:66
 _copy_to_iter+0xd18/0x1140 lib/iov_iter.c:527
 copy_page_to_iter+0xe0/0xa20 lib/iov_iter.c:725
 pipe_read+0x50e/0x1110 fs/pipe.c:307
 __kernel_read+0x2ca/0x7c0 fs/read_write.c:428
 kernel_read+0xc3/0x1c0 fs/read_write.c:446
 p9_fd_read net/9p/trans_fd.c:266 [inline]
 p9_read_work+0x2b0/0x1040 net/9p/trans_fd.c:301
 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
 worker_thread+0x669/0x1090 kernel/workqueue.c:2436
 kthread+0x2e8/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Allocated by task 3827:
 kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:371 [inline]
 ____kasan_kmalloc mm/kasan/common.c:330 [inline]
 __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:955 [inline]
 __kmalloc+0x5a/0xd0 mm/slab_common.c:968
 kmalloc include/linux/slab.h:558 [inline]
 p9_fcall_init+0x97/0x210 net/9p/client.c:228
 p9_tag_alloc+0x208/0x840 net/9p/client.c:293
 p9_client_prepare_req+0x177/0x590 net/9p/client.c:631
 p9_client_rpc+0x1a1/0xd70 net/9p/client.c:678
 p9_client_walk+0x1a0/0x540 net/9p/client.c:1152
 clone_fid fs/9p/fid.h:21 [inline]
 v9fs_fid_xattr_set+0xe4/0x2b0 fs/9p/xattr.c:118
 v9fs_xattr_set fs/9p/xattr.c:100 [inline]
 v9fs_xattr_handler_set+0x6f/0x120 fs/9p/xattr.c:159
 __vfs_setxattr+0x119/0x180 fs/xattr.c:182
 __vfs_setxattr_noperm+0x129/0x5f0 fs/xattr.c:216
 __vfs_setxattr_locked+0x1d3/0x260 fs/xattr.c:277
 vfs_setxattr+0x143/0x340 fs/xattr.c:309
 setxattr+0x146/0x160 fs/xattr.c:617
 path_setxattr+0x197/0x1c0 fs/xattr.c:636
 __do_sys_setxattr fs/xattr.c:652 [inline]
 __se_sys_setxattr fs/xattr.c:648 [inline]
 __x64_sys_setxattr+0xc4/0x160 fs/xattr.c:648
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff8880239fd480
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 7 bytes inside of
 32-byte region [ffff8880239fd480, ffff8880239fd4a0)

The buggy address belongs to the physical page:
page:ffffea00008e7f40 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880239fdfc1 pfn:0x239fd
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff888012041240 ffff888012041240 ffff888012040100
raw: ffff8880239fdfc1 ffff8880239fd000 000000010000003c 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x3420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 3748, tgid 3748 (syz-executor.3), ts 284995703075, free_ts 284995553269
 prep_new_page mm/page_alloc.c:2539 [inline]
 get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4288
 __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5555
 __alloc_pages_node include/linux/gfp.h:223 [inline]
 kmem_getpages mm/slab.c:1363 [inline]
 cache_grow_begin+0x75/0x360 mm/slab.c:2570
 cache_alloc_refill+0x27f/0x380 mm/slab.c:2943
 ____cache_alloc mm/slab.c:3019 [inline]
 ____cache_alloc mm/slab.c:3002 [inline]
 __do_cache_alloc mm/slab.c:3202 [inline]
 slab_alloc_node mm/slab.c:3250 [inline]
 __kmem_cache_alloc_node+0x44a/0x510 mm/slab.c:3549
 kmalloc_trace+0x26/0x60 mm/slab_common.c:1045
 kmalloc include/linux/slab.h:553 [inline]
 kzalloc include/linux/slab.h:689 [inline]
 ref_tracker_alloc+0x150/0x550 lib/ref_tracker.c:85
 netns_tracker_alloc include/net/net_namespace.h:327 [inline]
 get_net_track include/net/net_namespace.h:343 [inline]
 sk_alloc+0x202/0x780 net/core/sock.c:2095
 inet_create net/ipv4/af_inet.c:319 [inline]
 inet_create+0x399/0xea0 net/ipv4/af_inet.c:245
 __sock_create+0x359/0x790 net/socket.c:1515
 sock_create net/socket.c:1566 [inline]
 __sys_socket_create net/socket.c:1603 [inline]
 __sys_socket_create net/socket.c:1588 [inline]
 __sys_socket+0x133/0x250 net/socket.c:1636
 __do_sys_socket net/socket.c:1649 [inline]
 __se_sys_socket net/socket.c:1647 [inline]
 __x64_sys_socket+0x73/0xb0 net/socket.c:1647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1459 [inline]
 free_pcp_prepare+0x65c/0xd90 mm/page_alloc.c:1509
 free_unref_page_prepare mm/page_alloc.c:3387 [inline]
 free_unref_page+0x1d/0x4d0 mm/page_alloc.c:3483
 __vunmap+0x85d/0xd30 mm/vmalloc.c:2713
 __vfree+0x3c/0xd0 mm/vmalloc.c:2761
 vfree+0x5e/0x90 mm/vmalloc.c:2792
 copy_entries_to_user net/ipv4/netfilter/arp_tables.c:713 [inline]
 get_entries net/ipv4/netfilter/arp_tables.c:867 [inline]
 do_arpt_get_ctl+0x7b1/0x8f0 net/ipv4/netfilter/arp_tables.c:1453
 nf_getsockopt+0x76/0xd0 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0x189/0x1e0 net/ipv4/ip_sockglue.c:1796
 tcp_getsockopt+0x99/0x100 net/ipv4/tcp.c:4402
 __sys_getsockopt+0x21a/0x6a0 net/socket.c:2296
 __do_sys_getsockopt net/socket.c:2311 [inline]
 __se_sys_getsockopt net/socket.c:2308 [inline]
 __x64_sys_getsockopt+0xbe/0x160 net/socket.c:2308
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:
 ffff8880239fd380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880239fd400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880239fd480: 00 03 fc fc fc fc fc fc 00 00 01 fc fc fc fc fc
                      ^
 ffff8880239fd500: fa fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc
 ffff8880239fd580: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================