==================================================================
BUG: KASAN: use-after-free in get_max_inline_xattr_value_size+0x387/0x530 fs/ext4/inline.c:61
Read of size 4 at addr ffff8881051c1084 by task kworker/0:1/24

CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 5.10.161-syzkaller-00019-g416c4356f372 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: events p9_write_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x81/0x3c0 mm/kasan/report.c:233
 __kasan_report mm/kasan/report.c:419 [inline]
 kasan_report+0x1a4/0x1f0 mm/kasan/report.c:436
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 get_max_inline_xattr_value_size+0x387/0x530 fs/ext4/inline.c:61
 ext4_get_max_inline_size+0x142/0x200 fs/ext4/inline.c:112
 ext4_try_to_write_inline_data+0xb1/0x570 fs/ext4/inline.c:673
 ext4_write_begin+0x243/0x16f0 fs/ext4/inode.c:1170
 ext4_da_write_begin+0x4a8/0xf10 fs/ext4/inode.c:3022
 generic_perform_write+0x309/0x5b0 mm/filemap.c:3468
 ext4_buffered_write_iter+0x47c/0x610 fs/ext4/file.c:272
 ext4_file_write_iter+0x192/0x1c70 fs/ext4/file.c:689
 __kernel_write+0x5ad/0x9d0 fs/read_write.c:550
 kernel_write+0x1e2/0x420 fs/read_write.c:579
 p9_fd_write net/9p/trans_fd.c:431 [inline]
 p9_write_work+0x5bc/0xce0 net/9p/trans_fd.c:482
 process_one_work+0x726/0xc10 kernel/workqueue.c:2296
 worker_thread+0xb27/0x1550 kernel/workqueue.c:2442
 kthread+0x349/0x3d0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299

Allocated by task 1:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:428 [inline]
 __kasan_slab_alloc+0xb2/0xe0 mm/kasan/common.c:461
 kasan_slab_alloc include/linux/kasan.h:259 [inline]
 slab_post_alloc_hook include/../mm/slab.h:583 [inline]
 slab_alloc_node mm/slub.c:2956 [inline]
 slab_alloc mm/slub.c:2964 [inline]
 kmem_cache_alloc+0x16c/0x300 mm/slub.c:2969
 acpi_ps_alloc_op+0x18d/0x38d arch/x86/include/asm/irqflags.h:35
 acpi_ps_create_op+0x3f4/0xc67 drivers/acpi/acpica/psobject.c:321
 acpi_ps_parse_loop+0x635/0x1be0 drivers/acpi/acpica/psloop.c:307
 acpi_ps_parse_aml+0x1d8/0x95d drivers/acpi/acpica/psparse.c:475
 acpi_ps_execute_method+0x5ad/0x6c4 drivers/acpi/acpica/psxface.c:190
 acpi_ns_evaluate+0x637/0xa10 drivers/acpi/acpica/nseval.c:205
 acpi_ut_evaluate_object+0x14d/0x479 drivers/acpi/acpica/uteval.c:60
 acpi_ut_execute_STA+0xa8/0x1ae drivers/acpi/acpica/uteval.c:223
 acpi_ns_get_device_callback+0x25d/0x5d1 drivers/acpi/acpica/nsxfeval.c:723
 acpi_ns_walk_namespace+0x242/0x4ad drivers/acpi/acpica/nswalk.c:231
 acpi_get_devices+0x13b/0x18e drivers/acpi/acpica/nsxfeval.c:805
 pnpacpi_init+0x84/0x11d drivers/pnp/pnpacpi/core.c:308
 do_one_initcall+0x1b5/0x610 init/main.c:1206
 do_initcall_level+0x192/0x2f0 init/main.c:1279
 do_initcalls+0x50/0x94 init/main.c:1295
 do_basic_setup+0x88/0x91 init/main.c:1315
 kernel_init_freeable+0x2ba/0x3f1 init/main.c:1519
 kernel_init+0x11/0x290 init/main.c:1406
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:299

The buggy address belongs to the object at ffff8881051c1058
 which belongs to the cache Acpi-Parse of size 56
The buggy address is located 44 bytes inside of
 56-byte region [ffff8881051c1058, ffff8881051c1090)
The buggy address belongs to the page:
page:ffffea0004147040 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881051c1e70 pfn:0x1051c1
flags: 0x8000000000000200(slab)
raw: 8000000000000200 ffffea0004146e00 0000001200000012 ffff888100066a80
raw: ffff8881051c1e70 00000000802e0000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1699670540, free_ts 0
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2386 [inline]
 prep_new_page mm/page_alloc.c:2392 [inline]
 get_page_from_freelist+0x755/0x810 mm/page_alloc.c:4073
 __alloc_pages_nodemask+0x3b6/0x890 mm/page_alloc.c:5160
 alloc_slab_page mm/slub.c:1815 [inline]
 allocate_slab+0x78/0x540 mm/slub.c:1817
 new_slab mm/slub.c:1878 [inline]
 new_slab_objects mm/slub.c:2636 [inline]
 ___slab_alloc+0x131/0x2e0 mm/slub.c:2800
 __slab_alloc+0x63/0xa0 mm/slub.c:2840
 slab_alloc_node mm/slub.c:2922 [inline]
 slab_alloc mm/slub.c:2964 [inline]
 kmem_cache_alloc+0x1ef/0x300 mm/slub.c:2969
 acpi_ps_alloc_op+0x18d/0x38d arch/x86/include/asm/irqflags.h:35
 acpi_ps_create_op+0x3f4/0xc67 drivers/acpi/acpica/psobject.c:321
 acpi_ps_parse_loop+0x635/0x1be0 drivers/acpi/acpica/psloop.c:307
 acpi_ps_parse_aml+0x1d8/0x95d drivers/acpi/acpica/psparse.c:475
 acpi_ps_execute_method+0x5ad/0x6c4 drivers/acpi/acpica/psxface.c:190
 acpi_ns_evaluate+0x637/0xa10 drivers/acpi/acpica/nseval.c:205
 acpi_ut_evaluate_object+0x14d/0x479 drivers/acpi/acpica/uteval.c:60
 acpi_ut_execute_STA+0xa8/0x1ae drivers/acpi/acpica/uteval.c:223
 acpi_ns_get_device_callback+0x25d/0x5d1 drivers/acpi/acpica/nsxfeval.c:723
 acpi_ns_walk_namespace+0x242/0x4ad drivers/acpi/acpica/nswalk.c:231
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881051c0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881051c1000: fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb fb
>ffff8881051c1080: fb fb fc fc fc fc fb fb fb fb fb fb fb fc fc fc
                   ^
 ffff8881051c1100: fc fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
 ffff8881051c1180: fb fb fb fc fc fc fc fb fb fb fb fb fb fb fc fc
==================================================================
EXT4-fs error (device loop0): ext4_xattr_ibody_find:2179: inode #18: comm kworker/0:1: corrupted in-inode xattr