==================================================================
BUG: KASAN: slab-out-of-bounds in get_max_inline_xattr_value_size+0x369/0x510 fs/ext4/inline.c:62
Read of size 4 at addr ffff88807d50ffc4 by task syz-executor.3/9509

CPU: 1 PID: 9509 Comm: syz-executor.3 Not tainted 6.3.0-rc5-syzkaller-00247-gcdc9718d5e59 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:319 [inline]
 print_report+0x163/0x540 mm/kasan/report.c:430
 kasan_report+0x176/0x1b0 mm/kasan/report.c:536
 get_max_inline_xattr_value_size+0x369/0x510 fs/ext4/inline.c:62
 ext4_update_inline_dir fs/ext4/inline.c:1109 [inline]
 ext4_try_add_inline_entry+0x34b/0xb70 fs/ext4/inline.c:1306
 ext4_add_entry+0x535/0x1010 fs/ext4/namei.c:2384
 ext4_mkdir+0x553/0xce0 fs/ext4/namei.c:3006
 vfs_mkdir+0x29d/0x450 fs/namei.c:4038
 do_mkdirat+0x264/0x520 fs/namei.c:4061
 __do_sys_mkdir fs/namei.c:4081 [inline]
 __se_sys_mkdir fs/namei.c:4079 [inline]
 __x64_sys_mkdir+0x6e/0x80 fs/namei.c:4079
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f15c428c169
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f15c50b8168 EFLAGS: 00000246 ORIG_RAX: 0000000000000053
RAX: ffffffffffffffda RBX: 00007f15c43abf80 RCX: 00007f15c428c169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
RBP: 00007f15c42e7ca1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffec1376ef R14: 00007f15c50b8300 R15: 0000000000022000
 </TASK>

Allocated by task 5066:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4f/0x70 mm/kasan/common.c:52
 __kasan_slab_alloc+0x66/0x70 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:186 [inline]
 slab_post_alloc_hook+0x68/0x3a0 mm/slab.h:769
 slab_alloc_node mm/slub.c:3452 [inline]
 slab_alloc mm/slub.c:3460 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3467 [inline]
 kmem_cache_alloc+0x11f/0x2e0 mm/slub.c:3476
 ptlock_alloc+0x20/0x70 mm/memory.c:5835
 ptlock_init include/linux/mm.h:2620 [inline]
 pgtable_pte_page_ctor include/linux/mm.h:2647 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:66 [inline]
 pte_alloc_one+0xd5/0x360 arch/x86/mm/pgtable.c:33
 __pte_alloc+0x79/0x220 mm/memory.c:421
 do_anonymous_page mm/memory.c:4034 [inline]
 handle_pte_fault mm/memory.c:4921 [inline]
 __handle_mm_fault mm/memory.c:5065 [inline]
 handle_mm_fault+0x47c9/0x51c0 mm/memory.c:5211
 do_user_addr_fault arch/x86/mm/fault.c:1407 [inline]
 handle_page_fault arch/x86/mm/fault.c:1498 [inline]
 exc_page_fault+0x5b1/0x7c0 arch/x86/mm/fault.c:1554
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570

The buggy address belongs to the object at ffff88807d50ff60
 which belongs to the cache page->ptl of size 64
The buggy address is located 36 bytes to the right of
 allocated 64-byte region [ffff88807d50ff60, ffff88807d50ffa0)

The buggy address belongs to the physical page:
page:ffffea0001f543c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d50f
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffff88801244f780 ffffea0000aa5d40 0000000000000002
raw: 0000000000000000 00000000002a002a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 4904, tgid 4904 (sed), ts 53849229593, free_ts 53841742546
 prep_new_page mm/page_alloc.c:2553 [inline]
 get_page_from_freelist+0x3246/0x33c0 mm/page_alloc.c:4326
 __alloc_pages+0x255/0x670 mm/page_alloc.c:5592
 alloc_slab_page+0x6a/0x160 mm/slub.c:1851
 allocate_slab mm/slub.c:1998 [inline]
 new_slab+0x84/0x2f0 mm/slub.c:2051
 ___slab_alloc+0xa85/0x10a0 mm/slub.c:3193
 __slab_alloc mm/slub.c:3292 [inline]
 __slab_alloc_node mm/slub.c:3345 [inline]
 slab_alloc_node mm/slub.c:3442 [inline]
 slab_alloc mm/slub.c:3460 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3467 [inline]
 kmem_cache_alloc+0x1b9/0x2e0 mm/slub.c:3476
 ptlock_alloc+0x20/0x70 mm/memory.c:5835
 ptlock_init include/linux/mm.h:2620 [inline]
 pgtable_pte_page_ctor include/linux/mm.h:2647 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:66 [inline]
 pte_alloc_one+0xd5/0x360 arch/x86/mm/pgtable.c:33
 do_fault_around mm/memory.c:4470 [inline]
 do_read_fault mm/memory.c:4501 [inline]
 do_fault mm/memory.c:4635 [inline]
 handle_pte_fault mm/memory.c:4923 [inline]
 __handle_mm_fault mm/memory.c:5065 [inline]
 handle_mm_fault+0x3253/0x51c0 mm/memory.c:5211
 do_user_addr_fault arch/x86/mm/fault.c:1407 [inline]
 handle_page_fault arch/x86/mm/fault.c:1498 [inline]
 exc_page_fault+0x5b1/0x7c0 arch/x86/mm/fault.c:1554
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1454 [inline]
 free_pcp_prepare mm/page_alloc.c:1504 [inline]
 free_unref_page_prepare+0xe2f/0xe70 mm/page_alloc.c:3388
 free_unref_page_list+0x596/0x830 mm/page_alloc.c:3529
 release_pages+0x219e/0x2470 mm/swap.c:1042
 tlb_batch_pages_flush mm/mmu_gather.c:97 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
 tlb_flush_mmu+0x100/0x210 mm/mmu_gather.c:299
 tlb_finish_mmu+0xd4/0x1f0 mm/mmu_gather.c:391
 exit_mmap+0x3ce/0x9d0 mm/mmap.c:3043
 __mmput+0x115/0x3c0 kernel/fork.c:1207
 exec_mmap+0x4eb/0x580 fs/exec.c:1034
 begin_new_exec+0x665/0xf10 fs/exec.c:1293
 load_elf_binary+0x95d/0x2820 fs/binfmt_elf.c:1001
 search_binary_handler fs/exec.c:1736 [inline]
 exec_binprm fs/exec.c:1778 [inline]
 bprm_execve+0x90e/0x1740 fs/exec.c:1853
 do_execveat_common+0x580/0x720 fs/exec.c:1960
 do_execve fs/exec.c:2034 [inline]
 __do_sys_execve fs/exec.c:2110 [inline]
 __se_sys_execve fs/exec.c:2105 [inline]
 __x64_sys_execve+0x92/0xa0 fs/exec.c:2105
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:
 ffff88807d50fe80: fc fc fc fc 00 00 00 00 00 00 00 00 fc fc fc fc
 ffff88807d50ff00: 00 00 00 00 00 00 00 00 fc fc fc fc 00 00 00 00
>ffff88807d50ff80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
                                           ^
 ffff88807d510000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88807d510080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================