EXT4-fs error (device sda1): ext4_xattr_set_entry:1602: inode #16501: comm syz-executor4: corrupted xattr entries
EXT4-fs error (device sda1): ext4_xattr_set_entry:1602: inode #16573: comm syz-executor4: corrupted xattr entries
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x3768/0x3d20 fs/ext4/xattr.c:1599
Read of size 4 at addr ffff8880566e6084 by task syz-executor2/18879

CPU: 1 PID: 18879 Comm: syz-executor2 Not tainted 4.20.0+ #10
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:134
overlayfs: unrecognized mount option "upperdir¸™]ile0" or missing value
 ext4_xattr_set_entry+0x3768/0x3d20 fs/ext4/xattr.c:1599
 ext4_xattr_ibody_set+0x80/0x2b0 fs/ext4/xattr.c:2235
 ext4_xattr_set_handle+0x983/0x17d0 fs/ext4/xattr.c:2391
 ext4_xattr_set+0x235/0x420 fs/ext4/xattr.c:2503
 ext4_xattr_trusted_set+0x36/0x40 fs/ext4/xattr_trusted.c:37
 __vfs_setxattr+0x121/0x190 fs/xattr.c:149
 __vfs_setxattr_noperm+0x11c/0x410 fs/xattr.c:180
 vfs_setxattr+0xda/0x100 fs/xattr.c:223
 ovl_do_setxattr fs/overlayfs/overlayfs.h:154 [inline]
 ovl_make_workdir fs/overlayfs/super.c:1076 [inline]
 ovl_get_workdir fs/overlayfs/super.c:1139 [inline]
 ovl_fill_super+0xf04/0x41b5 fs/overlayfs/super.c:1470
 mount_nodev+0x68/0x110 fs/super.c:1204
 ovl_mount+0x2d/0x40 fs/overlayfs/super.c:1568
 mount_fs+0xae/0x331 fs/super.c:1261
 vfs_kern_mount.part.0+0xdb/0x570 fs/namespace.c:961
 vfs_kern_mount fs/namespace.c:951 [inline]
 do_new_mount fs/namespace.c:2469 [inline]
 do_mount+0x576/0x3110 fs/namespace.c:2801
 ksys_mount+0xdb/0x150 fs/namespace.c:3017
 __do_sys_mount fs/namespace.c:3031 [inline]
 __se_sys_mount fs/namespace.c:3028 [inline]
 __x64_sys_mount+0xbe/0x150 fs/namespace.c:3028
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457ec9
Code: 6d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 3b b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f17bc5abc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457ec9
RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 00000000004000e0
RBP: 000000000073bfa0 R08: 0000000020000100 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f17bc5ac6d4
R13: 00000000004c3c40 R14: 00000000004d6ac0 R15: 00000000ffffffff

The buggy address belongs to the page:
page:ffffea000159b980 count:0 mapcount:-128 mapping:0000000000000000 index:0x1
flags: 0x1fffc0000000000()
raw: 01fffc0000000000 ffffea0001bd9908 ffffea0001d70208 0000000000000000
raw: 0000000000000001 0000000000000001 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880566e5f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880566e6000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8880566e6080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff8880566e6100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8880566e6180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================