==================================================================
BUG: KASAN: use-after-free in memset include/linux/string.h:329 [inline]
BUG: KASAN: use-after-free in __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5787
EXT4-fs (sda1): re-mounted. Opts: debug_want_extra_isize=0x0000000020000000,
Write of size 536870912 at addr ffff8881d2c32580 by task syz-executor5/1857

CPU: 1 PID: 1857 Comm: syz-executor5 Not tainted 4.14.94+ #12
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 print_address_description+0x60/0x226 mm/kasan/report.c:252
kasan: CONFIG_KASAN_INLINE enabled
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0x88/0x2a5 mm/kasan/report.c:393

The buggy address belongs to the page:
kasan: GPF could be caused by NULL-ptr deref or user memory access
page:ffffea00074b0c80 count:2 mapcount:0 mapping:ffff8881d9ea8950 index:0x428
general protection fault: 0000 [#1] PREEMPT SMP KASAN NOPTI
Modules linked in:
flags: 0x4000000000001074(referenced|dirty|lru|active|private)
raw: 4000000000001074 ffff8881d9ea8950 0000000000000428 00000002ffffffff
CPU: 0 PID: 1632 Comm: rs:main Q:Reg Not tainted 4.14.94+ #12
raw: ffffea0007560560 ffffea00075275a0 ffff8881ca774690 ffff8881da81aa80
task: ffff8881d52f2f00 task.stack: ffff8881d45a0000
page dumped because: kasan: bad access detected
RIP: 0010:__rb_insert lib/rbtree.c:131 [inline]
RIP: 0010:rb_insert_color_cached+0x97/0x9d0 lib/rbtree.c:469
page->mem_cgroup:ffff8881da81aa80
RSP: 0018:ffff8881d45a74e0 EFLAGS: 00010002

Memory state around the buggy address:
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 1ffff1103aa5e5f2
 ffff8881d2ffff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RDX: 0000000000000000 RSI: ffff8881dba2a2c8 RDI: ffff8881d52f2f90
 ffff8881d2ffff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RBP: ffff8881d12d0090 R08: 0000000000000001 R09: ffff8881dba2a2a0
>ffff8881d3000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
R10: ffff8881d52f37f8 R11: 0000000000000001 R12: ffff8881d52f2f90
                   ^
R13: dffffc0000000000 R14: 0000000000000008 R15: ffff8881dba2a2a0
 ffff8881d3000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
FS:  00007f187c58b700(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000
 ffff8881d3000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
==================================================================
CR2: 00007fff238f7cd8 CR3: 00000001d6836006 CR4: 00000000001606b0
kasan: CONFIG_KASAN_INLINE enabled
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
kasan: GPF could be caused by NULL-ptr deref or user memory access
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
 put_prev_entity+0x1e9/0x18e0 kernel/sched/fair.c:4251
 pick_next_task_fair+0x18a3/0x2860 kernel/sched/fair.c:8338
 pick_next_task kernel/sched/core.c:3286 [inline]
 __schedule+0x500/0x1f30 kernel/sched/core.c:3412
 preempt_schedule_irq+0x5e/0xa0 kernel/sched/core.c:3673
 retint_kernel+0x1b/0x2d
RIP: 0010:memset_erms+0x9/0x10 arch/x86/lib/memset_64.S:66
RSP: 0018:ffff8881d45a7878 EFLAGS: 00010286 ORIG_RAX: ffffffffffffff10
RAX: 0000000000000000 RBX: 0000000000000020 RCX: 000000001ddc71e0
RDX: 000000001fffffe0 RSI: 0000000000000000 RDI: ffff8881d28570a0
RBP: ffff8881ca75ba98 R08: ffffed103a101008 R09: ffff8881d061e2a0
R10: ffffed103e0c3c4f R11: ffff8881f061e27f R12: 0000000000000000
R13: 0000000020000000 R14: ffff8881d061e2a0 R15: 0000000000000001
 memset include/linux/string.h:329 [inline]
 __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5787
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5839 [inline]
 ext4_mark_inode_dirty+0x460/0x7e0 fs/ext4/inode.c:5915
 ext4_da_write_end+0x666/0xc00 fs/ext4/inode.c:3185
 generic_perform_write+0x26d/0x450 mm/filemap.c:3048
 __generic_file_write_iter+0x32e/0x550 mm/filemap.c:3162
 ext4_file_write_iter+0x4fb/0xe10 fs/ext4/file.c:264
 call_write_iter include/linux/fs.h:1784 [inline]
 new_sync_write fs/read_write.c:471 [inline]
 __vfs_write+0x401/0x5a0 fs/read_write.c:484
 vfs_write+0x17f/0x4d0 fs/read_write.c:546
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0xc0/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
Code: 00 48 89 e8 48 c1 e8 03 42 80 3c 28 00 0f 85 30 06 00 00 48 8b 5d 00 f6 c3 01 0f 85 80 01 00 00 4c 8d 73 08 4c 89 f0 48 c1 e8 03 <42> 80 3c 28 00 0f 85 f8 05 00 00 4c 8b 7b 08 49 39 ef 0f 84 6c 
RIP: __rb_insert lib/rbtree.c:131 [inline] RSP: ffff8881d45a74e0
RIP: rb_insert_color_cached+0x97/0x9d0 lib/rbtree.c:469 RSP: ffff8881d45a74e0
---[ end trace e372ebde2b6a2f42 ]---
general protection fault: 0000 [#2] PREEMPT SMP KASAN NOPTI
Modules linked in: