==================================================================
BUG: KASAN: use-after-free in memset include/linux/string.h:332 [inline]
BUG: KASAN: use-after-free in __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5832
Write of size 1999304825 at addr ffff8881cd4676a0 by task syz-executor.0/11489

CPU: 1 PID: 11489 Comm: syz-executor.0 Not tainted 4.14.155-syzkaller #0
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xe5/0x154 lib/dump_stack.c:58
 print_address_description+0x60/0x226 mm/kasan/report.c:187
 __kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316
 memset+0x20/0x40 mm/kasan/common.c:113
 memset include/linux/string.h:332 [inline]
 __ext4_expand_extra_isize.isra.0+0x10b/0x1c0 fs/ext4/inode.c:5832
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5884 [inline]
 ext4_mark_inode_dirty+0x471/0x7f0 fs/ext4/inode.c:5960
 ext4_dirty_inode+0x6c/0x90 fs/ext4/inode.c:5994
 __mark_inode_dirty+0x69c/0x1080 fs/fs-writeback.c:2144
 generic_update_time+0x1b0/0x270 fs/inode.c:1650
 update_time fs/inode.c:1666 [inline]
 file_update_time+0x269/0x390 fs/inode.c:1882
 ext4_page_mkwrite+0x1d9/0x1030 fs/ext4/inode.c:6145
 do_page_mkwrite+0xd9/0x2f0 mm/memory.c:2383
 do_shared_fault mm/memory.c:3698 [inline]
 do_fault mm/memory.c:3763 [inline]
 handle_pte_fault mm/memory.c:3989 [inline]
 __handle_mm_fault+0x1054/0x2700 mm/memory.c:4113
 handle_mm_fault+0x2f1/0x6da mm/memory.c:4150
 __do_page_fault+0x477/0xbb0 arch/x86/mm/fault.c:1420
BUG: unable to handle kernel paging request at 0000000001f4073e
IP: wait_consider_task+0xb2/0x3150 kernel/exit.c:1352
PGD 169e28067 
P4D 169e28067 
PUD 169e2a067 
 page_fault+0x42/0x50 arch/x86/entry/entry_64.S:1122
PMD 0 
RIP: 80000000:0x7faed6e2e008
RSP: 2b5e7fe7:000000000000010f EFLAGS: 0075bfa8
Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI

Modules linked in:
The buggy address belongs to the page:
page:ffffea00073519c0 count:2 mapcount:0 mapping:ffff8881d9ab8950 index:0x428
CPU: 0 PID: 1851 Comm: syz-executor.1 Not tainted 4.14.155-syzkaller #0
task: 0000000068165f64 task.stack: 00000000a689b0c3
flags: 0x400000000000203a(referenced|dirty|lru|active|private)
RIP: 0010:wait_consider_task+0xb2/0x3150 kernel/exit.c:1352
raw: 400000000000203a ffff8881d9ab8950 0000000000000428 00000002ffffffff
RSP: 0018:ffff88819fdd7ad0 EFLAGS: 00010246
raw: ffffea00073518a0 ffffea00087db5a0 ffff8881c4160540 ffff8881da81aa80
page dumped because: kasan: bad access detected
RAX: 0000000000000007 RBX: 0000000000000000 RCX: ffffffffffffff6c
page->mem_cgroup:ffff8881da81aa80
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88819fdd7cd8

RBP: dffffc0000000000 R08: 00000000000043a2 R09: fffffbfff1e81219
Memory state around the buggy address:
R10: fffffbfff1e81218 R11: ffffffff8f4090c3 R12: ffff88819fdd7cd8
 ffff8881cd64ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
R13: fffffffffffffae8 R14: ffff88819fdd7cd8 R15: fffffffffffffae8
 ffff8881cd64ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
FS:  0000000002315940(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000
>ffff8881cd64f000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
                   ^
CR2: ffffffffffffff6c CR3: 000000019fe14001 CR4: 00000000001606b0
 ffff8881cd64f080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 ffff8881cd64f100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
==================================================================
Call Trace:
EXT4-fs: 4 callbacks suppressed
EXT4-fs (sda1): Remounting file system with no journal so ignoring journalled data option
EXT4-fs (sda1): required extra inode space not available
 do_wait_thread kernel/exit.c:1461 [inline]
 do_wait+0x43a/0x950 kernel/exit.c:1532
 kernel_wait4+0x116/0x210 kernel/exit.c:1675
 SYSC_wait4 kernel/exit.c:1687 [inline]
 SyS_wait4+0x130/0x140 kernel/exit.c:1683
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x41447a
RSP: 002b:00007fffe7f4c408 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 00000000000afce9 RCX: 000000000041447a
RDX: 0000000040000001 RSI: 00007fffe7f4c440 RDI: ffffffffffffffff
RBP: 0000000000000a60 R08: 0000000000000001 R09: 0000000002315940
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000f
R13: 00007fffe7f4c440 R14: 00000000000afc88 R15: 00007fffe7f4c450
Code: 8d 8f 84 04 00 00 48 89 c8 48 89 4c 24 08 48 c1 e8 03 0f b6 14 28 48 89 c8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 23 15 00 00 <41> 8b af 84 04 00 00 83 fd 10 0f 84 a5 00 00 00 e8 c9 d7 22 00 
RIP: wait_consider_task+0xb2/0x3150 kernel/exit.c:1352 RSP: ffff88819fdd7ad0
CR2: ffffffffffffff6c
---[ end trace 4a9206bf99a40495 ]---
BUG: unable to handle kernel paging request