==================================================================
BUG: KASAN: use-after-free in add_chain fs/minix/itree_common.c:14 [inline]
BUG: KASAN: use-after-free in get_branch fs/minix/itree_common.c:52 [inline]
BUG: KASAN: use-after-free in get_block+0x110f/0x1380 fs/minix/itree_common.c:160
Read of size 2 at addr ffff8880846163c2 by task syz-executor489/7083

CPU: 1 PID: 7083 Comm: syz-executor489 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382
 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511
 kasan_report+0x33/0x50 mm/kasan/common.c:625
 add_chain fs/minix/itree_common.c:14 [inline]
 get_branch fs/minix/itree_common.c:52 [inline]
 get_block+0x110f/0x1380 fs/minix/itree_common.c:160
 minix_get_block+0xe5/0x110 fs/minix/inode.c:376
 block_read_full_page+0x2bf/0x1010 fs/buffer.c:2316
 do_read_cache_page+0x1053/0x1810 mm/filemap.c:2774
 read_mapping_page include/linux/pagemap.h:397 [inline]
 dir_get_page.isra.0+0x1d/0x60 fs/minix/dir.c:70
 minix_find_entry+0x200/0x7b0 fs/minix/dir.c:170
 minix_inode_by_name+0x6d/0x452 fs/minix/dir.c:454
 minix_lookup fs/minix/namei.c:30 [inline]
 minix_lookup+0x103/0x190 fs/minix/namei.c:22
 lookup_open+0x8d7/0x1320 fs/namei.c:3060
 open_last_lookups fs/namei.c:3155 [inline]
 path_openat+0x93c/0x27f0 fs/namei.c:3343
 do_filp_open+0x192/0x260 fs/namei.c:3373
 do_sys_openat2+0x585/0x7d0 fs/open.c:1148
 do_sys_open+0xc3/0x140 fs/open.c:1164
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3
RIP: 0033:0x445ef9
Code: ed cb fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb cb fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdea5c53d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000445ef9
RDX: 0000000000000000 RSI: 0000000000020040 RDI: 0000000020000040
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000402fd0
R10: 00007ffdea5c52b0 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000402fd0 R14: 0000000000000000 R15: 0000000000000000

The buggy address belongs to the page:
page:ffffea0002118580 refcount:2 mapcount:0 mapping:000000009baa2f6d index:0x2f8ec
minix_aops name:"/"
flags: 0xfffe0000002016(referenced|uptodate|lru|private)
raw: 00fffe0000002016 ffffea00021191c8 ffffea00021185c8 ffff888086345c28
raw: 000000000002f8ec ffff888086b94698 00000002ffffffff ffff8880a9546000
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8880a9546000

Memory state around the buggy address:
 ffff888084616280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888084616300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888084616380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                           ^
 ffff888084616400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888084616480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================