EXT4-fs error (device sda1): ext4_xattr_ibody_get:591: inode #16484: comm syz-executor3: corrupted in-inode xattr
EXT4-fs error (device sda1): ext4_xattr_ibody_get:591: inode #16484: comm syz-executor3: corrupted in-inode xattr
ISOFS: Unable to identify CD-ROM format.
==================================================================
BUG: KASAN: use-after-free in memset include/linux/string.h:337 [inline]
BUG: KASAN: use-after-free in __ext4_expand_extra_isize+0x16c/0x240 fs/ext4/inode.c:5923
Write of size 2160 at addr ffff88806d017aa0 by task syz-executor4/15393

CPU: 1 PID: 15393 Comm: syz-executor4 Not tainted 5.0.0-rc3 #36
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x123/0x190 mm/kasan/generic.c:191
 memset+0x24/0x40 mm/kasan/common.c:113
 memset include/linux/string.h:337 [inline]
 __ext4_expand_extra_isize+0x16c/0x240 fs/ext4/inode.c:5923
 ext4_try_to_expand_extra_isize fs/ext4/inode.c:5975 [inline]
 ext4_mark_inode_dirty+0x827/0xb80 fs/ext4/inode.c:6051
 ext4_ext_truncate+0x92/0x200 fs/ext4/extents.c:4527
 ext4_truncate+0xf8d/0x1610 fs/ext4/inode.c:4534
 ext4_evict_inode+0xaed/0x1ae0 fs/ext4/inode.c:289
 evict+0x49b/0x940 fs/inode.c:558
 iput_final fs/inode.c:1550 [inline]
 iput fs/inode.c:1576 [inline]
 iput+0x67e/0xae0 fs/inode.c:1562
 dentry_unlink_inode+0x43a/0x5e0 fs/dcache.c:360
 __dentry_kill+0x472/0x780 fs/dcache.c:552
 dentry_kill+0xd7/0x5e0 fs/dcache.c:671
 dput+0x654/0x790 fs/dcache.c:832
 __fput+0x51f/0xb10 fs/file_table.c:291
 ____fput+0x16/0x20 fs/file_table.c:309
 task_work_run+0x1f4/0x2b0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xad7/0x26e0 kernel/exit.c:867
 do_group_exit+0x177/0x430 kernel/exit.c:971
 get_signal+0x8b4/0x19b0 kernel/signal.c:2517
 do_signal+0x91/0x1ea0 arch/x86/kernel/signal.c:816
 exit_to_usermode_loop+0x2f7/0x3b0 arch/x86/entry/common.c:162
 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
 do_syscall_64+0x696/0x800 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x458099
Code: Bad RIP value.
RSP: 002b:00007ff9024b8cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000073bf08 RCX: 0000000000458099
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000073bf08
RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000073bf0c
R13: 00007fffd12a1dcf R14: 00007ff9024b99c0 R15: 0000000000000000

The buggy address belongs to the page:
page:ffffea0001b405c0 count:2 mapcount:0 mapping:ffff888219e02a98 index:0x464
def_blk_aops 
flags: 0x1fffc000000203a(referenced|dirty|lru|active|private)
raw: 01fffc000000203a ffffea0001b99e48 ffffea0001347588 ffff888219e02a98
raw: 0000000000000464 ffff88809e378dc8 00000002ffffffff ffff8880a92d82c0
page dumped because: kasan: bad access detected
page->mem_cgroup:ffff8880a92d82c0

Memory state around the buggy address:
 ffff88806d017f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88806d017f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88806d018000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff88806d018080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88806d018100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
EXT4-fs error (device sda1): ext4_xattr_ibody_get:591: inode #16484: comm syz-executor3: corrupted in-inode xattr
EXT4-fs error (device sda1): ext4_xattr_ibody_get:591: inode #16484: comm syz-executor3: corrupted in-inode xattr