==================================================================
BUG: KASAN: use-after-free in move_expired_inodes+0xce6/0xdf0
Write of size 8 at addr ffff8800a3a36bf8 by task kworker/u8:0/5

CPU: 0 PID: 5 Comm: kworker/u8:0 Not tainted 4.14.0-rc4 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 dump_stack+0x115/0x1da
 print_address_description+0x6a/0x270
 kasan_report+0x25e/0x340
 __asan_report_store8_noabort+0x17/0x20
 move_expired_inodes+0xce6/0xdf0
 queue_io+0x300/0x840
 wb_writeback+0x9a3/0xdb0
 wb_workfn+0x2a7/0x1310
 process_one_work+0xbc4/0x1ba0
 worker_thread+0x223/0x1830
 kthread+0x39c/0x470
 ret_from_fork+0x2a/0x40

Allocated by task 11312:
 save_stack_trace+0x16/0x20
 save_stack+0x43/0xd0
 kasan_kmalloc+0xae/0xe0
 kasan_slab_alloc+0x12/0x20
 kmem_cache_alloc+0xfe/0x2d0
 ext4_alloc_inode+0xb3/0x790
 alloc_inode+0x65/0x180
 new_inode_pseudo+0x69/0x190
 new_inode+0x1c/0x40
 __ext4_new_inode+0x4cf/0x4e30
 ext4_symlink+0x550/0xae0
 vfs_symlink+0x2c4/0x4c0
 SyS_symlink+0x134/0x200
 entry_SYSCALL_64_fastpath+0x1f/0xbe

Freed by task 2705:
 save_stack_trace+0x16/0x20
 save_stack+0x43/0xd0
 kasan_slab_free+0x72/0xc0
 kmem_cache_free+0xba/0x2e0
 ext4_i_callback+0x20/0x30
 rcu_process_callbacks+0x7ce/0x2b70
 __do_softirq+0x279/0xb48

The buggy address belongs to the object at ffff8800a3a36840
 which belongs to the cache ext4_inode_cache of size 2096
The buggy address is located 952 bytes inside of
 2096-byte region [ffff8800a3a36840, ffff8800a3a37070)
The buggy address belongs to the page:
page:ffffea00028e8c00 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x100000000008100(slab|head)
raw: 0100000000008100 0000000000000000 0000000000000000 00000001800e000e
raw: dead000000000100 dead000000000200 ffff8800b6a33e00 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8800a3a36a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8800a3a36b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8800a3a36b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                                ^
 ffff8800a3a36c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8800a3a36c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================