Hi,
I've got the following bug report while fuzzing linux kenrel (4.16.0) on
arm64 with syzkaller.
The kernel config file and poc generated by C reproducer are attached.

Syzkaller hit 'KASAN: use-after-scope Write in mem_cgroup_uncharge' bug.

==================================================================
BUG: KASAN: use-after-scope in uncharge_gather_clear
mm/memcontrol.c:5546 [inline]
BUG: KASAN: use-after-scope in mem_cgroup_uncharge+0xcc/0xf0
mm/memcontrol.c:5667
Write of size 64 at addr ffff8000738c6cf0 by task syzkaller348646/1477

CPU: 0 PID: 1477 Comm: syzkaller348646 Not tainted 4.16.0 #2
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x0/0x350 arch/arm64/kernel/time.c:64
 show_stack+0x20/0x30 arch/arm64/kernel/traps.c:151
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x11c/0x198 lib/dump_stack.c:53
 print_address_description+0x60/0x270 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report+0x248/0x348 mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:253 [inline]
 check_memory_region+0x148/0x198 mm/kasan/kasan.c:267
 memset+0x2c/0x50 mm/kasan/kasan.c:285
 uncharge_gather_clear mm/memcontrol.c:5546 [inline]
 mem_cgroup_uncharge+0xcc/0xf0 mm/memcontrol.c:5667
 __page_cache_release+0x11c/0x640 mm/swap.c:73
 __put_compound_page+0x30/0x70 mm/swap.c:93
 release_pages+0x6b4/0x990 mm/swap.c:760
 free_pages_and_swap_cache+0x1e8/0x250 mm/swap_state.c:322
 tlb_flush_mmu_free+0x6c/0xb8 mm/memory.c:259
 tlb_flush_mmu+0x3c/0x48 mm/memory.c:268
 arch_tlb_finish_mmu+0x70/0xc0 mm/memory.c:283
 tlb_finish_mmu+0xd0/0x128 mm/memory.c:433
 unmap_region+0x248/0x2b8 mm/mmap.c:2514
 do_munmap+0x3b8/0x670 mm/mmap.c:2726
 mmap_region+0x3b8/0xa78 mm/mmap.c:1646
 do_mmap+0x448/0x6a0 mm/mmap.c:1483
 do_mmap_pgoff include/linux/mm.h:2223 [inline]
 vm_mmap_pgoff+0x17c/0x1b8 mm/util.c:355
 SYSC_mmap_pgoff mm/mmap.c:1533 [inline]
 SyS_mmap_pgoff+0x184/0x3e8 mm/mmap.c:1491
 sys_mmap+0x58/0x80 arch/arm64/kernel/sys.c:37
 el0_svc_naked+0x30/0x34

The buggy address belongs to the page:
page:ffff7e0001ce3180 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x4fffc00000000000()
raw: 4fffc00000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: 0000000000000000 ffff7e0001ce31a0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8000738c6b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8000738c6c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8000738c6c80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f1 f1 f1 f1 f8 f8
                                                             ^
 ffff8000738c6d00: f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 f8 f8 f8 f8 f8 f8
 ffff8000738c6d80: f8 f8 f8 f8 f8 f8 00 00 00 00 00 00 00 00 00 00
==================================================================