KASAN: use-after-free Read in hci_cmd

KASAN: use-after-free Read in hci_cmd_timeout
Status: upstream: reported syz repro on 2019/09/06 20:31
Reported-by: syzbot+188c65dac35116b39205@syzkaller.appspotmail.com
First crash: 69d, last: 69d

similar bugs (2):
Kernel	Title	Repro	Bisected	Count	Last	Reported	Patched	Status
linux-4.19	KASAN: use-after-free Read in hci_cmd_timeout			1	75d	75d	0/1	upstream: reported on 2019/09/01 02:37
upstream	KASAN: use-after-free Read in hci_cmd_timeout	C	cause	7	62d	192d	0/14	upstream: reported C repro on 2019/05/07 09:10

Sample crash report:

Bluetooth: hci4 command 0xfc11 tx timeout
Bluetooth: hci4: Entering manufacturer mode failed (-110)
Bluetooth: hci5: Entering manufacturer mode failed (-110)
Bluetooth: hci1: Entering manufacturer mode failed (-110)
==================================================================
BUG: KASAN: use-after-free in hci_cmd_timeout+0x1b4/0x1c0 net/bluetooth/hci_core.c:2524
Read of size 8 at addr ffff888093045c58 by task kworker/1:0/18

CPU: 1 PID: 18 Comm: kworker/1:0 Not tainted 4.14.142 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events hci_cmd_timeout
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x138/0x197 lib/dump_stack.c:53
 print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0xa9/0x2af mm/kasan/report.c:393
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
 hci_cmd_timeout+0x1b4/0x1c0 net/bluetooth/hci_core.c:2524
 process_one_work+0x863/0x1600 kernel/workqueue.c:2114
kobject: 'rfkill119' (ffff888098b16c68): kobject_cleanup, parent           (null)
 worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
 kthread+0x319/0x430 kernel/kthread.c:232
kobject: 'rfkill119' (ffff888098b16c68): calling ktype release
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Allocated by task 6904:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x45/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc mm/kasan/kasan.c:551 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:489
 kmem_cache_alloc+0x12e/0x780 mm/slab.c:3552
 skb_clone+0x129/0x320 net/core/skbuff.c:1282
 hci_cmd_work+0xc8/0x230 net/bluetooth/hci_core.c:4273
 process_one_work+0x863/0x1600 kernel/workqueue.c:2114
 worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
 kthread+0x319/0x430 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Freed by task 6879:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
 save_stack+0x45/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
kobject: 'rfkill119': free name
 __cache_free mm/slab.c:3496 [inline]
 kmem_cache_free+0x83/0x2b0 mm/slab.c:3758
 kfree_skbmem net/core/skbuff.c:586 [inline]
 kfree_skbmem+0xac/0x120 net/core/skbuff.c:580
 __kfree_skb net/core/skbuff.c:646 [inline]
 kfree_skb+0xbd/0x340 net/core/skbuff.c:663
 hci_dev_do_open+0x9db/0xf80 net/bluetooth/hci_core.c:1469
 hci_power_on+0x8d/0x3d0 net/bluetooth/hci_core.c:2080
 process_one_work+0x863/0x1600 kernel/workqueue.c:2114
kobject: 'hci5' (ffff8880a0b29da8): kobject_uevent_env
 worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
 kthread+0x319/0x430 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

The buggy address belongs to the object at ffff888093045b80
 which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 216 bytes inside of
 232-byte region [ffff888093045b80, ffff888093045c68)
The buggy address belongs to the page:
kobject: 'hci5' (ffff8880a0b29da8): fill_kobj_path: path = '/devices/virtual/bluetooth/hci5'
page:ffffea00024c1140 count:1 mapcount:0 mapping:ffff888093045040 index:0x0
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffff888093045040 0000000000000000 000000010000000c
raw: ffffea000252e1a0 ffffea000271cca0 ffff88821b7203c0 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888093045b00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
 ffff888093045b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888093045c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
                                                    ^
 ffff888093045c80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff888093045d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci2-linux-4-14	2019/09/06 19:30	linux-4.14.y	414510bc	acb5b744	.config	log	report	syz		davem@davemloft.net, gustavo@padovan.org, johan.hedberg@gmail.com, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org