KASAN: use-after-free Read in hci_get_auth

KASAN: use-after-free Read in hci_get_auth_info
Status: upstream: reported syz repro on 2020/08/09 04:54
Reported-by: syzbot+6aae86371d7bfc48f52a@syzkaller.appspotmail.com
First crash: 79d, last: 18d

similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: use-after-free Read in hci_get_auth_info	syz	error	error	1	80d	80d	0/17	upstream: reported syz repro on 2020/08/08 06:56

Sample crash report:

IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
Bluetooth: hci3 command 0x0419 tx timeout
Bluetooth: hci0 command 0x0409 tx timeout
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:172 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:840 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0x1245/0x1310 kernel/locking/mutex.c:893
Read of size 8 at addr ffff888091f94dd8 by task syz-executor.0/32135

CPU: 0 PID: 32135 Comm: syz-executor.0 Not tainted 4.14.193-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x1b2/0x283 lib/dump_stack.c:58
 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
 kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
 kasan_report mm/kasan/report.c:409 [inline]
 __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
 __mutex_waiter_is_first kernel/locking/mutex.c:172 [inline]
 __mutex_lock_common kernel/locking/mutex.c:840 [inline]
 __mutex_lock+0x1245/0x1310 kernel/locking/mutex.c:893
 hci_get_auth_info+0x90/0x3b0 net/bluetooth/hci_conn.c:1508
 hci_sock_bound_ioctl net/bluetooth/hci_sock.c:945 [inline]
 hci_sock_ioctl+0x2c9/0x650 net/bluetooth/hci_sock.c:1048
 sock_do_ioctl net/socket.c:974 [inline]
 sock_ioctl+0x2cc/0x4c0 net/socket.c:1071
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45ce69
RSP: 002b:00007f4dacf01c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000001d340 RCX: 000000000045ce69
RDX: 0000000020000000 RSI: 00000000800448d7 RDI: 0000000000000005
RBP: 000000000118c000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bfcc
R13: 00007ffd5fd8a75f R14: 00007f4dacf029c0 R15: 000000000118bfcc

Allocated by task 18874:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
 kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
 kmalloc include/linux/slab.h:488 [inline]
 kzalloc include/linux/slab.h:661 [inline]
 hci_alloc_dev+0x3e/0x1c60 net/bluetooth/hci_core.c:2978
 __vhci_create_device+0xe9/0x540 drivers/bluetooth/hci_vhci.c:114
 vhci_create_device drivers/bluetooth/hci_vhci.c:163 [inline]
 vhci_open_timeout+0x35/0x50 drivers/bluetooth/hci_vhci.c:319
 process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
 kthread+0x30d/0x420 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Freed by task 31078:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
 __cache_free mm/slab.c:3496 [inline]
 kfree+0xc9/0x250 mm/slab.c:3815
 bt_host_release+0x15/0x20 net/bluetooth/hci_sysfs.c:86
 device_release+0xf0/0x1a0 drivers/base/core.c:831
 kobject_cleanup lib/kobject.c:646 [inline]
 kobject_release lib/kobject.c:675 [inline]
 kref_put include/linux/kref.h:70 [inline]
 kobject_put+0x1f3/0x2d0 lib/kobject.c:692
 put_device+0x1c/0x30 drivers/base/core.c:2014
 vhci_release+0x78/0xe0 drivers/bluetooth/hci_vhci.c:355
 __fput+0x25f/0x7a0 fs/file_table.c:210
 task_work_run+0x11f/0x190 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xa08/0x27f0 kernel/exit.c:865
 do_group_exit+0x100/0x2e0 kernel/exit.c:962
 SYSC_exit_group kernel/exit.c:973 [inline]
 SyS_exit_group+0x19/0x20 kernel/exit.c:971
 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x46/0xbb

The buggy address belongs to the object at ffff888091f94d80
 which belongs to the cache kmalloc-8192 of size 8192
The buggy address is located 88 bytes inside of
 8192-byte region [ffff888091f94d80, ffff888091f96d80)
The buggy address belongs to the page:
page:ffffea000247e500 count:1 mapcount:0 mapping:ffff888091f94d80 index:0x0 compound_mapcount: 0
flags: 0xfffe0000008100(slab|head)
raw: 00fffe0000008100 ffff888091f94d80 0000000000000000 0000000100000001
raw: ffffea00024f7d20 ffffea000293d220 ffff88812fe51080 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888091f94c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888091f94d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888091f94d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                    ^
 ffff888091f94e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888091f94e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Fix bisection attempts:
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info
ci2-linux-4-14	2020/10/08 08:02	linux-4.14.y	bae31eef	f721e4a0	.config	log	report	syz
ci2-linux-4-14	2020/09/08 05:36	linux-4.14.y	2f166cdc	f721e4a0	.config	log	report	syz

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Maintainers
ci2-linux-4-14	2020/08/09 04:54	linux-4.14.y	14b58326	f721e4a0	.config	log	report	syz			davem@davemloft.net, gustavo@padovan.org, johan.hedberg@gmail.com, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, marcel@holtmann.org, netdev@vger.kernel.org