[v5.15] KASAN: slab-out-of-bounds Read in hci_le_meta_evt

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: bbf9f29bac04 Linux 5.15.101
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=14bb3adcc80000
kernel config: https://syzkaller.appspot.com/x/.config?x=353a11a1dbfe7820
dashboard link: https://syzkaller.appspot.com/bug?extid=57b8721a7d4d06e7ffa8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/741458b6f24d/disk-bbf9f29b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/46cdc0f15ae5/vmlinux-bbf9f29b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/15bf795c52fa/Image-bbf9f29b.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+57b872...@syzkaller.appspotmail.com

Bluetooth: hci2: Unknown advertising packet type: 0x6678
==================================================================
BUG: KASAN: slab-out-of-bounds in hci_le_ext_adv_report_evt net/bluetooth/hci_event.c:5895 [inline]
BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xe70/0x2f38 net/bluetooth/hci_event.c:6165
Read of size 1 at addr ffff0000ce1eac0a by task kworker/u5:0/144

CPU: 1 PID: 144 Comm: kworker/u5:0 Not tainted 5.15.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
Workqueue: hci2 hci_rx_work
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load1_noabort+0x44/0x50 mm/kasan/report_generic.c:306
hci_le_ext_adv_report_evt net/bluetooth/hci_event.c:5895 [inline]
hci_le_meta_evt+0xe70/0x2f38 net/bluetooth/hci_event.c:6165
hci_event_packet+0xe04/0x1258 net/bluetooth/hci_event.c:6482
hci_rx_work+0x1d0/0x6d0 net/bluetooth/hci_core.c:5153
process_one_work+0x84c/0x14b8 kernel/workqueue.c:2306
worker_thread+0x910/0x1034 kernel/workqueue.c:2453
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 <unknown>:870

Allocated by task 1215:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
__kmalloc_node_track_caller+0x20c/0x384 mm/slub.c:4963
kmalloc_reserve+0xe8/0x270 net/core/skbuff.c:356
__alloc_skb+0x1a4/0x584 net/core/skbuff.c:427
alloc_skb include/linux/skbuff.h:1166 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:391 [inline]
vhci_get_user drivers/bluetooth/hci_vhci.c:167 [inline]
vhci_write+0xb8/0x3b8 drivers/bluetooth/hci_vhci.c:287
call_write_iter include/linux/fs.h:2101 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x87c/0xb3c fs/read_write.c:594
ksys_write+0x15c/0x26c fs/read_write.c:647
__do_sys_write fs/read_write.c:659 [inline]
__se_sys_write fs/read_write.c:656 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:656
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
el0t_64_sync+0x1a0/0x1a4 <unknown>:584

Last potentially related work creation:
kasan_save_stack+0x38/0x68 mm/kasan/common.c:38
kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348
kvfree_call_rcu+0xb8/0x684 kernel/rcu/tree.c:3559
neigh_destroy+0x474/0x6f4 net/core/neighbour.c:883
neigh_release include/net/neighbour.h:426 [inline]
neigh_cleanup_and_release+0x224/0x530 net/core/neighbour.c:103
neigh_periodic_work+0x488/0xc48 net/core/neighbour.c:967
process_one_work+0x84c/0x14b8 kernel/workqueue.c:2306
worker_thread+0x910/0x1034 kernel/workqueue.c:2453
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 <unknown>:870

The buggy address belongs to the object at ffff0000ce1ea800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 10 bytes to the right of
1024-byte region [ffff0000ce1ea800, ffff0000ce1eac00)
The buggy address belongs to the page:
page:000000005308ec06 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e1e8
head:000000005308ec06 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 0000000100000001 ffff0000c0002780
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff0000ce1eab00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000ce1eab80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000ce1eac00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff0000ce1eac80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000ce1ead00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Bluetooth: hci1: Unknown advertising packet type: 0x7830
Bluetooth: hci5: Unknown advertising packet type: 0x6678
Bluetooth: hci2: hardware error 0x00


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: bbf9f29bac04 Linux 5.15.101
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=168b811ac80000

kernel config: https://syzkaller.appspot.com/x/.config?x=353a11a1dbfe7820
dashboard link: https://syzkaller.appspot.com/bug?extid=57b8721a7d4d06e7ffa8
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=136e091ac80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11abb65cc80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/741458b6f24d/disk-bbf9f29b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/46cdc0f15ae5/vmlinux-bbf9f29b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/15bf795c52fa/Image-bbf9f29b.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+57b872...@syzkaller.appspotmail.com

Bluetooth: hci0: Unknown advertising packet type: 0x6678

==================================================================
BUG: KASAN: slab-out-of-bounds in hci_le_ext_adv_report_evt net/bluetooth/hci_event.c:5895 [inline]
BUG: KASAN: slab-out-of-bounds in hci_le_meta_evt+0xe70/0x2f38 net/bluetooth/hci_event.c:6165

Read of size 1 at addr ffff0000ceba740a by task kworker/u5:1/4055

CPU: 0 PID: 4055 Comm: kworker/u5:1 Not tainted 5.15.101-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023

Workqueue: hci0 hci_rx_work

Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load1_noabort+0x44/0x50 mm/kasan/report_generic.c:306
hci_le_ext_adv_report_evt net/bluetooth/hci_event.c:5895 [inline]
hci_le_meta_evt+0xe70/0x2f38 net/bluetooth/hci_event.c:6165
hci_event_packet+0xe04/0x1258 net/bluetooth/hci_event.c:6482
hci_rx_work+0x1d0/0x6d0 net/bluetooth/hci_core.c:5153
process_one_work+0x84c/0x14b8 kernel/workqueue.c:2306
worker_thread+0x910/0x1034 kernel/workqueue.c:2453
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 <unknown>:870

Allocated by task 4053:

The buggy address belongs to the object at ffff0000ceba7000

which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 10 bytes to the right of

1024-byte region [ffff0000ceba7000, ffff0000ceba7400)

The buggy address belongs to the page:

page:00000000065839b5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10eba0
head:00000000065839b5 order:3 compound_mapcount:0 compound_pincount:0

flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)

raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002780

raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:

ffff0000ceba7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff0000ceba7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff0000ceba7400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff0000ceba7480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000ceba7500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

[syzbot]

syzbot suspects this issue could be fixed by backporting the following commit:

commit b48b833f9e8aa0675820a3b5a0f30d7319590ea8
git tree: upstream
Author: Luiz Augusto von Dentz <luiz.vo...@intel.com>
Date: Wed Dec 1 18:55:01 2021 +0000

Bluetooth: HCI: Use skb_pull_data to parse LE Ext Advertising Report event

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=157d444e680000
kernel config: https://syzkaller.appspot.com/x/.config?x=f5592cc4916e1c2f
dashboard link: https://syzkaller.appspot.com/bug?extid=57b8721a7d4d06e7ffa8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=146a7e1ec80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=139851f5c80000


Please keep in mind that other backports might be required as well.

For information about bisection process see: https://goo.gl/tpsmEJ#bisection