KASAN: use-after-free Read in skb_release_data (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 78d697fc Linux 4.14.172
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11517ba1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=31ad682bcda9b93f
dashboard link: https://syzkaller.appspot.com/bug?extid=32ab713350c43e6736ca
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13f11291e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+32ab71...@syzkaller.appspotmail.com

Bluetooth: Invalid header checksum
Bluetooth: Invalid header checksum
Bluetooth: Invalid header checksum
Bluetooth: Invalid header checksum
==================================================================
BUG: KASAN: use-after-free in skb_release_data+0x563/0x7b0 net/core/skbuff.c:567
Read of size 1 at addr ffff8880994b77c2 by task kworker/u4:7/8147
Bluetooth: Invalid header checksum

CPU: 0 PID: 8147 Comm: kworker/u4:7 Not tainted 4.14.172-syzkaller #0
Bluetooth: Invalid header checksum
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Bluetooth: Invalid header checksum
Workqueue: events_unbound flush_to_ldisc
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x13e/0x194 lib/dump_stack.c:58
print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393
skb_release_data+0x563/0x7b0 net/core/skbuff.c:567
skb_release_all+0x46/0x60 net/core/skbuff.c:631
__kfree_skb net/core/skbuff.c:645 [inline]
kfree_skb+0xae/0x340 net/core/skbuff.c:663
h5_reset_rx+0x47/0x100 drivers/bluetooth/hci_h5.c:499
h5_rx_3wire_hdr+0x2a2/0x360 drivers/bluetooth/hci_h5.c:409
Bluetooth: Invalid header checksum
h5_recv+0x232/0x3b0 drivers/bluetooth/hci_h5.c:532
Bluetooth: Invalid header checksum
hci_uart_tty_receive+0x1ec/0x4c0 drivers/bluetooth/hci_ldisc.c:616
tty_ldisc_receive_buf+0x12e/0x170 drivers/tty/tty_buffer.c:459
tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:475 [inline]
flush_to_ldisc+0x1dd/0x3f0 drivers/tty/tty_buffer.c:527
process_one_work+0x813/0x1540 kernel/workqueue.c:2114
worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Allocated by task 8147:
save_stack+0x32/0xa0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529
__do_kmalloc_node mm/slab.c:3682 [inline]
__kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3696
__kmalloc_reserve.isra.0+0x35/0xd0 net/core/skbuff.c:137
__alloc_skb+0xca/0x4c0 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:336 [inline]
h5_rx_pkt_start+0xbf/0x260 drivers/bluetooth/hci_h5.c:443
h5_recv+0x232/0x3b0 drivers/bluetooth/hci_h5.c:532
hci_uart_tty_receive+0x1ec/0x4c0 drivers/bluetooth/hci_ldisc.c:616
tty_ldisc_receive_buf+0x12e/0x170 drivers/tty/tty_buffer.c:459
tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:475 [inline]
flush_to_ldisc+0x1dd/0x3f0 drivers/tty/tty_buffer.c:527
process_one_work+0x813/0x1540 kernel/workqueue.c:2114
worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248
kthread+0x30d/0x420 kernel/kthread.c:232
Bluetooth: Invalid header checksum
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Bluetooth: Invalid header checksum

Freed by task 8494:
Bluetooth: Invalid header checksum
save_stack+0x32/0xa0 mm/kasan/kasan.c:447
Bluetooth: Invalid header checksum
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcb/0x260 mm/slab.c:3815
skb_free_head+0x83/0xa0 net/core/skbuff.c:554
skb_release_data+0x528/0x7b0 net/core/skbuff.c:574
skb_release_all+0x46/0x60 net/core/skbuff.c:631
__kfree_skb net/core/skbuff.c:645 [inline]
kfree_skb+0xae/0x340 net/core/skbuff.c:663
h5_reset_rx+0x47/0x100 drivers/bluetooth/hci_h5.c:499
h5_rx_3wire_hdr+0x2a2/0x360 drivers/bluetooth/hci_h5.c:409
h5_recv+0x232/0x3b0 drivers/bluetooth/hci_h5.c:532
hci_uart_tty_receive+0x1ec/0x4c0 drivers/bluetooth/hci_ldisc.c:616
tiocsti drivers/tty/tty_io.c:2186 [inline]
tty_ioctl+0xd5b/0x1220 drivers/tty/tty_io.c:2572
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff8880994b5900
which belongs to the cache kmalloc-8192 of size 8192
The buggy address is located 7874 bytes inside of
8192-byte region [ffff8880994b5900, ffff8880994b7900)
The buggy address belongs to the page:
page:ffffea0002652d00 count:1 mapcount:0 mapping:ffff8880994b5900 index:0x0 compound_mapcount: 0
flags: 0xfffe0000008100(slab|head)
raw: 00fffe0000008100 ffff8880994b5900 0000000000000000 0000000100000001
raw: ffffea0001e04320 ffffea0002613520 ffff88812fe55080 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8880994b7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880994b7700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880994b7780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880994b7800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880994b7880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches