KASAN: use-after-free Read in hci_get_auth_info

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 14b58326 Linux 4.14.193
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=17c28194900000
kernel config: https://syzkaller.appspot.com/x/.config?x=68ef0287ccbc3b42
dashboard link: https://syzkaller.appspot.com/bug?extid=6aae86371d7bfc48f52a
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11bda026900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6aae86...@syzkaller.appspotmail.com

IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
Bluetooth: hci3 command 0x0419 tx timeout
Bluetooth: hci0 command 0x0409 tx timeout
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:172 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:840 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0x1245/0x1310 kernel/locking/mutex.c:893
Read of size 8 at addr ffff888091f94dd8 by task syz-executor.0/32135

CPU: 0 PID: 32135 Comm: syz-executor.0 Not tainted 4.14.193-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430
__mutex_waiter_is_first kernel/locking/mutex.c:172 [inline]
__mutex_lock_common kernel/locking/mutex.c:840 [inline]
__mutex_lock+0x1245/0x1310 kernel/locking/mutex.c:893
hci_get_auth_info+0x90/0x3b0 net/bluetooth/hci_conn.c:1508
hci_sock_bound_ioctl net/bluetooth/hci_sock.c:945 [inline]
hci_sock_ioctl+0x2c9/0x650 net/bluetooth/hci_sock.c:1048
sock_do_ioctl net/socket.c:974 [inline]
sock_ioctl+0x2cc/0x4c0 net/socket.c:1071
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x45ce69
RSP: 002b:00007f4dacf01c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000001d340 RCX: 000000000045ce69
RDX: 0000000020000000 RSI: 00000000800448d7 RDI: 0000000000000005
RBP: 000000000118c000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bfcc
R13: 00007ffd5fd8a75f R14: 00007f4dacf029c0 R15: 000000000118bfcc

Allocated by task 18874:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
kzalloc include/linux/slab.h:661 [inline]
hci_alloc_dev+0x3e/0x1c60 net/bluetooth/hci_core.c:2978
__vhci_create_device+0xe9/0x540 drivers/bluetooth/hci_vhci.c:114
vhci_create_device drivers/bluetooth/hci_vhci.c:163 [inline]
vhci_open_timeout+0x35/0x50 drivers/bluetooth/hci_vhci.c:319
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404

Freed by task 31078:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
bt_host_release+0x15/0x20 net/bluetooth/hci_sysfs.c:86
device_release+0xf0/0x1a0 drivers/base/core.c:831
kobject_cleanup lib/kobject.c:646 [inline]
kobject_release lib/kobject.c:675 [inline]
kref_put include/linux/kref.h:70 [inline]
kobject_put+0x1f3/0x2d0 lib/kobject.c:692
put_device+0x1c/0x30 drivers/base/core.c:2014
vhci_release+0x78/0xe0 drivers/bluetooth/hci_vhci.c:355
__fput+0x25f/0x7a0 fs/file_table.c:210
task_work_run+0x11f/0x190 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0xa08/0x27f0 kernel/exit.c:865
do_group_exit+0x100/0x2e0 kernel/exit.c:962
SYSC_exit_group kernel/exit.c:973 [inline]
SyS_exit_group+0x19/0x20 kernel/exit.c:971
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb

The buggy address belongs to the object at ffff888091f94d80
which belongs to the cache kmalloc-8192 of size 8192
The buggy address is located 88 bytes inside of
8192-byte region [ffff888091f94d80, ffff888091f96d80)
The buggy address belongs to the page:
page:ffffea000247e500 count:1 mapcount:0 mapping:ffff888091f94d80 index:0x0 compound_mapcount: 0
flags: 0xfffe0000008100(slab|head)
raw: 00fffe0000008100 ffff888091f94d80 0000000000000000 0000000100000001
raw: ffffea00024f7d20 ffffea000293d220 ffff88812fe51080 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff888091f94c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888091f94d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888091f94d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888091f94e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888091f94e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches