KASAN: slab-out-of-bounds Read in hci_event_packet

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: fa5941f4 Linux 4.14.114
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13832f62a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d7780000df8e070e
dashboard link: https://syzkaller.appspot.com/bug?extid=3068e9adbae6a7481631
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14c894c2a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11fc7e50a00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+3068e9...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read)
audit: type=1400 audit(1556763934.514:36): avc: denied { map } for
pid=7078 comm="syz-executor021" path="/root/syz-executor021756876"
dev="sda1" ino=1426 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023
tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:347 [inline]
BUG: KASAN: slab-out-of-bounds in bacpy
include/net/bluetooth/bluetooth.h:233 [inline]
BUG: KASAN: slab-out-of-bounds in hci_inquiry_result_with_rssi_evt
net/bluetooth/hci_event.c:3629 [inline]
BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x9524/0x9d13
net/bluetooth/hci_event.c:5363
Read of size 6 at addr ffff88808ba3ec7b by task kworker/u5:0/1402

CPU: 1 PID: 1402 Comm: kworker/u5:0 Not tainted 4.14.114 #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
Workqueue: hci0 hci_rx_work
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x138/0x19c lib/dump_stack.c:53
print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold+0xaf/0x2b5 mm/kasan/report.c:393
__asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:440
memcpy include/linux/string.h:347 [inline]
bacpy include/net/bluetooth/bluetooth.h:233 [inline]
hci_inquiry_result_with_rssi_evt net/bluetooth/hci_event.c:3629 [inline]
hci_event_packet+0x9524/0x9d13 net/bluetooth/hci_event.c:5363
hci_rx_work+0x3ab/0x900 net/bluetooth/hci_core.c:4237
process_one_work+0x868/0x1610 kernel/workqueue.c:2114
worker_thread+0x5d9/0x1050 kernel/workqueue.c:2248
kthread+0x31c/0x430 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402

Allocated by task 7082:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc mm/kasan/kasan.c:551 [inline]
kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529
__do_kmalloc_node mm/slab.c:3682 [inline]
__kmalloc_node_track_caller+0x51/0x80 mm/slab.c:3696
__kmalloc_reserve.isra.0+0x40/0xe0 net/core/skbuff.c:137
__alloc_skb+0xcf/0x500 net/core/skbuff.c:205
alloc_skb include/linux/skbuff.h:980 [inline]
bt_skb_alloc include/net/bluetooth/bluetooth.h:336 [inline]
vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline]
vhci_write+0xb6/0x437 drivers/bluetooth/hci_vhci.c:299
call_write_iter include/linux/fs.h:1774 [inline]
new_sync_write fs/read_write.c:469 [inline]
__vfs_write+0x4ae/0x6c0 fs/read_write.c:482
vfs_write+0x198/0x500 fs/read_write.c:544
SYSC_write fs/read_write.c:589 [inline]
SyS_write+0xb8/0x180 fs/read_write.c:581
do_syscall_64+0x1eb/0x630 arch/x86/entry/common.c:289
entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 3559:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x45/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcc/0x270 mm/slab.c:3815
kernfs_fop_release+0x112/0x180 fs/kernfs/file.c:783
__fput+0x277/0x7a0 fs/file_table.c:210
____fput+0x16/0x20 fs/file_table.c:244
task_work_run+0x119/0x190 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x1da/0x220 arch/x86/entry/common.c:163
prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
do_syscall_64+0x4a9/0x630 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff88808ba3ea80
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 507 bytes inside of
512-byte region [ffff88808ba3ea80, ffff88808ba3ec80)
The buggy address belongs to the page:
page:ffffea00022e8f80 count:1 mapcount:0 mapping:ffff88808ba3e080 index:0x0
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffff88808ba3e080 0000000000000000 0000000100000006
raw: ffffea00022e8f20 ffffea00024050e0 ffff8880aa800940 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff88808ba3eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88808ba3ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff88808ba3ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88808ba3ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88808ba3ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot suspects this issue was fixed by commit:

commit 68bb9eddbf5da767131079325b2097341ab05dca
Author: Peilin Ye <yepei...@gmail.com>
Date: Fri Jul 10 21:45:26 2020 +0000

Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=11682301900000
start commit: b850307b Linux 4.14.184
git tree: linux-4.14.y
kernel config: https://syzkaller.appspot.com/x/.config?x=ddc0f08dd6b981c5
dashboard link: https://syzkaller.appspot.com/bug?extid=3068e9adbae6a7481631
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=106412bd100000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10e102fb100000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: Bluetooth: Prevent out-of-bounds read in hci_inquiry_result_with_rssi_evt()

For information about bisection process see: https://goo.gl/tpsmEJ#bisection