Merge: CVE-2024-58013: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/476

JIRA: https://issues.redhat.com/browse/RHEL-81510
CVE: CVE-2024-58013

```
commit 26fbd34
Author: Mazin Al Haddad <mazin@getstate.dev>
Date:   Tue Dec 24 05:06:16 2024 +0300

    Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync

    This fixes the following crash:

    ==================================================================
    BUG: KASAN: slab-use-after-free in mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543
    Read of size 8 at addr ffff88814128f898 by task kworker/u9:4/5961

    CPU: 1 UID: 0 PID: 5961 Comm: kworker/u9:4 Not tainted 6.12.0-syzkaller-10684-gf1cd565ce577 #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
    Workqueue: hci0 hci_cmd_sync_work
    Call Trace:
     <TASK>
     __dump_stack lib/dump_stack.c:94 [inline]
     dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
     print_address_description mm/kasan/report.c:378 [inline]
     print_report+0x169/0x550 mm/kasan/report.c:489
     kasan_report+0x143/0x180 mm/kasan/report.c:602
     mgmt_remove_adv_monitor_sync+0x3a/0xd0 net/bluetooth/mgmt.c:5543
     hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332
     process_one_work kernel/workqueue.c:3229 [inline]
     process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310
     worker_thread+0x870/0xd30 kernel/workqueue.c:3391
     kthread+0x2f0/0x390 kernel/kthread.c:389
     ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
     ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
     </TASK>

    Allocated by task 16026:
     kasan_save_stack mm/kasan/common.c:47 [inline]
     kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
     poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
     __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
     kasan_kmalloc include/linux/kasan.h:260 [inline]
     __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4314
     kmalloc_noprof include/linux/slab.h:901 [inline]
     kzalloc_noprof include/linux/slab.h:1037 [inline]
     mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269
     mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296
     remove_adv_monitor+0x102/0x1b0 net/bluetooth/mgmt.c:5568
     hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712
     hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832
     sock_sendmsg_nosec net/socket.c:711 [inline]
     __sock_sendmsg+0x221/0x270 net/socket.c:726
     sock_write_iter+0x2d7/0x3f0 net/socket.c:1147
     new_sync_write fs/read_write.c:586 [inline]
     vfs_write+0xaeb/0xd30 fs/read_write.c:679
     ksys_write+0x18f/0x2b0 fs/read_write.c:731
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Freed by task 16022:
     kasan_save_stack mm/kasan/common.c:47 [inline]
     kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
     kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582
     poison_slab_object mm/kasan/common.c:247 [inline]
     __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
     kasan_slab_free include/linux/kasan.h:233 [inline]
     slab_free_hook mm/slub.c:2338 [inline]
     slab_free mm/slub.c:4598 [inline]
     kfree+0x196/0x420 mm/slub.c:4746
     mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259
     __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550
     hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208
     hci_dev_do_close net/bluetooth/hci_core.c:483 [inline]
     hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508
     sock_do_ioctl+0x158/0x460 net/socket.c:1209
     sock_ioctl+0x626/0x8e0 net/socket.c:1328
     vfs_ioctl fs/ioctl.c:51 [inline]
     __do_sys_ioctl fs/ioctl.c:906 [inline]
     __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892
     do_syscall_x64 arch/x86/entry/common.c:52 [inline]
     do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Reported-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=479aff51bb361ef5aa18
    Tested-by: syzbot+479aff51bb361ef5aa18@syzkaller.appspotmail.com
    Signed-off-by: Mazin Al Haddad <mazin@getstate.dev>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>```

Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com>

---

<small>Created 2025-02-27 22:51 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://gitlab.com/cki-project/kernel-workflow/-/issues/new?issue%5Btitle%5D=backporter%20webhook%20issue)</small>

Approved-by: Bastien Nocera <bnocera@redhat.com>
Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Julio Faracco <jfaracco@redhat.com>

Author: jcfaracco

net/bluetooth/mgmt.c

@@ -5456,10 +5456,16 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
 {
 	struct mgmt_rp_remove_adv_monitor rp;
 	struct mgmt_pending_cmd *cmd = data;
-	struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
+	struct mgmt_cp_remove_adv_monitor *cp;
+
+	if (status == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev))
+		return;
 
 	hci_dev_lock(hdev);
 
+	cp = cmd->param;
+
 	rp.monitor_handle = cp->monitor_handle;
 
 	if (!status)
@@ -5477,6 +5483,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data)
 {
 	struct mgmt_pending_cmd *cmd = data;
+
+	if (cmd != pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev))
+		return -ECANCELED;
+
 	struct mgmt_cp_remove_adv_monitor *cp = cmd->param;
 	u16 handle = __le16_to_cpu(cp->monitor_handle);