[BUG] greybus: ODEBUG init-active on a greybus_reset timer, and use-after-free in do_work()

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/167-warning-odebug-bug-in-do-work/

  greybus 3-svc: Resetting the greybus network, watch out!!!
  ODEBUG: init active (active state 0) object: ffffffff92bbc2a0 object
type: timer_list hint: greybus_reset+0x0/0x50
  WARNING: lib/debugobjects.c:632 at __debug_object_init+0x2a8/0x4a0
lib/debugobjects.c:790, CPU#0: kworker/0:4/11040
  Call Trace:
   debug_timer_init kernel/time/timer.c:788 [inline]
   debug_init kernel/time/timer.c:836 [inline]
   timer_init_key+0x34/0x1e0 kernel/time/timer.c:880
   list_splice_tail_init include/linux/list.h:620 [inline]
   do_work+0x19e/0x2b0 drivers/md/dm-kcopyd.c:664
   process_one_work kernel/workqueue.c:3314 [inline]
   process_scheduled_works+0x881/0x1170 kernel/workqueue.c:3397
   worker_thread+0x988/0xde0 kernel/workqueue.c:3478

  WARNING: kernel/workqueue.c:806 at insert_work+0x1f3/0x240
  BUG: KASAN: slab-use-after-free in do_work+0x257/0x2b0

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,