tty: Fix use-after-free of echo_delayed_work member from tty_struct

Cancel the delayed work echo_delayed_work before freeing ldisc.

BUG: KASAN: use-after-free in hlist_move_list include/linux/list.h:771 [inline]
BUG: KASAN: use-after-free in __collect_expired_timers kernel/time/timer.c:1401 [inline]
BUG: KASAN: use-after-free in collect_expired_timers kernel/time/timer.c:1659 [inline]
BUG: KASAN: use-after-free in __run_timers kernel/time/timer.c:1722 [inline]
BUG: KASAN: use-after-free in run_timer_softirq+0x498/0x22b0 kernel/time/timer.c:1739
Write of size 8 at addr ffffffc057cacc48 by task syz-executor/26004

CPU: 0 PID: 26004 Comm: syz-executor Tainted: G S W 4.19.47+ #1
Hardware name: Qualcomm Technologies, Inc. MTP (DT)
Call trace:
dump_backtrace+0x0/0x440
show_stack+0x24/0x30 arch/arm64/kernel/traps.c:158
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x134/0x1a0 lib/dump_stack.c:113
print_address_description+0x84/0x2e0 mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report+0x26c/0x2d0 mm/kasan/report.c:412
__asan_report_store8_noabort+0x2c/0x38 mm/kasan/report.c:438
hlist_move_list include/linux/list.h:771 [inline]
__collect_expired_timers kernel/time/timer.c:1401 [inline]
collect_expired_timers kernel/time/timer.c:1659 [inline]
__run_timers kernel/time/timer.c:1722 [inline]
run_timer_softirq+0x498/0x22b0 kernel/time/timer.c:1739
__do_softirq+0x778/0xd04 kernel/softirq.c:296
do_softirq_own_stack include/linux/interrupt.h:510 [inline]
invoke_softirq kernel/softirq.c:383 [inline]
irq_exit+0x218/0x318 kernel/softirq.c:416
__handle_domain_irq+0x124/0x1c0 kernel/irq/irqdesc.c:666
gic_handle_irq+0x280/0x324 drivers/irqchip/irq-gic-v3.c:428
el1_irq+0xb4/0x130 arch/arm64/kernel/entry.S:622
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:88 [inline]
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
_raw_spin_unlock_irqrestore+0x48/0xe0 kernel/locking/spinlock.c:184
task_rq_unlock kernel/sched/sched.h:1254 [inline]
sched_exit+0x9e0/0xdd0 kernel/sched/core.c:7832
do_exit+0x218/0x1ff0 kernel/exit.c:823
do_group_exit+0x138/0x250 kernel/exit.c:980
__do_sys_exit_group kernel/exit.c:991 [inline]
__se_sys_exit_group+0x24/0x28 kernel/exit.c:989
__se_sys_exit_group+0x0/0x28 kernel/exit.c:989
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common+0x198/0x368 arch/arm64/kernel/syscall.c:114
el0_svc_handler+0x12c/0x198 arch/arm64/kernel/syscall.c:160
el0_svc+0x8/0xc arch/arm64/kernel/entry.S:928

Allocated by task 26006:
save_stack mm/kasan/kasan.c:448 [inline]
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xe0/0x1b0 mm/kasan/kasan.c:553
kmem_cache_alloc_trace+0x1ec/0x448 mm/slub.c:2746
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
alloc_tty_struct+0xb0/0x690 drivers/tty/tty_io.c:2836
pty_common_install drivers/tty/pty.c:398 [inline]
pty_unix98_install+0x150/0x400 drivers/tty/pty.c:730
tty_driver_install_tty drivers/tty/tty_io.c:1226 [inline]
tty_init_dev+0xb4/0x668 drivers/tty/tty_io.c:1339
ptmx_open+0xfc/0x2a0 drivers/tty/pty.c:835
chrdev_open+0x40c/0x4f0 fs/char_dev.c:423
do_dentry_open+0x63c/0xb88 fs/open.c:789
vfs_open+0x7c/0x90 fs/open.c:898
do_last fs/namei.c:3456 [inline]
path_openat+0x2b14/0x4d00 fs/namei.c:3573
do_filp_open+0x1b4/0x3c0 fs/namei.c:3603
do_sys_open+0x2b0/0x5e0 fs/open.c:1081
__do_sys_openat fs/open.c:1108 [inline]
__se_sys_openat fs/open.c:1102 [inline]
__arm64_sys_openat+0x9c/0xb0 fs/open.c:1102
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common+0x198/0x368 arch/arm64/kernel/syscall.c:114
el0_svc_handler+0x12c/0x198 arch/arm64/kernel/syscall.c:160
el0_svc+0x8/0xc arch/arm64/kernel/entry.S:928

Freed by task 630:
save_stack mm/kasan/kasan.c:448 [inline]
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x13c/0x220 mm/kasan/kasan.c:521
kasan_slab_free+0x10/0x20 mm/kasan/kasan.c:528
slab_free_hook mm/slub.c:1383 [inline]
slab_free_freelist_hook mm/slub.c:1410 [inline]
slab_free mm/slub.c:2966 [inline]
kfree+0x23c/0x938 mm/slub.c:3923
free_tty_struct drivers/tty/tty_io.c:175 [inline]
release_one_tty+0x228/0x278 drivers/tty/tty_io.c:1463
process_one_work+0xb18/0x15d8 kernel/workqueue.c:2191
worker_thread+0xc60/0x1100 kernel/workqueue.c:2337
kthread+0x2c8/0x2e0 kernel/kthread.c:247
ret_from_fork+0x10/0x1c arch/arm64/kernel/entry.S:1085

The buggy address belongs to the object at ffffffc057cac680
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 1480 bytes inside of
2048-byte region [ffffffc057cac680, ffffffc057cace80)
The buggy address belongs to the page:
page:ffffffbf015f2a00 count:1 mapcount:0
mapping:ffffffc07fc28b00 index:0x0 compound_mapcount: 0
flags: 0x10200(slab|head)
raw: 0000000000010200 ffffffbf04844208 ffffffbf028faa08 ffffffc07fc28b00
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page allocated via order 3, migratetype Unmovable,
gfp_mask 0x352c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|
__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2012 [inline]
prep_new_page+0x294/0x3d8 mm/page_alloc.c:2020
get_page_from_freelist+0x2f48/0x31d8 mm/page_alloc.c:3639
__alloc_pages_nodemask+0x428/0x2fc0 mm/page_alloc.c:4745
alloc_slab_page mm/slub.c:334 [inline]
allocate_slab mm/slub.c:1595 [inline]
new_slab+0xd4/0x698 mm/slub.c:1666
new_slab_objects mm/slub.c:2430 [inline]
___slab_alloc+0x548/0x6e8 mm/slub.c:2582
__slab_alloc mm/slub.c:2622 [inline]
slab_alloc_node mm/slub.c:2685 [inline]
slab_alloc mm/slub.c:2727 [inline]
kmem_cache_alloc_trace+0x40c/0x448 mm/slub.c:2744
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
alloc_tty_struct+0xb0/0x690 drivers/tty/tty_io.c:2836
tty_init_dev+0x60/0x668 drivers/tty/tty_io.c:1332
ptmx_open+0xfc/0x2a0 drivers/tty/pty.c:835
chrdev_open+0x40c/0x4f0 fs/char_dev.c:423
do_dentry_open+0x63c/0xb88 fs/open.c:789
vfs_open+0x7c/0x90 fs/open.c:898
do_last fs/namei.c:3456 [inline]
path_openat+0x2b14/0x4d00 fs/namei.c:3573
do_filp_open+0x1b4/0x3c0 fs/namei.c:3603
do_sys_open+0x2b0/0x5e0 fs/open.c:1081
__do_sys_openat fs/open.c:1108 [inline]
__se_sys_openat fs/open.c:1102 [inline]
__arm64_sys_openat+0x9c/0xb0 fs/open.c:1102

Memory state around the buggy address:
ffffffc057cacb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffffffc057cacb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffffffc057cacc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
ffffffc057cacc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffffffc057cacd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Change-Id: Ibd79a962a884ddbd9ccf17dd1e2795c3bd022e07
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
Signed-off-by: Prakruthi Deepak Heragu <pheragu@codeaurora.org>