Re: KASAN: invalid-free in tomoyo_realpath_from_path

[Tetsuo Handa]

Well, I don't think this is a TOMOYO's problem.

On 2019/05/28 14:48, syzbot wrote:
> CPU: 1 PID: 11697 Comm: syz-executor.3 Not tainted 5.2.0-rc1+ #2
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
(...snipped...)
>  kfree+0xcf/0x220 mm/slab.c:3755
>  tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319
(...snipped...)
> Allocated by task 11696:
(...snipped...)
>  kmalloc include/linux/slab.h:552 [inline]
>  tomoyo_realpath_from_path+0xcd/0x7a0 security/tomoyo/realpath.c:277
(...snipped...)
> 
> Freed by task 11696:
(...snipped...)
>  kfree+0xcf/0x220 mm/slab.c:3755
>  tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319

Since the "buf" variable is a local variable, it cannot be shared between
two threads. Since "buf" is assigned as

  buf = kmalloc(buf_len, GFP_NOFS);

and nobody else is reassigning "buf",

  kfree(buf);

can't become an invalid free.

Let's wait for a reproducer...