Messages in this thread | | | Subject | Re: KASAN: invalid-free in tomoyo_realpath_from_path | From | Tetsuo Handa <> | Date | Tue, 28 May 2019 16:38:50 +0900 |
| |
Well, I don't think this is a TOMOYO's problem.
On 2019/05/28 14:48, syzbot wrote: > CPU: 1 PID: 11697 Comm: syz-executor.3 Not tainted 5.2.0-rc1+ #2 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: (...snipped...) > kfree+0xcf/0x220 mm/slab.c:3755 > tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319 (...snipped...) > Allocated by task 11696: (...snipped...) > kmalloc include/linux/slab.h:552 [inline] > tomoyo_realpath_from_path+0xcd/0x7a0 security/tomoyo/realpath.c:277 (...snipped...) > > Freed by task 11696: (...snipped...) > kfree+0xcf/0x220 mm/slab.c:3755 > tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319
Since the "buf" variable is a local variable, it cannot be shared between two threads. Since "buf" is assigned as
buf = kmalloc(buf_len, GFP_NOFS);
and nobody else is reassigning "buf",
kfree(buf);
can't become an invalid free.
Let's wait for a reproducer...
| |