lkml.org 
[lkml]   [2019]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: KASAN: invalid-free in tomoyo_realpath_from_path
From
Date
Well, I don't think this is a TOMOYO's problem.

On 2019/05/28 14:48, syzbot wrote:
> CPU: 1 PID: 11697 Comm: syz-executor.3 Not tainted 5.2.0-rc1+ #2
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
(...snipped...)
> kfree+0xcf/0x220 mm/slab.c:3755
> tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319
(...snipped...)
> Allocated by task 11696:
(...snipped...)
> kmalloc include/linux/slab.h:552 [inline]
> tomoyo_realpath_from_path+0xcd/0x7a0 security/tomoyo/realpath.c:277
(...snipped...)
>
> Freed by task 11696:
(...snipped...)
> kfree+0xcf/0x220 mm/slab.c:3755
> tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319

Since the "buf" variable is a local variable, it cannot be shared between
two threads. Since "buf" is assigned as

buf = kmalloc(buf_len, GFP_NOFS);

and nobody else is reassigning "buf",

kfree(buf);

can't become an invalid free.

Let's wait for a reproducer...

\
 
 \ /
  Last update: 2019-05-28 09:39    [W:1.199 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site