netdev - Re: KASAN: invalid-free in tomoyo_realpath_from

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fb152725-1694-3412-9757-902f550f07f1@i-love.sakura.ne.jp>
Date:   Tue, 28 May 2019 16:38:50 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
To:     syzbot <syzbot+9742b1c6c7aedf18beda@...kaller.appspotmail.com>
Cc:     jmorris@...ei.org, linux-kernel@...r.kernel.org,
        linux-security-module@...r.kernel.org, netdev@...r.kernel.org,
        serge@...lyn.com, syzkaller-bugs@...glegroups.com,
        takedakn@...data.co.jp
Subject: Re: KASAN: invalid-free in tomoyo_realpath_from_path

Well, I don't think this is a TOMOYO's problem.

On 2019/05/28 14:48, syzbot wrote:
> CPU: 1 PID: 11697 Comm: syz-executor.3 Not tainted 5.2.0-rc1+ #2
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
> Call Trace:
(...snipped...)
>  kfree+0xcf/0x220 mm/slab.c:3755
>  tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319
(...snipped...)
> Allocated by task 11696:
(...snipped...)
>  kmalloc include/linux/slab.h:552 [inline]
>  tomoyo_realpath_from_path+0xcd/0x7a0 security/tomoyo/realpath.c:277
(...snipped...)
> 
> Freed by task 11696:
(...snipped...)
>  kfree+0xcf/0x220 mm/slab.c:3755
>  tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319

Since the "buf" variable is a local variable, it cannot be shared between
two threads. Since "buf" is assigned as

  buf = kmalloc(buf_len, GFP_NOFS);

and nobody else is reassigning "buf",

  kfree(buf);

can't become an invalid free.

Let's wait for a reproducer...