Well, I don't think this is a TOMOYO's problem.

On 2019/05/28 14:48, syzbot wrote:

CPU: 1 PID: 11697 Comm: syz-executor.3 Not tainted 5.2.0-rc1+ #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:

(...snipped...)

 kfree+0xcf/0x220 mm/slab.c:3755
 tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319

(...snipped...)

Allocated by task 11696:

(...snipped...)

 kmalloc include/linux/slab.h:552 [inline]
 tomoyo_realpath_from_path+0xcd/0x7a0 security/tomoyo/realpath.c:277

(...snipped...)

Freed by task 11696:

(...snipped...)

 kfree+0xcf/0x220 mm/slab.c:3755
 tomoyo_realpath_from_path+0x1de/0x7a0 security/tomoyo/realpath.c:319

Since the "buf" variable is a local variable, it cannot be shared between
two threads. Since "buf" is assigned as

  buf = kmalloc(buf_len, GFP_NOFS);

and nobody else is reassigning "buf",

  kfree(buf);

can't become an invalid free.

Let's wait for a reproducer...