Messages in this thread Patch in this message | | | From | Anant Thazhemadam <> | Subject | [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition | Date | Mon, 7 Sep 2020 01:41:56 +0530 |
| |
A use-after-free read of the kobject member being casted out to the device structure containing it seems to be potentially possible due to unsafe casting using container_of (since an edge case such as when the ptr being casted might be NULL or problematic is not accounted for). Using container_of_safe resolves this issue, with no obvious tradeoffs and without considerable expense.
Reported-by: syzbot+b8639c8dcb5ec4483d4f@syzkaller.appspotmail.com Tested-by: syzbot+b8639c8dcb5ec4483d4f@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com> --- include/linux/device.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/device.h b/include/linux/device.h index ca18da4768e3..aeb70b7a37e6 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -643,7 +643,7 @@ struct device_link { static inline struct device *kobj_to_dev(struct kobject *kobj) { - return container_of(kobj, struct device, kobj); + return container_of_safe(kobj, struct device, kobj); } /** -- 2.25.1
| |