[Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition

[Anant Thazhemadam]

A use-after-free read of the kobject member being casted out to the
device structure containing it seems to be potentially possible
due to unsafe casting using container_of (since an edge case such
as when the ptr being casted might be NULL or problematic is not
accounted for).
Using container_of_safe resolves this issue, with no obvious tradeoffs
and without considerable expense.

Reported-by: syzbot+b8639c8dcb5ec4483d4f at syzkaller.appspotmail.com
Tested-by: syzbot+b8639c8dcb5ec4483d4f at syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam at gmail.com>
---
 include/linux/device.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/device.h b/include/linux/device.h
index ca18da4768e3..aeb70b7a37e6 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -643,7 +643,7 @@ struct device_link {
 
 static inline struct device *kobj_to_dev(struct kobject *kobj)
 {
-	return container_of(kobj, struct device, kobj);
+	return container_of_safe(kobj, struct device, kobj);
 }
 
 /**
-- 
2.25.1