[Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition

Anant Thazhemadam anant.thazhemadam at gmail.com
Sun Sep 6 20:11:56 UTC 2020

A use-after-free read of the kobject member being casted out to the
device structure containing it seems to be potentially possible
due to unsafe casting using container_of (since an edge case such
as when the ptr being casted might be NULL or problematic is not
accounted for).
Using container_of_safe resolves this issue, with no obvious tradeoffs
and without considerable expense.

Reported-by: syzbot+b8639c8dcb5ec4483d4f at syzkaller.appspotmail.com
Tested-by: syzbot+b8639c8dcb5ec4483d4f at syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam at gmail.com>
 include/linux/device.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/device.h b/include/linux/device.h
index ca18da4768e3..aeb70b7a37e6 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -643,7 +643,7 @@ struct device_link {
 static inline struct device *kobj_to_dev(struct kobject *kobj)
-	return container_of(kobj, struct device, kobj);
+	return container_of_safe(kobj, struct device, kobj);

More information about the Linux-kernel-mentees mailing list