linux-kernel-mentees.lists.linuxfoundation.org archive mirror
 help / color / mirror / Atom feed
* [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition
@ 2020-09-06 20:11 Anant Thazhemadam
  2020-09-07  5:47 ` Greg Kroah-Hartman
  0 siblings, 1 reply; 2+ messages in thread
From: Anant Thazhemadam @ 2020-09-06 20:11 UTC (permalink / raw)
  Cc: Jean-Philippe Brucker, Anant Thazhemadam, Joerg Roedel,
	Saravana Kannan, Rafael J. Wysocki, linux-kernel,
	Bartosz Golaszewski, syzbot+b8639c8dcb5ec4483d4f, Dan Williams,
	linux-kernel-mentees

A use-after-free read of the kobject member being casted out to the
device structure containing it seems to be potentially possible
due to unsafe casting using container_of (since an edge case such
as when the ptr being casted might be NULL or problematic is not
accounted for).
Using container_of_safe resolves this issue, with no obvious tradeoffs
and without considerable expense.

Reported-by: syzbot+b8639c8dcb5ec4483d4f@syzkaller.appspotmail.com
Tested-by: syzbot+b8639c8dcb5ec4483d4f@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
 include/linux/device.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/device.h b/include/linux/device.h
index ca18da4768e3..aeb70b7a37e6 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -643,7 +643,7 @@ struct device_link {
 
 static inline struct device *kobj_to_dev(struct kobject *kobj)
 {
-	return container_of(kobj, struct device, kobj);
+	return container_of_safe(kobj, struct device, kobj);
 }
 
 /**
-- 
2.25.1

_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition
  2020-09-06 20:11 [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition Anant Thazhemadam
@ 2020-09-07  5:47 ` Greg Kroah-Hartman
  0 siblings, 0 replies; 2+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-07  5:47 UTC (permalink / raw)
  To: Anant Thazhemadam
  Cc: Jean-Philippe Brucker, Joerg Roedel, Saravana Kannan,
	Rafael J. Wysocki, linux-kernel, Bartosz Golaszewski,
	syzbot+b8639c8dcb5ec4483d4f, Dan Williams, linux-kernel-mentees

On Mon, Sep 07, 2020 at 01:41:56AM +0530, Anant Thazhemadam wrote:
> A use-after-free read of the kobject member being casted out to the
> device structure containing it seems to be potentially possible
> due to unsafe casting using container_of (since an edge case such
> as when the ptr being casted might be NULL or problematic is not
> accounted for).
> Using container_of_safe resolves this issue, with no obvious tradeoffs
> and without considerable expense.

No, now every caller has to check for NULL, and that would mean that you
now need to fix up hundreds of different places in the kernel.

Please fix the root cause that would cause NULL to be passed to this
call in the block code, don't paper over the issue here.

thanks,

greg k-h
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2020-09-07  5:47 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-06 20:11 [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition Anant Thazhemadam
2020-09-07  5:47 ` Greg Kroah-Hartman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).