[Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition

[Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition

[Anant Thazhemadam]

A use-after-free read of the kobject member being casted out to the
device structure containing it seems to be potentially possible
due to unsafe casting using container_of (since an edge case such
as when the ptr being casted might be NULL or problematic is not
accounted for).
Using container_of_safe resolves this issue, with no obvious tradeoffs
and without considerable expense.

Reported-by: syzbot+b8639c8dcb5ec4483d4f@syzkaller.appspotmail.com
Tested-by: syzbot+b8639c8dcb5ec4483d4f@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
 include/linux/device.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/device.h b/include/linux/device.h
index ca18da4768e3..aeb70b7a37e6 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -643,7 +643,7 @@ struct device_link {
 
 static inline struct device *kobj_to_dev(struct kobject *kobj)
 {
-	return container_of(kobj, struct device, kobj);
+	return container_of_safe(kobj, struct device, kobj);
 }
 
 /**
-- 
2.25.1

Re: [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition

[Greg Kroah-Hartman]

On Mon, Sep 07, 2020 at 01:41:56AM +0530, Anant Thazhemadam wrote:
> A use-after-free read of the kobject member being casted out to the
> device structure containing it seems to be potentially possible
> due to unsafe casting using container_of (since an edge case such
> as when the ptr being casted might be NULL or problematic is not
> accounted for).
> Using container_of_safe resolves this issue, with no obvious tradeoffs
> and without considerable expense.

No, now every caller has to check for NULL, and that would mean that you
now need to fix up hundreds of different places in the kernel.

Please fix the root cause that would cause NULL to be passed to this
call in the block code, don't paper over the issue here.

thanks,

greg k-h