linux-kernel - [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  7 Sep 2020 01:41:56 +0530
From:   Anant Thazhemadam <anant.thazhemadam@...il.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     linux-kernel-mentees@...ts.linuxfoundation.org,
        Anant Thazhemadam <anant.thazhemadam@...il.com>,
        syzbot+b8639c8dcb5ec4483d4f@...kaller.appspotmail.com,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Saravana Kannan <saravanak@...gle.com>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Jean-Philippe Brucker <jean-philippe@...aro.org>,
        Dan Williams <dan.j.williams@...el.com>,
        Joerg Roedel <jroedel@...e.de>,
        Bartosz Golaszewski <bgolaszewski@...libre.com>,
        linux-kernel@...r.kernel.org
Subject: [Linux-kernel-mentees] [PATCH] block : Fix use-after-free Read in delete_partition

A use-after-free read of the kobject member being casted out to the
device structure containing it seems to be potentially possible
due to unsafe casting using container_of (since an edge case such
as when the ptr being casted might be NULL or problematic is not
accounted for).
Using container_of_safe resolves this issue, with no obvious tradeoffs
and without considerable expense.

Reported-by: syzbot+b8639c8dcb5ec4483d4f@...kaller.appspotmail.com
Tested-by: syzbot+b8639c8dcb5ec4483d4f@...kaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@...il.com>
---
 include/linux/device.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/device.h b/include/linux/device.h
index ca18da4768e3..aeb70b7a37e6 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -643,7 +643,7 @@ struct device_link {
 
 static inline struct device *kobj_to_dev(struct kobject *kobj)
 {
-	return container_of(kobj, struct device, kobj);
+	return container_of_safe(kobj, struct device, kobj);
 }
 
 /**
-- 
2.25.1