A use-after-free read of the kobject member being casted out to the device structure containing it seems to be potentially possible due to unsafe casting using container_of (since an edge case such as when the ptr being casted might be NULL or problematic is not accounted for). Using container_of_safe resolves this issue, with no obvious tradeoffs and without considerable expense.
Reported-by: [email protected] Tested-by: [email protected] Signed-off-by: Anant Thazhemadam <[email protected]> --- include/linux/device.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/device.h b/include/linux/device.h index ca18da4768e3..aeb70b7a37e6 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -643,7 +643,7 @@ struct device_link { static inline struct device *kobj_to_dev(struct kobject *kobj) { - return container_of(kobj, struct device, kobj); + return container_of_safe(kobj, struct device, kobj); } /** -- 2.25.1
