Unlocking Linux Kernel Magic: How container_of Retrieves Struct Addresses

In the Linux kernel, the macro container_of(ptr, type, member) is extensively used, for example in the linked list implementation list_head and work queue structures work_struct.

The macro is defined roughly as:

#define container_of(ptr, type, member) \
    ((type *)((char *)(ptr) - offsetof(type, member)))

It allows you to obtain the address of the whole structure when you only have the address of one of its members.

Consider the following structure:

struct test {
    int i;
    int j;
    char k;
};

struct test temp;

If you have the address of temp.j, you can retrieve the address of temp itself with: container_of(&temp.j, struct test, j) The macro works by first creating a temporary pointer to the member using GNU C’s typeof extension:

const typeof(((struct test *)0)->j) * __mptr = (&temp.j);

Here typeof deduces the type of j (an int) and stores the member’s address in __mptr. The final address of the containing structure is then calculated as:

(struct test *)((char *)__mptr - offsetof(struct test, j))

The offsetof macro, defined in the kernel as:

#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)

produces the byte offset of j within struct test. Subtracting this offset from the member’s address yields the base address of the structure.

The accompanying images illustrate the macro expansion, the offset calculation, and the final result of the example.

Thus, a seemingly simple macro in the Linux kernel encapsulates a clever technique for navigating from a member pointer back to its enclosing structure.