From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933114AbdKCNUB (ORCPT ); Fri, 3 Nov 2017 09:20:01 -0400 Received: from mail-qk0-f180.google.com ([209.85.220.180]:51983 "EHLO mail-qk0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932569AbdKCNT5 (ORCPT ); Fri, 3 Nov 2017 09:19:57 -0400 X-Google-Smtp-Source: ABhQp+Tn+fpBNr7kZ+u46oCD5hKAme0Wgg/yvrAkbsquPkEcC1x/QTo8x/jb28CsNEYgkrCuMuixyg== Date: Fri, 3 Nov 2017 06:19:37 -0700 From: Tejun Heo To: Taras Kondratiuk Cc: linux-ide@vger.kernel.org, linux-kernel@vger.kernel.org, xe-linux-external@cisco.com Subject: Re: Manual unbind of ATA devices causes use-after-free Message-ID: <20171103131937.GQ3252168@devbig577.frc2.facebook.com> References: <150957868766.7160.13267337838101258462@takondra-t460s> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <150957868766.7160.13267337838101258462@takondra-t460s> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, On Wed, Nov 01, 2017 at 04:24:47PM -0700, Taras Kondratiuk wrote: > Manual unbind/remove unconditionally invokes devres_release_all which > calls ata_host_release() and frees ata_host/ata_port memory while it is > still being referenced (e.g as a parent of SCSI host). > > Is there a reason why ata_host is using derves which is not refcounted? > Does it make sense to add recounting to ata_host? Hmm... the removal path is supposed to drain everything synchronously. What kind of controller is it? Thanks. -- tejun