Messages in this thread | | | Date | Fri, 3 Nov 2017 06:19:37 -0700 | From | Tejun Heo <> | Subject | Re: Manual unbind of ATA devices causes use-after-free |
| |
Hello,
On Wed, Nov 01, 2017 at 04:24:47PM -0700, Taras Kondratiuk wrote: > Manual unbind/remove unconditionally invokes devres_release_all which > calls ata_host_release() and frees ata_host/ata_port memory while it is > still being referenced (e.g as a parent of SCSI host). > > Is there a reason why ata_host is using derves which is not refcounted? > Does it make sense to add recounting to ata_host?
Hmm... the removal path is supposed to drain everything synchronously. What kind of controller is it?
Thanks.
-- tejun
| |