2017-11-13 20:10:38

by Taras Kondratiuk

[permalink] [raw]
Subject: Re: Manual unbind of ATA devices causes use-after-free

Hi Lin,

Quoting Tejun Heo (2017-11-06 07:24:52)
> Hello,
>
> On Fri, Nov 03, 2017 at 09:32:16AM -0700, Taras Kondratiuk wrote:
> > Also even if sg_release() is called before ata_host_release() there is
> > still no guarantee that the last reference will be dropped, because
> > sg_release() schedules sg_remove_sfp_usercontext() to do actual release
> > and the work may not be completed in time.
>
> Hmmm, we didn't use to put in ata device structs in the kobject tree,
> so this wasn't an issue. This was changed by 9a6d6a2ddabb ("ata: make
> ata port as parent device of scsi host") while adding the transport
> support. While doing that, we didn't change the release path to match
> it, so the failure.
>
> cc'ing Lin. Lin, can you take a look at this?

I'm ready to test whenever you have something. If you don't have time to
look at this then can you recommend a proper way to fix it. Is it better
to change device hierarchy back to previous state (revert 9a6d6a2ddabb)
or add reference counting to ata_host?

From 1583330911094473181@xxx Mon Nov 06 15:27:04 +0000 2017
X-GM-THRID: 1582908631068481434
X-Gmail-Labels: Inbox,Category Forums,HistoricalUnread