Re: [PATCH v3 1/2] ata: pata_parport: pin the protocol module before device_register()

[Niklas Cassel]

Hello Pei,

On Tue, Sep 22, 2026 at 11:38:00AM +0800, Pei Xiao wrote:
> pi_init_one() calls device_register() before try_module_get(). Between
> these two calls the device is already visible but the module is not
> pinned yet, so an unload in this window leaves pi->proto dangling:
> 
>     pi_init_one()                       rmmod -f <proto>
>     --------------------------------------------------------
>     device_register(&pi->dev)
>          device visible on the bus
>                                            module memory freed
>          pi->proto = pr        <- writes into freed memory / dangles
>          try_module_get(...)   <- too late, module already gone
> 
> Take the module reference before registering the device, and drop it
> on the device_register() failure path.
> 
> Fixes: 246a1c4c6b7f ("ata: pata_parport: add driver (PARIDE replacement)")
> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>

Looking at the code, this race cannot happen.

All three callers hold pi_mutex throughout pi_init_one().

pata_parport_unregister_driver() also acquires the mutex
before unregistering.

Thus, unload cannot complete at the same time as pi_init_one().
So the motivation looks wrong.

Additionally, rmmod -f bypasses a non-zero module reference count,
so I don't see how taking a refcount earlier would solve a rmmod -f.

Are you building your kernel with CONFIG_MODULE_FORCE_UNLOAD ?


Kind regards,
Niklas