Re: [PATCH v3 1/2] ata: pata_parport: pin the protocol module before device_register()

[Pei Xiao]

在 2026/9/22 22:53, Niklas Cassel 写道:
> Hello Pei,
> 
> On Tue, Sep 22, 2026 at 11:38:00AM +0800, Pei Xiao wrote:
>> pi_init_one() calls device_register() before try_module_get(). Between
>> these two calls the device is already visible but the module is not
>> pinned yet, so an unload in this window leaves pi->proto dangling:
>>
>>     pi_init_one()                       rmmod -f <proto>
>>     --------------------------------------------------------
>>     device_register(&pi->dev)
>>          device visible on the bus
>>                                            module memory freed
>>          pi->proto = pr        <- writes into freed memory / dangles
>>          try_module_get(...)   <- too late, module already gone
>>
>> Take the module reference before registering the device, and drop it
>> on the device_register() failure path.
>>
>> Fixes: 246a1c4c6b7f ("ata: pata_parport: add driver (PARIDE replacement)")
>> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
> 
> Looking at the code, this race cannot happen.
> 
> All three callers hold pi_mutex throughout pi_init_one().
> 
> pata_parport_unregister_driver() also acquires the mutex
> before unregistering.
> 
> Thus, unload cannot complete at the same time as pi_init_one().
> So the motivation looks wrong.
> 
> Additionally, rmmod -f bypasses a non-zero module reference count,
> so I don't see how taking a refcount earlier would solve a rmmod -f.
Yes, you're right — force unload doesn't really solve this issue. Thanks
for pointing it out.
  Thanks for your reply, and sorry for the noise.

Pei.
Thanks.
> 
> Are you building your kernel with CONFIG_MODULE_FORCE_UNLOAD ?
> 
> 
> Kind regards,
> Niklas