Re: Manual unbind of ATA devices causes use-after-free

[Taras Kondratiuk]

Hi Lin,

Quoting Tejun Heo (2017-11-06 07:24:52)
> Hello,
> 
> On Fri, Nov 03, 2017 at 09:32:16AM -0700, Taras Kondratiuk wrote:
> > Also even if sg_release() is called before ata_host_release() there is
> > still no guarantee that the last reference will be dropped, because
> > sg_release() schedules sg_remove_sfp_usercontext() to do actual release
> > and the work may not be completed in time.
> 
> Hmmm, we didn't use to put in ata device structs in the kobject tree,
> so this wasn't an issue.  This was changed by 9a6d6a2ddabb ("ata: make
> ata port as parent device of scsi host") while adding the transport
> support.  While doing that, we didn't change the release path to match
> it, so the failure.
> 
> cc'ing Lin.  Lin, can you take a look at this?

I'm ready to test whenever you have something. If you don't have time to
look at this then can you recommend a proper way to fix it. Is it better
to change device hierarchy back to previous state (revert 9a6d6a2ddabb)
or add reference counting to ata_host?