Re: [PATCH v2] ata: pata_parport: Fix use-after-free in new_device_store

[Niklas Cassel]

On Thu, 30 Jul 2026 11:16:29 +0800, Pei Xiao wrote:
> The function new_device_store() calls driver_find() without any
> protection against concurrent driver unregistration. This can lead
> to a use-after-free (UAF) when a driver is unloaded (via rmmod)
> in parallel with a new device addition via sysfs.
> 
> The race window exists because driver_find() returns a pointer to
> the driver's private data, but does not increase its reference
> count. The caller is responsible for ensuring the driver remains
> valid, but new_device_store() did not hold any lock or reference
> during the lookup and subsequent use.
> 
> [...]

Applied to libata/linux.git (for-7.4), thanks!

[1/1] ata: pata_parport: Fix use-after-free in new_device_store
      https://git.kernel.org/libata/linux/c/bd46a0b2

Kind regards,
Niklas