Re: [PATCH v2] ata: pata_parport: Fix use-after-free in new_device_store

[Pei Xiao]

在 2026/8/31 18:36, Niklas Cassel 写道:
> On Mon, Aug 31, 2026 at 05:49:51PM +0800, Pei Xiao wrote:
>> 在 2026/8/31 17:32, Niklas Cassel 写道:
>>> Hello Pei,
>>>
>>> On Mon, Aug 31, 2026 at 11:26:06AM +0200, Niklas Cassel wrote:
>>>> On Thu, 30 Jul 2026 11:16:29 +0800, Pei Xiao wrote:
>>>>> The function new_device_store() calls driver_find() without any
>>>>> protection against concurrent driver unregistration. This can lead
>>>>> to a use-after-free (UAF) when a driver is unloaded (via rmmod)
>>>>> in parallel with a new device addition via sysfs.
>>>>>
>>>>> The race window exists because driver_find() returns a pointer to
>>>>> the driver's private data, but does not increase its reference
>>>>> count. The caller is responsible for ensuring the driver remains
>>>>> valid, but new_device_store() did not hold any lock or reference
>>>>> during the lookup and subsequent use.
>>>>>
>>>>> [...]
>>>>
>>>> Applied to libata/linux.git (for-7.4), thanks!
>>>>
>>>> [1/1] ata: pata_parport: Fix use-after-free in new_device_store
>>>>       https://git.kernel.org/libata/linux/c/bd46a0b2
>>>
>>> I picked up this patch.
>>>
>>> But here:
>>> https://lore.kernel.org/linux-ide/dd146e49-33ff-4ae8-a641-1dc614e22733@xxxxxxxxxx/T/#m1cd93326f2935273e707c0aaea3c659a238bf2b6
>>>
>>> Damien asked you:
>>> "Sashiko had a comment about this that I think is very valid: if rmmod is
>>> executed with devices attached, what happens here?
>>> This entire driver seems to be lacking reference counting on the
>>> modules/drivers, so this all seems very fragile."
>> hi Maintainer,
>> I have submitted this patch, and now I'm a bit unsure whether I've
>> solved this problem.
>> https://lore.kernel.org/lkml/a8d9807618ab786313654099c904d613075e1b63.1785398816.git.xiaopei01@xxxxxxxxxx/
> 
> That patch proposal seems to prevent the module from ever being unloaded:
> https://lore.kernel.org/linux-ide/20260730082554.B2C161F00A3A@xxxxxxxxxxxxxxx/
> 
> So I would assume that it is not the right solution.
> 
> I did not try to unload the module myself while having devices attached.
> 
> However, as far as I can tell, this is a pre-existing problem, and not
> related to your already accepted patch, so don't feel obligated to fix
> this problem. It was mainly if you had some extra time.
hi Niklas,
  Thank you for your reply. I'll take a look when I have some time.

Thanks!
Pei.
> 
> 
> Kind regards,
> Niklas