This series fixes use-after-free issues in pata_parport when a protocol
module goes away while pi_adapter devices created by it are still
attached.

Patch 1 pins the protocol module before the device becomes visible.
Previously try_module_get() ran after device_register(), so a forced
module unload in between left pi->proto dangling from the moment the
device appeared on the bus.

Patch 2 makes pata_parport_unregister_driver() tear down all adapters
using the protocol. Without this, the rollback path of a multi-protocol
module init (e.g. kbic registering k951 then k971) left the devices of
the already-registered protocol alive while the module loader freed the
module memory; removing such a dangling device later crashed in
pi_disconnect() dereferencing pi->proto->disconnect.

Pei Xiao (2):
  ata: pata_parport: pin the protocol module before device_register()
  ata: pata_parport: unregister devices on protocol unregister

 drivers/ata/pata_parport/pata_parport.c | 28 ++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

-- 
2.25.1

On Tue, 08 Sep 2026 19:47:26 +0800, Pei Xiao wrote:
> This series fixes use-after-free issues in pata_parport when a protocol
> module goes away while pi_adapter devices created by it are still
> attached.
> 
> Patch 1 pins the protocol module before the device becomes visible.
> Previously try_module_get() ran after device_register(), so a forced
> module unload in between left pi->proto dangling from the moment the
> device appeared on the bus.
> 
> [...]

Applied to libata/linux.git (for-7.4), thanks!

[1/2] ata: pata_parport: pin the protocol module before device_register()
      https://git.kernel.org/libata/linux/c/5d3355c7
[2/2] ata: pata_parport: unregister devices on protocol unregister
      https://git.kernel.org/libata/linux/c/d82c5cf6

Kind regards,
Niklas

On Wed, Sep 09, 2026 at 12:52:47PM +0200, Niklas Cassel wrote:
> On Tue, 08 Sep 2026 19:47:26 +0800, Pei Xiao wrote:
> > This series fixes use-after-free issues in pata_parport when a protocol
> > module goes away while pi_adapter devices created by it are still
> > attached.
> > 
> > Patch 1 pins the protocol module before the device becomes visible.
> > Previously try_module_get() ran after device_register(), so a forced
> > module unload in between left pi->proto dangling from the moment the
> > device appeared on the bus.
> > 
> > [...]
> 
> Applied to libata/linux.git (for-7.4), thanks!
> 
> [1/2] ata: pata_parport: pin the protocol module before device_register()
>       https://git.kernel.org/libata/linux/c/5d3355c7
> [2/2] ata: pata_parport: unregister devices on protocol unregister
>       https://git.kernel.org/libata/linux/c/d82c5cf6

This series was dropped because of kernel test robot reporting
build error.

(Interestingly, Sashiko did only reported an unrelated pre-existing issue,
but did not report the build error.)


Kind regards,
Niklas