On Mon, 2017-03-13 at 14:55 -0700, James Bottomley wrote: > This is true, but I don't see how it can cause the host to be freed > before the sdev. The memory for struct Scsi_Host is freed in the > shost_gendev release routine, which should be pinned by the parent > traversal from sdev. So it should not be possible for > scsi_host_dev_release() to be called before > scsi_device_dev_release_usercontext() becase the latter has the final > put of the parent device. Hello James, I will run a bisect to see whether that provides more information about what caused the change in the reference counting behavior. Israel, since you did not hit the reference counting issue in your tests, can you repeat your test with patches 3, 4 and 5 applied? Thanks, Bart.