From: Ao Sun <ao.sun@transsion.com>

The child RPMB device holds a reference to its parent, so the parent's
release callback cannot be invoked if the child device is still registered.
Remove the rpmb_dev_unregister() from the parent release handler, and
unregister the child RPMB device ahead of the parent device in the remove 
path.

Memory for ufs_rpmb_dev is allocated via devm_kzalloc(), devres frees it on
parent remove, so no extra resource release is needed, and remove redundant
release callback.

Initialize hba->rpmbs at the start of ufs_rpmb_probe() so the list is
always initialized, preventing NULL-pointer dereferences in
ufs_rpmb_remove() during driver teardown.

Reported-by: sashiko-bot@kernel.org
Closes: https://lore.kernel.org/all/20260623121840.300121F000E9@smtp.kernel.org/
Signed-off-by: Jiazi Li <jiazi.li@transsion.com>
Signed-off-by: Ao Sun <ao.sun@transsion.com>
---
Changes in v2:
  - drop the release callback
  - init rpmbs list early
---
 drivers/ufs/core/ufs-rpmb.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index ffad049872b9..8c63913f7c39 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -124,13 +124,6 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
 	return ret;
 }
 
-static void ufs_rpmb_device_release(struct device *dev)
-{
-	struct ufs_rpmb_dev *ufs_rpmb = dev_get_drvdata(dev);
-
-	rpmb_dev_unregister(ufs_rpmb->rdev);
-}
-
 /* UFS RPMB device registration */
 int ufs_rpmb_probe(struct ufs_hba *hba)
 {
@@ -141,6 +134,8 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
 	u32 cap;
 	int ret;
 
+	INIT_LIST_HEAD(&hba->rpmbs);
+
 	if (!hba->ufs_rpmb_wlun || hba->dev_info.b_advanced_rpmb_en) {
 		dev_info(hba->dev, "Skip OP-TEE RPMB registration\n");
 		return -ENODEV;
@@ -152,8 +147,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
 		return -EINVAL;
 	}
 
-	INIT_LIST_HEAD(&hba->rpmbs);
-
 	struct rpmb_descr descr = {
 		.type = RPMB_TYPE_UFS,
 		.route_frames = ufs_rpmb_route_frames,
@@ -174,7 +167,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
 		ufs_rpmb->hba = hba;
 		ufs_rpmb->dev.parent = &hba->ufs_rpmb_wlun->sdev_gendev;
 		ufs_rpmb->dev.bus = &ufs_rpmb_bus_type;
-		ufs_rpmb->dev.release = ufs_rpmb_device_release;
 		dev_set_name(&ufs_rpmb->dev, "ufs_rpmb%d", region);
 
 		/* Set driver data BEFORE device_register */
@@ -224,6 +216,7 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
 	kfree(cid);
 	list_for_each_entry_safe(it, tmp, &hba->rpmbs, node) {
 		list_del(&it->node);
+		rpmb_dev_unregister(it->rdev);
 		device_unregister(&it->dev);
 	}
 
@@ -244,6 +237,7 @@ void ufs_rpmb_remove(struct ufs_hba *hba)
 		/* Remove from list first */
 		list_del(&ufs_rpmb->node);
 		/* Unregister device */
+		rpmb_dev_unregister(ufs_rpmb->rdev);
 		device_unregister(&ufs_rpmb->dev);
 	}
 
-- 
2.34.1