From nobody Sat Jul 25 01:24:38 2026 Received: from TYPPR03CU001.outbound.protection.outlook.com (mail-japaneastazon11022133.outbound.protection.outlook.com [52.101.126.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5990C34E766; Tue, 21 Jul 2026 08:41:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.126.133 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784623292; cv=fail; b=aXE+cwrbjRS1F+C8EX4F9hbS1YtulMCSkXaGsU7ZaH7jRPdn4ZJJLoFrDN71xQdducjlmX+itdjb7/1gaWFV32SIuZKZJWi8RY1AChVIpd0lWAFbrfslxh00FPwYo6mN3vNweZHgo4OCdotAGE6H+wxkZpK4HI3WWgpuXtJSsxY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784623292; c=relaxed/simple; bh=rmUyP3VJxvijmJJJux5JmEE5P19WGCD466kiLoz5370=; h=From:To:CC:Subject:Date:Message-ID:Content-Type:MIME-Version; b=LTURKSgc+aFwRToBD3yi6Br72pzfyeeR90HdA4cDXtqPD+qiiBdU32EkCSPrfKa13PYbY9E9xLoh4qLuBfkiqpvF2YXIT1nkgKm6Lg1b6QRtW0DUgDX/EnrfBXfyEqCW+c0slnzNgC2TqjFKqRMrTltnAeJyNWSi088WQRbdIUU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=transsion.com; spf=pass smtp.mailfrom=transsion.com; dkim=pass (1024-bit key) header.d=transsion.com header.i=@transsion.com header.b=GLMkEQZs; arc=fail smtp.client-ip=52.101.126.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=transsion.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=transsion.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=transsion.com header.i=@transsion.com header.b="GLMkEQZs" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=h0mrskcI+UCaRatef39A6Lw5pOUIvip1OL8nNaVktW2R0arzD+ILRq9l9sIXrhZFq+viP8yXmsCJgyGoXOpjVG4iqQeOVGeLXfON73o/ycZObG1Vl3JGzRZCiW4VPeFhzUtvMGR+ZbbjB9+ukPyyPGOQrulsdWBatXSyFRh8f/mgtKVtPeuXJWJgayDAmEo41A+jdqwlAy03vKNjt03VQhevZ8qGaGH3Vcup5a+6Msiq2Qf7+E3VQ5ztzqmvnQSs2wWLOHNmPQ9GWHSutK5reYovYmHbqc7gNdqchOwEsxkTwuU52M6PcEpLPTHV1G7+FBfWDEmIEc2d2BcFpedqgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Q+oGFM1uUMhsm7QDlfb12GfHfIqayYtSmZD2Ncpw/2k=; b=kaSCqBRtDNp5vG5nwJPC6bJCMXHFLRxKNKyn7j62ZP3yJ2xQOHSo5ySuwR7bBQ+oWlCxAFtRryuf9UVVOe9werentp85akWBHr8uQVwF+2Fj/Hur33cYggjGZ6gqXr5KH8+g02ZR+1gzXKYJ2kyNh8pG3LhPbAOgHKj9M762veRMyp9rmfE/wDapi5rXF28mq61M/Wrd6jx+Un0NF8wSOmz8hM8/JGExxaeuPzrq6QQ4qjGopuUtphD8iiT6Yu7dCewNL2FjYbSD3sNgVzUl21hVYRCLWrMLe/gXG8k8uAmdkOLZSPT5SWIwuJiQ6Q0LhYS4ObRcf2Z7/r931PZ+Yw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=transsion.com; dmarc=pass action=none header.from=transsion.com; dkim=pass header.d=transsion.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=transsion.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Q+oGFM1uUMhsm7QDlfb12GfHfIqayYtSmZD2Ncpw/2k=; b=GLMkEQZshhPXgFi8YWfCPwKjQyh3di0BTJOLFS+Aqii8bRWkj2n1XPk1kUBsYvwoCab8k04yW8c+/FNtNncLuJ2xdFG+luoR1/Chnsr7ZxsC6ezmQe4xEOzsg5rMs2+4CxW8ncyf6UO6Xc+6Q4GHtpARMDXlEwwz8qF5QNei7FE= Received: from SE3PR04MB8921.apcprd04.prod.outlook.com (2603:1096:101:2e8::6) by SI4PR04MB9377.apcprd04.prod.outlook.com (2603:1096:4:29c::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.10; Tue, 21 Jul 2026 08:41:25 +0000 Received: from SE3PR04MB8921.apcprd04.prod.outlook.com ([fe80::ebed:1dee:3932:9ba2]) by SE3PR04MB8921.apcprd04.prod.outlook.com ([fe80::ebed:1dee:3932:9ba2%3]) with mapi id 15.21.0245.009; Tue, 21 Jul 2026 08:41:24 +0000 From: Ao Sun To: "alim.akhtar@samsung.com" , "avri.altman@sandisk.com" , "bvanassche@acm.org" , "James.Bottomley@HansenPartnership.com" , "martin.petersen@oracle.com" , "peter.wang@mediatek.com" , "beanhuo@micron.com" , "can.guo@oss.qualcomm.com" CC: "linux-scsi@vger.kernel.org" , "linux-kernel@vger.kernel.org" , Jiazi Li , Hongyan Xia , Ao Sun , "sashiko-bot@kernel.org" Subject: [PATCH v3] scsi: ufs: core: Fix UFS RPMB device teardown order Thread-Topic: [PATCH v3] scsi: ufs: core: Fix UFS RPMB device teardown order Thread-Index: AQHdGOy2jO5MRWIl3kSyAJcKl5i7iw== Date: Tue, 21 Jul 2026 08:41:24 +0000 Message-ID: <20260721084015.319-1-ao.sun@transsion.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=transsion.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SE3PR04MB8921:EE_|SI4PR04MB9377:EE_ x-ms-office365-filtering-correlation-id: c069ead9-f3c7-413d-ed0a-08dee703d93b x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|42112799006|376014|7416014|366016|23010399003|1800799024|38070700021|18002099003|6133799003|11063799006|56012099006|5023799004|10067099003; x-microsoft-antispam-message-info: sBuq/WOnSLuK0a3bPbTnfJCSpk0phFOBq9DNVKEEYGk1dUj84NZEbCISYCObaBVq+FTi2V/a2Ybbk5xy1dagz8coZepNM3sL1aiZKLdFoh97bvYk/+OpUknYKi0+LgLyOfxxDk4/yDWb/36yr2sj0HC/v3eUpFgTSIdwPdTOxwvyR00khL+s5TSPv8z2lB/8fPvtnyhoRGaGVy7k8JUUzapq3f5QkQWRAsbXlHN2PGLzz8u4mN1k9hHN8J9lnlRgrtQtSjPw/qv8lnmcTvuisnWz177wDHFtMbXzrCfwxlE8K0iPgKPDPaoOvxohIh4Xy8V28L8fqULSihj/tFyazHs+Xwkdgu0DCVqA2CJ5JRwZ9yFEcQZu+MVhlpchgVbbTEFk3qv8gHnqldWlnrI80aZdN6TNVpTXqVL/iMEqkeA2PirxLzslcBDzZzruenOagAGB0gZEBqq+tdK9aKfs0mqRQWIqJzyRS2+kysCermnyyJF3ctWMJsTRSc4wgmYJZ0aTCE2sCPoAlWNGJ3Hdcl5ZWmBpJCSuvlMF9Fi1BhhYRZNs6zRFL/XpNdBlXr9EJfNZuJarptXpV8ZYL+YtJbGIzqeONTbYrFP5rr3HCprTgBTeWIm+JQbrvTU+rwt2YyVw9LcrO5D0i+78ZHLwn5OM+Cm6sYBo4R3ev2HdI7hbYkNtgJwz3vjguh9W0FCr11kJ7Zc7kug0hySNbjL+nBD84pzEr21sJizbDbr6oI0= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SE3PR04MB8921.apcprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(42112799006)(376014)(7416014)(366016)(23010399003)(1800799024)(38070700021)(18002099003)(6133799003)(11063799006)(56012099006)(5023799004)(10067099003);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?rH6cpZqZc11TFhbkcUdtrQq13NWy7FN4TzIYGwImdlceaUbdcKrAtk++of?= =?iso-8859-1?Q?qVXjzVJdOj9TXrQCDSAj+dDSvPwzOTj8IVADTiUv0ZJLcZvLqPKBNtksDY?= =?iso-8859-1?Q?4S7j9qIyt6sci+KYgjIpvsOupEg5RnG0gRQjYQXh9GtJeNVgVApqIw1Cmy?= =?iso-8859-1?Q?pVzn3OPVuMqL8M8bj+9Yll5YjyqyhKV6gfc0Pg7aF2hh3n2+ONBflGUtRD?= =?iso-8859-1?Q?hSFmgpyzS2hTBcCXV2862Dg9mCmiaPo0a6P/6u/X++25UWRYIL/iWLY/W8?= =?iso-8859-1?Q?uNy5wJEAo1NzDNoqcL/wMebsyu9zcuCOdC8ZVZ2NRFJPwDjyM6eprRRtlk?= =?iso-8859-1?Q?p0Vp3J+m/5trsn8MM9mjY1ZFXL8zPLDip97rVNRAZsHpGAlQojeaXRYW2T?= =?iso-8859-1?Q?PeFyamituGG/tdkkJ6ZNsAB61ODi732mP1Jrj3BX9eByA8P8zU5iNAoSrY?= =?iso-8859-1?Q?/G4L83P/vassamJuLT42/lgodOWNgEAH8z4FG0vrEGKU+dPMSgDgyqEkz0?= =?iso-8859-1?Q?VJSoa+wO3QdL6cohIIEoRjjIGyCJ7mHpDENbgQ4SBhyO4FOr59nTzzWgRm?= =?iso-8859-1?Q?QLtY6RpjHMfnXAg0E5sXMjpmBdNPpqCCRZMdzPUoa54DZaxN0y0W3EXCX/?= =?iso-8859-1?Q?4aVBQheIBIB6D/9SXLfyQ3e+X2WHxOzvYa2q1I9QpKkpsGG97H/VuI5ltC?= =?iso-8859-1?Q?boxstW/cb4uqGcUf3Pw750bD+UdprqcuBGB5UVy76a4vjXiuQjIyp57fu/?= =?iso-8859-1?Q?oRw+HyNlzo/iH+j1DAvcJYV90BI10Taf3rhGB9ombEvaavcVi3/B2wKNRW?= =?iso-8859-1?Q?TdCDjmio6BUl2F5AovwU82D7pDc5WKr8ttSlA0ePzw423IwG7uqkQjwZAy?= =?iso-8859-1?Q?jNbqSf9qFkh7hobVrjAlTgZ9TgFyZcTcWXTt7jCQc7ZbYHZGJMMT/wdGi/?= =?iso-8859-1?Q?/9QGfqNq/2OWbx75HuGzoljERanv2/HcOLeDxQIHPfv7pqYL/sKfHXzetW?= =?iso-8859-1?Q?fWgBZMd2lzfGLAsqzcqRhI12yccer0tVG/SE5EziTzGZYsF9uzN1u3VA38?= =?iso-8859-1?Q?DmLh8eT7LH3BMP5IAs9LSoKKqfMrKnwpswIqfXYL2qjDCB2o57n1BUB+go?= =?iso-8859-1?Q?tzAY69fd7p2Ja4hX7kS6iUAmGdfUvKo2UuvxDw/mYLyDErogJ/P6PUqF69?= =?iso-8859-1?Q?tCzbpkK13JZOCgXMxB395FGGkuHfx9TlgKMGA0ouqe40kkRTUA8VcL1AQJ?= =?iso-8859-1?Q?q7VWfFr6YxI9FujzcHC6mHi59d4UyNveZrPJntNGz0C70nASSdlHYMAIXt?= =?iso-8859-1?Q?KaFuwVKmcMZh2L3ab2s3heppyIeriG7ADCaHsAP/1JWjruAByk4xTwpeOm?= =?iso-8859-1?Q?qZhafzQSuRS5xzaTJA4ORucqoC7zcKN3FNtjkmBR7vMWsXbkLELlMUTifX?= =?iso-8859-1?Q?gOugjbmsttkIPmt8me77A7LjQ9Dhn9QhX2VwscQvTpbNppAUphKowpRgsM?= =?iso-8859-1?Q?nsSsh9XqTGdF/PMTXwFNb/pv/0lIq5EYa55kFrG0GtlSk2L1B1qKAahCEu?= =?iso-8859-1?Q?7CGEG2erjKR8aTFD+0wxVJmsoNsKCMYPkQZc7WiW5TcwyK8xrXemYjmtv/?= =?iso-8859-1?Q?P8xNHPbUmgjEkwuefkuCQNaa0XOXbG47BZRHhAOyMmIi4CSCBYf7CB0L5U?= =?iso-8859-1?Q?AjPv4aoX9pRKW38/ujir1pjgNrf4sBpxBjZ9CrUaVlykQe6uPZ89L8flRt?= =?iso-8859-1?Q?5nmbigiSzPeP/4wN9bUpa0VTYEQBkxJMh/NIZDStEf2zaP2JvX/ZTVklGY?= =?iso-8859-1?Q?KQFDqPUoeQ=3D=3D?= Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-OriginatorOrg: transsion.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SE3PR04MB8921.apcprd04.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c069ead9-f3c7-413d-ed0a-08dee703d93b X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Jul 2026 08:41:24.8413 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 2e8503a6-2d01-4333-8e36-6ab7c8cd7ae2 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: F5Pafdg48kkoqCbXxUWM4cRXkILe23sGTISZaiLxPzK/LW+IMBv9RscvhrfV70pXGkuC30LRl2QXf7mFm5oibg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI4PR04MB9377 Content-Type: text/plain; charset="utf-8" From: Ao Sun The child RPMB device holds a reference to its parent, so the parent's release callback cannot be invoked if the child device is still registered. Remove the rpmb_dev_unregister() from the parent release handler, and unregister the child RPMB device ahead of the parent device in the remove path. Memory for struct ufs_rpmb_dev is allocated via kzalloc_obj(), and free it from the device release callback, following the same pattern as MMC RPMB. Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL pointer dereference in the device teardown path if ufs_rpmb_probe() fails. Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260714064356.CF7101F000E9@smtp.kernel= .org/ Signed-off-by: Jiazi Li Signed-off-by: Ao Sun --- Changes in v3: - switch devm_kzalloc() to kzalloc_obj() - init rpmbs list in ufshcd --- Changes in v2: - drop the release callback - init rpmbs list early --- drivers/ufs/core/ufs-rpmb.c | 8 ++++---- drivers/ufs/core/ufshcd.c | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c index ffad049872b9..cfd1f074d004 100644 --- a/drivers/ufs/core/ufs-rpmb.c +++ b/drivers/ufs/core/ufs-rpmb.c @@ -128,7 +128,7 @@ static void ufs_rpmb_device_release(struct device *dev) { struct ufs_rpmb_dev *ufs_rpmb =3D dev_get_drvdata(dev); =20 - rpmb_dev_unregister(ufs_rpmb->rdev); + kfree(ufs_rpmb); } =20 /* UFS RPMB device registration */ @@ -152,8 +152,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba) return -EINVAL; } =20 - INIT_LIST_HEAD(&hba->rpmbs); - struct rpmb_descr descr =3D { .type =3D RPMB_TYPE_UFS, .route_frames =3D ufs_rpmb_route_frames, @@ -165,7 +163,7 @@ int ufs_rpmb_probe(struct ufs_hba *hba) if (!cap) continue; =20 - ufs_rpmb =3D devm_kzalloc(hba->dev, sizeof(*ufs_rpmb), GFP_KERNEL); + ufs_rpmb =3D kzalloc_obj(*ufs_rpmb); if (!ufs_rpmb) { ret =3D -ENOMEM; goto err_out; @@ -224,6 +222,7 @@ int ufs_rpmb_probe(struct ufs_hba *hba) kfree(cid); list_for_each_entry_safe(it, tmp, &hba->rpmbs, node) { list_del(&it->node); + rpmb_dev_unregister(it->rdev); device_unregister(&it->dev); } =20 @@ -244,6 +243,7 @@ void ufs_rpmb_remove(struct ufs_hba *hba) /* Remove from list first */ list_del(&ufs_rpmb->node); /* Unregister device */ + rpmb_dev_unregister(ufs_rpmb->rdev); device_unregister(&ufs_rpmb->dev); } =20 diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index d3044a3089b5..60227069db06 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -10988,6 +10988,7 @@ int ufshcd_alloc_host(struct device *dev, struct uf= s_hba **hba_handle) hba->nop_out_timeout =3D NOP_OUT_TIMEOUT; ufshcd_set_sg_entry_size(hba, sizeof(struct ufshcd_sg_entry)); INIT_LIST_HEAD(&hba->clk_list_head); + INIT_LIST_HEAD(&hba->rpmbs); spin_lock_init(&hba->outstanding_lock); =20 *hba_handle =3D hba; --=20 2.34.1