From nobody Fri Sep 25 17:43:30 2026 Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F3E22AD0C for ; Thu, 10 Sep 2026 01:55:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789005312; cv=none; b=rBSjxy/NdSGSXR3iUfSWCxktgPKZsoGObuEW4XwEPxCnrK0CKx9EKYUjrd5/U7jPIT3Y5zWdq059M8udkI2ikV29CyhBfi1n7oPqqsaYw1NE54q9/tf5mXQarKaJnM7socwCqFAhQ5EUGL+R/D8GeXTJxecQu9dGVxuB+o1N7fQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789005312; c=relaxed/simple; bh=ESP5vcfHg5EQaCQZksyCAA5yYo0vvPVNjjiY5EjrX4E=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=eU3BA/PifPvN6G7mgFLPtiIoV/cWAEz13iGcMv/JVTua1wR9yExokIyk0kjSv/9JMtl19DqvqYZ8SMazTurYCq5HwJl0Q7uFw7h7Bgt0nDDFdoW4CXojTw41MS0gY4+znp9pT20T119HEpy0Uemm0GshklpFR/NogXLzpDXNT40= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--stanleyjhu.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=jHGi9pv5; arc=none smtp.client-ip=209.85.215.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--stanleyjhu.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="jHGi9pv5" Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cc1bbd7d6e6so6882873a12.3 for ; Wed, 09 Sep 2026 18:55:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1789005308; x=1789610108; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ET5/GbgiiB4Lp6CLcqQ3B6Zkpa2YVFmls1cNjryflLY=; b=jHGi9pv5SlFq/J2YOpNxkr0nJ2/t1eLBwFJ5bGsVjJSXUh1wgDbSAiOAD+Y433yMkT xitMqWMT8ZI7egzvIbVFgM1i3p3lMwdjasA0rktxAbSMx0rwQ+Qd3UJKjCmGf+awU2iM pazsWQWy9YrZFMGriwH+1VMoWEu4wifiTvpYwRQ14Li0Ymu2FeFF2lWFIcLBm71YOox/ eKALELdrLi+N4jYaruM6YdIeC6wDkxES43F7UwR2MCndp2gBCm7AUCo7g7zZKXTZwBxE Hrdg4b3MUxu+BW+Ee+XrAtsKDGiGrenaLZeV99kePXV9+wG0leCXJfcbxR05oLYFvtQt MNwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1789005308; x=1789610108; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ET5/GbgiiB4Lp6CLcqQ3B6Zkpa2YVFmls1cNjryflLY=; b=I5U+agxUZjffabDbkF5yZK1bY4V1Y+Y2rDADnZ6pzswUTeH2LrVtTL09IJqHlX2Yux BAFexRTRDT63IDUrVXgRGlCfHkMalf8hIfdzQ1/BOG5KG//h+V6bauIMFK04/N1IFzt8 DhlVYiKw9IW0ZbsMj8KnYoFJDm8bBc7p9py3XpemPQ6+tqpt6DLVgsbQ3UqofPOirgwG aswZ5mM7dIKVk7ZVDEjVgkMyZGaqtLmqLgQD+ti4lnw6RLY9GAN7dLJYUruzKTuEo+TP 6ifDb6XaBeI/ScfgPYZd0oOMYXdN/TndSIPcCepe2d/YVJ8v60x05qtO8ejfyvKcSe9R PezQ== X-Forwarded-Encrypted: i=1; AKwUvBzy9hGA6qfaVO/qO/8yetjVVbTDFAfIS5ZALftNYNimdFt/r0qBOT6S6BCkzgNtYHBrUEJXKXKKJPh7IXY=@vger.kernel.org X-Gm-Message-State: AFuF++nVcLs4uy+gcq66bObGHDjvLLiN4z3GTIYWGCRapH6AArzd0vvt VP5oxbU2iIitaJesSMaHkZblAyQ/OSyHKWwo/768lZOk01+PPO/VqoKJvrmz9gc1vWYSIzYMLJ2 2nc0kfbIYWBVeODwNu39p2g== X-Received: from pjte17.prod.google.com ([2002:a17:90a:c211:b0:39d:7360:f8d9]) (user=stanleyjhu job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:1641:b0:399:1f8b:d255 with SMTP id 98e67ed59e1d1-39b260dd3fdmr55287009a91.5.1789005307303; Wed, 09 Sep 2026 18:55:07 -0700 (PDT) Date: Thu, 10 Sep 2026 09:55:02 +0800 In-Reply-To: <20260910015503.1991119-1-stanleyjhu@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260910015503.1991119-1-stanleyjhu@google.com> X-Mailer: git-send-email 2.55.0.1007.g17ff1f9808-goog Message-ID: <20260910015503.1991119-2-stanleyjhu@google.com> Subject: [PATCH v3 1/2] scsi: ufs: rpmb: Register and unregister ufs_rpmb_bus_type From: Stanley Jhu To: "Martin K . Petersen" , "James E . J . Bottomley" , linux-scsi@vger.kernel.org Cc: Brian Kao , Bean Huo , Bart Van Assche , Alim Akhtar , Avri Altman , Peter Wang , Can Guo , Li Qiang , Ao Sun , linux-kernel@vger.kernel.org, Stanley Jhu Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The UFS RPMB driver defines ufs_rpmb_bus_type and assigns it to the bus member of struct device for each RPMB device. However, ufs_rpmb_bus_type is never registered with the driver core via bus_register(). When driver core rejects devices assigned to unregistered buses with -EINVAL in bus_add_device(), device_register(&ufs_rpmb->dev) in ufs_rpmb_probe() fails with: "bus_add_device: cannot add device 'ufs_rpmb0' to unregistered bus 'ufs_rpmb'" "ufshcd: Failed to register UFS RPMB device 0" Fix this by registering ufs_rpmb_bus_type during UFS core initialization in ufshcd_core_init() and unregistering it in ufshcd_core_exit(). Add helper functions ufs_rpmb_bus_register() and ufs_rpmb_bus_unregister(), guarding their declarations with IS_REACHABLE(CONFIG_RPMB) and inline fallback stubs for configurations where CONFIG_RPMB is disabled. Mark ufs_rpmb_bus_register() as __init so its memory can be reclaimed after module initialization. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS= devices") Signed-off-by: Stanley Jhu --- drivers/ufs/core/ufs-rpmb.c | 10 ++++++++++ drivers/ufs/core/ufshcd-priv.h | 13 ++++++++++++- drivers/ufs/core/ufshcd.c | 16 ++++++++++++++-- 3 files changed, 36 insertions(+), 3 deletions(-) diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c index aa925cbb07e8..c7aade96c823 100644 --- a/drivers/ufs/core/ufs-rpmb.c +++ b/drivers/ufs/core/ufs-rpmb.c @@ -28,6 +28,16 @@ static const struct bus_type ufs_rpmb_bus_type =3D { .name =3D "ufs_rpmb", }; =20 +int __init ufs_rpmb_bus_register(void) +{ + return bus_register(&ufs_rpmb_bus_type); +} + +void ufs_rpmb_bus_unregister(void) +{ + bus_unregister(&ufs_rpmb_bus_type); +} + /* UFS RPMB device structure */ struct ufs_rpmb_dev { u8 region_id; diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h index e55c2a02c1f5..d5e0cc3edb5b 100644 --- a/drivers/ufs/core/ufshcd-priv.h +++ b/drivers/ufs/core/ufshcd-priv.h @@ -493,10 +493,21 @@ static inline u32 ufshcd_mcq_get_sq_head_slot(struct = ufs_hw_queue *q) return val / sizeof(struct utp_transfer_req_desc); } =20 -#if IS_ENABLED(CONFIG_RPMB) +#if IS_REACHABLE(CONFIG_RPMB) +int __init ufs_rpmb_bus_register(void); +void ufs_rpmb_bus_unregister(void); int ufs_rpmb_probe(struct ufs_hba *hba); void ufs_rpmb_remove(struct ufs_hba *hba); #else +static inline int ufs_rpmb_bus_register(void) +{ + return 0; +} + +static inline void ufs_rpmb_bus_unregister(void) +{ +} + static inline int ufs_rpmb_probe(struct ufs_hba *hba) { return 0; diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index a25b6a0cb5c6..4470e3d65c5c 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -11584,16 +11584,28 @@ static int __init ufshcd_core_init(void) =20 ufs_debugfs_init(); =20 + ret =3D ufs_rpmb_bus_register(); + if (ret) + goto err_debugfs; + ret =3D scsi_register_driver(&ufs_dev_wlun_template); if (ret) - ufs_debugfs_exit(); + goto err_rpmb_bus; + + return 0; + +err_rpmb_bus: + ufs_rpmb_bus_unregister(); +err_debugfs: + ufs_debugfs_exit(); return ret; } =20 static void __exit ufshcd_core_exit(void) { - ufs_debugfs_exit(); scsi_unregister_driver(&ufs_dev_wlun_template); + ufs_rpmb_bus_unregister(); + ufs_debugfs_exit(); } =20 module_init(ufshcd_core_init); --=20 2.55.0.1007.g17ff1f9808-goog From nobody Fri Sep 25 17:43:30 2026 Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C3813644C5 for ; Thu, 10 Sep 2026 01:55:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789005317; cv=none; b=pF6F30sPFxNKok8K/rhvz3CRUoxnjjeiqyfOXL9zGz6xXdi8JcxJYIT0TKdfPZZT4Ss/yL8P8s0kwxAN4Ohkgk7R4eqZe34ZSQzrVtugVkH81f6Yd6kn6XnRR/pT/mhNcvgj3BRqSdWbLmawyAf7OW0SvjQe+ZdgYFZ6DWCwmgA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789005317; c=relaxed/simple; bh=PbtTiBlCJ93wycFbEUMoaBxmCsvne/aYHArz4TGngUE=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=NigVfH1y8SwbFbO3kY07wrGsOoSb/e/kwENFHfzX7qd1DsV+6cdHRaEoQwUzuvngVjAckiY54YQuXZSmlRaItnGNuL9XOZ7RFR9bGpe4cgc72R1UaGK5+tTKR+t+5GR8uK8wzn3NF85y/WKUSkiCMoyHIND5EkBsq/TXA9AHNYM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--stanleyjhu.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=pxq5W9oV; arc=none smtp.client-ip=209.85.216.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--stanleyjhu.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="pxq5W9oV" Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-39b77130a7fso6179538a91.2 for ; Wed, 09 Sep 2026 18:55:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1789005311; x=1789610111; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=C4/am/kdLlw6Qus0zXUv5BTnGPExVekY3lTJpwF5cR8=; b=pxq5W9oVmWAVTH9bJFGkw98NyUOBXdF3rHctNuhMiAzZBHLAREtwt+DFpFh2FJW3ip 6ScCMPkZfzoGDZ1QF7mFkIrHA7Pkb0pBkaAYhvZZvPWUn9by8Y7q4ZUSjJk7qCYEf2Uw bmN8m0MB/XEZV97QdU/0D3AOGkbyUcnIp7VdowHiAqa5oeqgUwvQ/6JVOOjKgwOgfFBT ERYnLZpK21fUSslKRdSJ3Fv9U7QUjYFuDqJWyLwVhB3JA3MkZyN9TwhvPIjP6T45sJNX Ru9di/8+32Kxqf9BI14lUGycbANVFinOl9qHAmcQvs7J2BYH4aNszG18TS0VgY/+vVcA o49Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1789005311; x=1789610111; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=C4/am/kdLlw6Qus0zXUv5BTnGPExVekY3lTJpwF5cR8=; b=PJf8LAq2j17q7peoyZ/Q01ZZ6E1mSok1g2oOU5tYdTcX7s2Zp6SPxjnWGUB8lUjMaa RmjxbO1W9vxIarXNa8iTDgPzax7PHJXE/BHcijde+HAwkQxM5HSRfIvY8wi5y9qiyGri h0RvtD7CEoZ6EeTOlGUUnD/G9Q1ZG2wv/OOarq4J6xK1KuS7nnPIdhv4pSRVmARdA48Z 4LrOD6q89Aw0rdsje7hok3MTyGk/godEv+6XxSgvJxQ5jDOV1lKB6B+t+jy3wsC9Ah5M YuFxdWwfJPKthHWygQGwUjd51QRrCCCTU+B/EHgZJcXlyyNBytlv3vhravCJ2xyRKm0g rmvw== X-Forwarded-Encrypted: i=1; AKwUvBw50uuaSnw718Gyx1Tvzg7ZgYJoFG8MTBHN/91nt0Ipceb11NwHh55tmfdig0/Y/uFRIYY3q+rojjUPlpo=@vger.kernel.org X-Gm-Message-State: AFuF++lnKS6fhYNX5ne83XEMTCR/0JEtgzqfkxIH7WQmjiIWkexrqccK QWDIm0+vub6WRIs2tASpqUotR7VJx8+ljXJOXCv2agVUX169nahkOPZEQHa5GWgYsLIm6Vye8Id WXhqH7LtcMAwJNPwwr4lMZA== X-Received: from pjqo8.prod.google.com ([2002:a17:90a:ac08:b0:39b:4704:7c5c]) (user=stanleyjhu job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:5905:b0:398:9bd5:490b with SMTP id 98e67ed59e1d1-39b262133ccmr55053877a91.18.1789005309361; Wed, 09 Sep 2026 18:55:09 -0700 (PDT) Date: Thu, 10 Sep 2026 09:55:03 +0800 In-Reply-To: <20260910015503.1991119-1-stanleyjhu@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260910015503.1991119-1-stanleyjhu@google.com> X-Mailer: git-send-email 2.55.0.1007.g17ff1f9808-goog Message-ID: <20260910015503.1991119-3-stanleyjhu@google.com> Subject: [PATCH v3 2/2] scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF From: Stanley Jhu To: "Martin K . Petersen" , "James E . J . Bottomley" , linux-scsi@vger.kernel.org Cc: Brian Kao , Bean Huo , Bart Van Assche , Alim Akhtar , Avri Altman , Peter Wang , Can Guo , Li Qiang , Ao Sun , linux-kernel@vger.kernel.org, Stanley Jhu , stable@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" struct ufs_rpmb_dev embeds struct device, but is allocated using devm_kzalloc() tied to the host controller (hba->dev). When the host controller unbinds, devres automatically frees ufs_rpmb regardless of active references to ufs_rpmb->dev (such as sysfs users or child devices). Subsequent access to ufs_rpmb->dev triggers a Use-After-Free (UAF) kernel Oops. Fix this lifetime defect: - Allocate ufs_rpmb with kzalloc_obj() and free it in ufs_rpmb_device_release() via kfree(), strictly tying memory lifetime to the device reference count. - Pin the underlying SCSI WLUN via scsi_device_get() in probe and release it with scsi_device_put() in device_release. - Call rpmb_dev_unregister() in ufs_rpmb_remove() and probe error unwind before device_unregister(). - Check scsi_device_online() before submitting security commands. Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS= devices") Signed-off-by: Stanley Jhu Cc: stable@vger.kernel.org --- drivers/ufs/core/ufs-rpmb.c | 97 +++++++++++++++++++++---------------- 1 file changed, 55 insertions(+), 42 deletions(-) diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c index c7aade96c823..33b9a4a1b120 100644 --- a/drivers/ufs/core/ufs-rpmb.c +++ b/drivers/ufs/core/ufs-rpmb.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -43,15 +44,19 @@ struct ufs_rpmb_dev { u8 region_id; struct device dev; struct rpmb_dev *rdev; - struct ufs_hba *hba; + struct scsi_device *sdev; struct list_head node; }; =20 -static int ufs_sec_submit(struct ufs_hba *hba, u16 spsp, void *buffer, siz= e_t len, bool send) +static int ufs_sec_submit(struct ufs_rpmb_dev *ufs_rpmb, u16 spsp, + void *buffer, size_t len, bool send) { - struct scsi_device *sdev =3D hba->ufs_rpmb_wlun; + struct scsi_device *sdev =3D ufs_rpmb->sdev; u8 cdb[12] =3D { }; =20 + if (!sdev || !scsi_device_online(sdev)) + return -ENODEV; + cdb[0] =3D send ? SECURITY_PROTOCOL_OUT : SECURITY_PROTOCOL_IN; cdb[1] =3D UFS_RPMB_SEC_PROTOCOL; put_unaligned_be16(spsp, &cdb[2]); @@ -63,13 +68,12 @@ static int ufs_sec_submit(struct ufs_hba *hba, u16 spsp= , void *buffer, size_t le =20 /* UFS RPMB route frames implementation */ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int= req_len, u8 *resp, - unsigned int resp_len) + unsigned int resp_len) { struct ufs_rpmb_dev *ufs_rpmb =3D dev_get_drvdata(dev); struct rpmb_frame *frm_out =3D (struct rpmb_frame *)req; bool need_result_read =3D true; u16 req_type, protocol_id; - struct ufs_hba *hba; int ret; =20 if (!ufs_rpmb) { @@ -77,8 +81,6 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *= req, unsigned int req_l return -ENODEV; } =20 - hba =3D ufs_rpmb->hba; - /* req_resp is at the end of an RPMB frame. */ if (req_len < sizeof(*frm_out)) return -EINVAL; @@ -111,7 +113,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8= *req, unsigned int req_l =20 protocol_id =3D ufs_rpmb->region_id << 8 | UFS_RPMB_SEC_PROTOCOL_ID; =20 - ret =3D ufs_sec_submit(hba, protocol_id, req, req_len, true); + ret =3D ufs_sec_submit(ufs_rpmb, protocol_id, req, req_len, true); if (ret) { dev_err(dev, "Command failed with ret=3D%d\n", ret); return ret; @@ -122,7 +124,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8= *req, unsigned int req_l =20 memset(frm_resp, 0, sizeof(*frm_resp)); put_unaligned_be16(RPMB_RESULT_READ, &frm_resp->req_resp); - ret =3D ufs_sec_submit(hba, protocol_id, resp, resp_len, true); + ret =3D ufs_sec_submit(ufs_rpmb, protocol_id, resp, resp_len, true); if (ret) { dev_err(dev, "Result read request failed with ret=3D%d\n", ret); return ret; @@ -130,7 +132,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8= *req, unsigned int req_l } =20 if (!ret) { - ret =3D ufs_sec_submit(hba, protocol_id, resp, resp_len, false); + ret =3D ufs_sec_submit(ufs_rpmb, protocol_id, resp, resp_len, false); if (ret) dev_err(dev, "Response read failed with ret=3D%d\n", ret); } @@ -140,22 +142,29 @@ static int ufs_rpmb_route_frames(struct device *dev, = u8 *req, unsigned int req_l =20 static void ufs_rpmb_device_release(struct device *dev) { - struct ufs_rpmb_dev *ufs_rpmb =3D dev_get_drvdata(dev); + struct ufs_rpmb_dev *ufs_rpmb =3D container_of(dev, struct ufs_rpmb_dev, = dev); =20 - rpmb_dev_unregister(ufs_rpmb->rdev); + scsi_device_put(ufs_rpmb->sdev); + kfree(ufs_rpmb); } =20 /* UFS RPMB device registration */ int ufs_rpmb_probe(struct ufs_hba *hba) { + struct rpmb_descr descr =3D { + .type =3D RPMB_TYPE_UFS, + .route_frames =3D ufs_rpmb_route_frames, + .reliable_wr_count =3D hba->dev_info.rpmb_io_size, + }; + struct scsi_device *sdev =3D hba->ufs_rpmb_wlun; struct ufs_rpmb_dev *ufs_rpmb, *it, *tmp; struct rpmb_dev *rdev; - char *cid =3D NULL; + char *cid; int region; u32 cap; int ret; =20 - if (!hba->ufs_rpmb_wlun || hba->dev_info.b_advanced_rpmb_en) { + if (!sdev || hba->dev_info.b_advanced_rpmb_en) { dev_info(hba->dev, "Skip OP-TEE RPMB registration\n"); return -ENODEV; } @@ -166,25 +175,28 @@ int ufs_rpmb_probe(struct ufs_hba *hba) return -EINVAL; } =20 - struct rpmb_descr descr =3D { - .type =3D RPMB_TYPE_UFS, - .route_frames =3D ufs_rpmb_route_frames, - .reliable_wr_count =3D hba->dev_info.rpmb_io_size, - }; - for (region =3D 0; region < ARRAY_SIZE(hba->dev_info.rpmb_region_size); r= egion++) { cap =3D hba->dev_info.rpmb_region_size[region]; if (!cap) continue; =20 - ufs_rpmb =3D devm_kzalloc(hba->dev, sizeof(*ufs_rpmb), GFP_KERNEL); + ufs_rpmb =3D kzalloc_obj(*ufs_rpmb); if (!ufs_rpmb) { ret =3D -ENOMEM; goto err_out; } =20 - ufs_rpmb->hba =3D hba; - ufs_rpmb->dev.parent =3D &hba->ufs_rpmb_wlun->sdev_gendev; + INIT_LIST_HEAD(&ufs_rpmb->node); + + ret =3D scsi_device_get(sdev); + if (ret) { + kfree(ufs_rpmb); + goto err_out; + } + + ufs_rpmb->sdev =3D sdev; + ufs_rpmb->region_id =3D region; + ufs_rpmb->dev.parent =3D &sdev->sdev_gendev; ufs_rpmb->dev.bus =3D &ufs_rpmb_bus_type; ufs_rpmb->dev.release =3D ufs_rpmb_device_release; dev_set_name(&ufs_rpmb->dev, "ufs_rpmb%d", region); @@ -195,16 +207,14 @@ int ufs_rpmb_probe(struct ufs_hba *hba) ret =3D device_register(&ufs_rpmb->dev); if (ret) { dev_err(hba->dev, "Failed to register UFS RPMB device %d\n", region); - put_device(&ufs_rpmb->dev); - goto err_out; + goto err_put; } =20 /* Create unique ID by appending region number to device_id */ cid =3D kasprintf(GFP_KERNEL, "%s-R%d", hba->dev_info.device_id, region); if (!cid) { - device_unregister(&ufs_rpmb->dev); ret =3D -ENOMEM; - goto err_out; + goto err_unreg; } =20 descr.dev_id =3D cid; @@ -213,29 +223,33 @@ int ufs_rpmb_probe(struct ufs_hba *hba) =20 /* Register RPMB device */ rdev =3D rpmb_dev_register(&ufs_rpmb->dev, &descr); + kfree(cid); if (IS_ERR(rdev)) { dev_err(hba->dev, "Failed to register UFS RPMB device.\n"); - device_unregister(&ufs_rpmb->dev); ret =3D PTR_ERR(rdev); - goto err_out; + goto err_unreg; } =20 - kfree(cid); - cid =3D NULL; - ufs_rpmb->rdev =3D rdev; - ufs_rpmb->region_id =3D region; - list_add_tail(&ufs_rpmb->node, &hba->rpmbs); =20 dev_info(hba->dev, "UFS RPMB region %d registered (capacity=3D%u)\n", re= gion, cap); } =20 return 0; + +err_unreg: + device_unregister(&ufs_rpmb->dev); + goto err_out; +err_put: + put_device(&ufs_rpmb->dev); err_out: - kfree(cid); list_for_each_entry_safe(it, tmp, &hba->rpmbs, node) { - list_del(&it->node); + list_del_init(&it->node); + if (it->rdev) { + rpmb_dev_unregister(it->rdev); + it->rdev =3D NULL; + } device_unregister(&it->dev); } =20 @@ -252,14 +266,13 @@ void ufs_rpmb_remove(struct ufs_hba *hba) =20 /* Remove all registered RPMB devices */ list_for_each_entry_safe(ufs_rpmb, tmp, &hba->rpmbs, node) { - dev_info(hba->dev, "Removing UFS RPMB region %d\n", ufs_rpmb->region_id); - /* Remove from list first */ - list_del(&ufs_rpmb->node); - /* Unregister device */ + list_del_init(&ufs_rpmb->node); + if (ufs_rpmb->rdev) { + rpmb_dev_unregister(ufs_rpmb->rdev); + ufs_rpmb->rdev =3D NULL; + } device_unregister(&ufs_rpmb->dev); } - - dev_info(hba->dev, "All UFS RPMB devices unregistered\n"); } =20 MODULE_LICENSE("GPL v2"); --=20 2.55.0.1007.g17ff1f9808-goog