From: Stanley Jhu <stanleyjhu@google.com>
To: "Martin K . Petersen" <mkp@kernel.org>,
"James E . J . Bottomley"
<James.Bottomley@HansenPartnership.com>,
linux-scsi@vger.kernel.org
Cc: Brian Kao <powenkao@google.com>, Bean Huo <beanhuo@micron.com>,
Bart Van Assche <bvanassche@acm.org>,
Alim Akhtar <alim.akhtar@samsung.com>,
Avri Altman <avri.altman@sandisk.com>,
Can Guo <can.guo@oss.qualcomm.com>,
Peter Wang <peter.wang@mediatek.com>,
linux-kernel@vger.kernel.org,
Stanley Jhu <stanleyjhu@google.com>
Subject: [PATCH 2/2] scsi: ufs: rpmb: Register and unregister ufs_rpmb_bus_type
Date: Fri, 4 Sep 2026 19:00:17 +0800 [thread overview]
Message-ID: <20260904110017.3444852-3-stanleyjhu@google.com> (raw)
In-Reply-To: <20260904110017.3444852-1-stanleyjhu@google.com>
The UFS RPMB driver assigns its devices to a custom ufs_rpmb_bus_type,
but never registers this bus with the driver core. As a result,
device_register() fails during probe because the driver core rejects
devices attached to unregistered buses with -EINVAL:
"bus_add_device: cannot add device 'ufs_rpmb0' to unregistered bus
'ufs_rpmb'"
"ufshcd: Failed to register UFS RPMB device 0"
Resolve this by integrating the bus into the UFS core lifecycle:
1. Bus registration and lifecycle:
Register ufs_rpmb_bus_type during ufshcd_core_init() before any
device probe occurs, and unregister it during ufshcd_core_exit().
Annotate the registration helper with __init to allow init memory
reclamation.
2. Modular reachability:
Guard bus helper prototypes with IS_REACHABLE(CONFIG_RPMB) and provide
inline stubs, preventing link failures when UFS is built-in and RPMB
is compiled as a module.
Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
drivers/ufs/core/ufs-rpmb.c | 10 ++++++++++
drivers/ufs/core/ufshcd-priv.h | 11 ++++++++++-
drivers/ufs/core/ufshcd.c | 16 ++++++++++++++--
3 files changed, 34 insertions(+), 3 deletions(-)
diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index 4f41d0b64d20..cf8982824b14 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -29,6 +29,16 @@ static const struct bus_type ufs_rpmb_bus_type = {
.name = "ufs_rpmb",
};
+int __init ufs_rpmb_bus_register(void)
+{
+ return bus_register(&ufs_rpmb_bus_type);
+}
+
+void ufs_rpmb_bus_unregister(void)
+{
+ bus_unregister(&ufs_rpmb_bus_type);
+}
+
/* UFS RPMB device structure */
struct ufs_rpmb_dev {
u8 region_id;
diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h
index e55c2a02c1f5..415f9230b164 100644
--- a/drivers/ufs/core/ufshcd-priv.h
+++ b/drivers/ufs/core/ufshcd-priv.h
@@ -493,10 +493,19 @@ static inline u32 ufshcd_mcq_get_sq_head_slot(struct ufs_hw_queue *q)
return val / sizeof(struct utp_transfer_req_desc);
}
-#if IS_ENABLED(CONFIG_RPMB)
+#if IS_REACHABLE(CONFIG_RPMB)
+int __init ufs_rpmb_bus_register(void);
+void ufs_rpmb_bus_unregister(void);
int ufs_rpmb_probe(struct ufs_hba *hba);
void ufs_rpmb_remove(struct ufs_hba *hba);
#else
+static inline int ufs_rpmb_bus_register(void)
+{
+ return 0;
+}
+static inline void ufs_rpmb_bus_unregister(void)
+{
+}
static inline int ufs_rpmb_probe(struct ufs_hba *hba)
{
return 0;
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index a25b6a0cb5c6..4470e3d65c5c 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -11584,16 +11584,28 @@ static int __init ufshcd_core_init(void)
ufs_debugfs_init();
+ ret = ufs_rpmb_bus_register();
+ if (ret)
+ goto err_debugfs;
+
ret = scsi_register_driver(&ufs_dev_wlun_template);
if (ret)
- ufs_debugfs_exit();
+ goto err_rpmb_bus;
+
+ return 0;
+
+err_rpmb_bus:
+ ufs_rpmb_bus_unregister();
+err_debugfs:
+ ufs_debugfs_exit();
return ret;
}
static void __exit ufshcd_core_exit(void)
{
- ufs_debugfs_exit();
scsi_unregister_driver(&ufs_dev_wlun_template);
+ ufs_rpmb_bus_unregister();
+ ufs_debugfs_exit();
}
module_init(ufshcd_core_init);
--
2.55.0.979.g7e5102b832-goog
prev parent reply other threads:[~2026-09-04 11:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 11:00 [PATCH 0/2] scsi: ufs: rpmb: Fix device lifetime UAF and unregistered bus regression Stanley Jhu
2026-09-04 11:00 ` [PATCH 1/2] scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF Stanley Jhu
2026-09-04 11:14 ` sashiko-bot
2026-09-04 11:00 ` Stanley Jhu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904110017.3444852-3-stanleyjhu@google.com \
--to=stanleyjhu@google.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=alim.akhtar@samsung.com \
--cc=avri.altman@sandisk.com \
--cc=beanhuo@micron.com \
--cc=bvanassche@acm.org \
--cc=can.guo@oss.qualcomm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=mkp@kernel.org \
--cc=peter.wang@mediatek.com \
--cc=powenkao@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.