[PATCH] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

[PATCH] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

[Ao Sun]

From: Ao Sun <ao.sun@transsion.com>

Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL
pointer dereference in the device teardown path if ufs_rpmb_probe()
fails.

Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Signed-off-by: Jiazi Li <jiazi.li@transsion.com>
Signed-off-by: Ao Sun <ao.sun@transsion.com>
---
 drivers/ufs/core/ufs-rpmb.c | 2 --
 drivers/ufs/core/ufshcd.c   | 1 +
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index ffad049872b9..62120dc2e9da 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -152,8 +152,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
 		return -EINVAL;
 	}
 
-	INIT_LIST_HEAD(&hba->rpmbs);
-
 	struct rpmb_descr descr = {
 		.type = RPMB_TYPE_UFS,
 		.route_frames = ufs_rpmb_route_frames,
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index d3044a3089b5..60227069db06 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -10988,6 +10988,7 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
 	hba->nop_out_timeout = NOP_OUT_TIMEOUT;
 	ufshcd_set_sg_entry_size(hba, sizeof(struct ufshcd_sg_entry));
 	INIT_LIST_HEAD(&hba->clk_list_head);
+	INIT_LIST_HEAD(&hba->rpmbs);
 	spin_lock_init(&hba->outstanding_lock);
 
 	*hba_handle = hba;
-- 
2.34.1

Re: [PATCH] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but a circular dependency between the parent UFS RPMB device and its child RPMB device prevents both from being unregistered and freed.
- [High] This problem wasn't introduced by this patch, but the `struct ufs_rpmb_dev` embeds a `struct device` and is incorrectly allocated using `devm_kzalloc()`, violating the Linux device model and risking a Use-After-Free on unbind.
--

--- Patch [1]: [PATCH] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd ---
commit b69c44ec9068da0584fce2f43d2e235ffbfe2675
Author: Ao Sun <ao.sun@transsion.com>

scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
    
Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL
pointer dereference in the device teardown path if ufs_rpmb_probe()
fails.

> diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
> index ffad049872b9a..62120dc2e9da7 100644
> --- a/drivers/ufs/core/ufs-rpmb.c
> +++ b/drivers/ufs/core/ufs-rpmb.c
> @@ -152,8 +152,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
>  		return -EINVAL;
>  	}
>  
> -	INIT_LIST_HEAD(&hba->rpmbs);
> -

[Severity: High]
This isn't a bug introduced by this patch, but is it safe to allocate
ufs_rpmb using devm_kzalloc() when it embeds a struct device?

The ufs_rpmb structure is tied to the host device's devres lifecycle:

ufs_rpmb_probe() {
        ...
        ufs_rpmb = devm_kzalloc(hba->dev, sizeof(*ufs_rpmb), GFP_KERNEL);
        ...
}

When the host controller unbinds, devres will free this memory. However,
if a userspace process holds an open file descriptor to the sysfs
attributes of ufs_rpmb->dev, the kobject reference count remains elevated.

When userspace later closes the file, the driver core will drop the final
reference and invoke ufs_rpmb_device_release(), which will access the
already-freed ufs_rpmb_dev structure.

Could this result in a use-after-free on unbind?


[Severity: High]
This isn't a bug introduced by this patch, but does the error path in
ufs_rpmb_probe() fully clean up the registered RPMB devices?

If device_unregister() is called on ufs_rpmb->dev during probe error or
unbind, the parent device is unregistered. However, rpmb_dev_register()
creates a child device that holds a reference to this parent.

Because the child holds a reference, the parent's reference count will
not drop to zero, preventing its release callback from ever running:

ufs_rpmb_device_release() {
        ...
        rpmb_dev_unregister(ufs_rpmb->rdev);
        ...
}

Since rpmb_dev_unregister() is called inside that release callback, neither
device gets fully unregistered.

Does this create a circular dependency that leaks device structures and
sysfs entries?

>  	struct rpmb_descr descr = {
>  		.type = RPMB_TYPE_UFS,
>  		.route_frames = ufs_rpmb_route_frames,

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723034440.217-1-ao.sun@transsion.com?part=1

Re: [PATCH] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

[Bean Huo]

On Thu, 2026-07-23 at 03:45 +0000, Ao Sun wrote:
> From: Ao Sun <ao.sun@transsion.com>
> 
> Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL
> pointer dereference in the device teardown path if ufs_rpmb_probe()
> fails.
> 
> Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS
> devices")
> Signed-off-by: Jiazi Li <jiazi.li@transsion.com>
> Signed-off-by: Ao Sun <ao.sun@transsion.com>
> ---
>  drivers/ufs/core/ufs-rpmb.c | 2 --
>  drivers/ufs/core/ufshcd.c   | 1 +
>  2 files changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
> index ffad049872b9..62120dc2e9da 100644
> --- a/drivers/ufs/core/ufs-rpmb.c
> +++ b/drivers/ufs/core/ufs-rpmb.c
> @@ -152,8 +152,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
>                 return -EINVAL;
>         }
>  
> -       INIT_LIST_HEAD(&hba->rpmbs);
> -
>         struct rpmb_descr descr = {
>                 .type = RPMB_TYPE_UFS,
>                 .route_frames = ufs_rpmb_route_frames,
> diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
> index d3044a3089b5..60227069db06 100644
> --- a/drivers/ufs/core/ufshcd.c
> +++ b/drivers/ufs/core/ufshcd.c
> @@ -10988,6 +10988,7 @@ int ufshcd_alloc_host(struct device *dev, struct
> ufs_hba **hba_handle)
>         hba->nop_out_timeout = NOP_OUT_TIMEOUT;
>         ufshcd_set_sg_entry_size(hba, sizeof(struct ufshcd_sg_entry));
>         INIT_LIST_HEAD(&hba->clk_list_head);
> +       INIT_LIST_HEAD(&hba->rpmbs);
>         spin_lock_init(&hba->outstanding_lock);
>  
>         *hba_handle = hba;


Thanks for splitting this out, this is much easier to reason about.

For the two lifetime issues Sashiko reported (the container/rdev circular
reference and the devm_kzalloc() ownership), both are real but pre-existing and
independent of this fix. Let's keep this patch focused on the NULL deref and
handle those in the teardown-order series, this one can go in on its own.

Reviewed-by: Bean Huo <beanhuo@micron.com>

Kind regards,
Bean

Re: [PATCH] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

[Martin K. Petersen]

On Thu, 23 Jul 2026 03:45:30 +0000, Ao Sun wrote:

> Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL
> pointer dereference in the device teardown path if ufs_rpmb_probe()
> fails.
> 
> 

Applied to 7.2/scsi-fixes, thanks!

[1/1] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd
      https://git.kernel.org/mkp/scsi/c/0279fd451a99

-- 
Martin K. Petersen