From: Stanley Jhu <stanleyjhu@google.com>
To: "Martin K . Petersen" <mkp@kernel.org>,
"James E . J . Bottomley"
<James.Bottomley@HansenPartnership.com>,
linux-scsi@vger.kernel.org
Cc: Brian Kao <powenkao@google.com>, Bean Huo <beanhuo@micron.com>,
Bart Van Assche <bvanassche@acm.org>,
Alim Akhtar <alim.akhtar@samsung.com>,
Avri Altman <avri.altman@sandisk.com>,
Can Guo <can.guo@oss.qualcomm.com>,
Peter Wang <peter.wang@mediatek.com>,
linux-kernel@vger.kernel.org,
Stanley Jhu <stanleyjhu@google.com>
Subject: [PATCH 2/2] scsi: ufs: rpmb: Register and unregister ufs_rpmb_bus_type
Date: Fri, 4 Sep 2026 19:00:17 +0800 [thread overview]
Message-ID: <20260904110017.3444852-3-stanleyjhu@google.com> (raw)
In-Reply-To: <20260904110017.3444852-1-stanleyjhu@google.com>
The UFS RPMB driver assigns its devices to a custom ufs_rpmb_bus_type,
but never registers this bus with the driver core. As a result,
device_register() fails during probe because the driver core rejects
devices attached to unregistered buses with -EINVAL:
"bus_add_device: cannot add device 'ufs_rpmb0' to unregistered bus
'ufs_rpmb'"
"ufshcd: Failed to register UFS RPMB device 0"
Resolve this by integrating the bus into the UFS core lifecycle:
1. Bus registration and lifecycle:
Register ufs_rpmb_bus_type during ufshcd_core_init() before any
device probe occurs, and unregister it during ufshcd_core_exit().
Annotate the registration helper with __init to allow init memory
reclamation.
2. Modular reachability:
Guard bus helper prototypes with IS_REACHABLE(CONFIG_RPMB) and provide
inline stubs, preventing link failures when UFS is built-in and RPMB
is compiled as a module.
Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
drivers/ufs/core/ufs-rpmb.c | 10 ++++++++++
drivers/ufs/core/ufshcd-priv.h | 11 ++++++++++-
drivers/ufs/core/ufshcd.c | 16 ++++++++++++++--
3 files changed, 34 insertions(+), 3 deletions(-)
diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index 4f41d0b64d20..cf8982824b14 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -29,6 +29,16 @@ static const struct bus_type ufs_rpmb_bus_type = {
.name = "ufs_rpmb",
};
+int __init ufs_rpmb_bus_register(void)
+{
+ return bus_register(&ufs_rpmb_bus_type);
+}
+
+void ufs_rpmb_bus_unregister(void)
+{
+ bus_unregister(&ufs_rpmb_bus_type);
+}
+
/* UFS RPMB device structure */
struct ufs_rpmb_dev {
u8 region_id;
diff --git a/drivers/ufs/core/ufshcd-priv.h b/drivers/ufs/core/ufshcd-priv.h
index e55c2a02c1f5..415f9230b164 100644
--- a/drivers/ufs/core/ufshcd-priv.h
+++ b/drivers/ufs/core/ufshcd-priv.h
@@ -493,10 +493,19 @@ static inline u32 ufshcd_mcq_get_sq_head_slot(struct ufs_hw_queue *q)
return val / sizeof(struct utp_transfer_req_desc);
}
-#if IS_ENABLED(CONFIG_RPMB)
+#if IS_REACHABLE(CONFIG_RPMB)
+int __init ufs_rpmb_bus_register(void);
+void ufs_rpmb_bus_unregister(void);
int ufs_rpmb_probe(struct ufs_hba *hba);
void ufs_rpmb_remove(struct ufs_hba *hba);
#else
+static inline int ufs_rpmb_bus_register(void)
+{
+ return 0;
+}
+static inline void ufs_rpmb_bus_unregister(void)
+{
+}
static inline int ufs_rpmb_probe(struct ufs_hba *hba)
{
return 0;
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index a25b6a0cb5c6..4470e3d65c5c 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -11584,16 +11584,28 @@ static int __init ufshcd_core_init(void)
ufs_debugfs_init();
+ ret = ufs_rpmb_bus_register();
+ if (ret)
+ goto err_debugfs;
+
ret = scsi_register_driver(&ufs_dev_wlun_template);
if (ret)
- ufs_debugfs_exit();
+ goto err_rpmb_bus;
+
+ return 0;
+
+err_rpmb_bus:
+ ufs_rpmb_bus_unregister();
+err_debugfs:
+ ufs_debugfs_exit();
return ret;
}
static void __exit ufshcd_core_exit(void)
{
- ufs_debugfs_exit();
scsi_unregister_driver(&ufs_dev_wlun_template);
+ ufs_rpmb_bus_unregister();
+ ufs_debugfs_exit();
}
module_init(ufshcd_core_init);
--
2.55.0.979.g7e5102b832-goog
prev parent reply other threads:[~2026-09-04 11:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 11:00 [PATCH 0/2] scsi: ufs: rpmb: Fix device lifetime UAF and unregistered bus regression Stanley Jhu
2026-09-04 11:00 ` [PATCH 1/2] scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF Stanley Jhu
2026-09-04 11:14 ` sashiko-bot
2026-09-04 11:00 ` Stanley Jhu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904110017.3444852-3-stanleyjhu@google.com \
--to=stanleyjhu@google.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=alim.akhtar@samsung.com \
--cc=avri.altman@sandisk.com \
--cc=beanhuo@micron.com \
--cc=bvanassche@acm.org \
--cc=can.guo@oss.qualcomm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=mkp@kernel.org \
--cc=peter.wang@mediatek.com \
--cc=powenkao@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox