From: Stanley Jhu <stanleyjhu@google.com>
To: jenswi@kernel.org, mkp@kernel.org
Cc: gregkh@linuxfoundation.org, arnd@arndb.de, bvanassche@acm.org,
avri.altman@sandisk.com, alim.akhtar@samsung.com,
beanhuo@micron.com, can.guo@oss.qualcomm.com, ulfh@kernel.org,
linusw@kernel.org, tomas.winkler@intel.com,
shyamsaini@linux.microsoft.com, alex.bennee@linaro.org,
James.Bottomley@HansenPartnership.com,
linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org,
Stanley Jhu <stanleyjhu@google.com>
Subject: [PATCH v4 3/3] scsi: ufs: rpmb: Drop the unregistered ufs_rpmb bus
Date: Sun, 13 Sep 2026 11:36:33 +0800 [thread overview]
Message-ID: <20260913033633.3159296-4-stanleyjhu@google.com> (raw)
In-Reply-To: <20260913033633.3159296-1-stanleyjhu@google.com>
ufs_rpmb_probe() assigns ufs_rpmb_bus_type to dev.bus, but that bus is
never passed to bus_register(). bus_add_device() rejects devices on an
unregistered bus, so device_register() has always failed:
bus_add_device: cannot add device 'ufs_rpmb0' to unregistered bus
'ufs_rpmb'
ufshcd 0000:00:02.0: Failed to register UFS RPMB device 0
ufs_rpmb_probe() unwinds on the first failure, so no RPMB region has
ever been registered and /sys/bus/ufs_rpmb/devices/ has never been
populated.
ufs_rpmb_bus_type declares no .match and no .probe, and no driver binds
to it. RPMB devices are exposed to consumers through /sys/class/rpmb/,
which rpmb_dev_register() already sets up. Drop the bus rather than
register it: device_register() works with dev.bus left NULL given a
parent and a release callback, both of which ufs_rpmb_probe() sets.
With the bus gone, on a device advertising four RPMB regions:
ufshcd 0000:00:02.0: UFS RPMB region 0 registered (capacity=32)
ufshcd 0000:00:02.0: UFS RPMB region 1 registered (capacity=32)
ufshcd 0000:00:02.0: UFS RPMB region 2 registered (capacity=32)
ufshcd 0000:00:02.0: UFS RPMB region 3 registered (capacity=32)
/sys/class/rpmb then holds rpmb0 to rpmb3, and unbinding the host
removes them.
Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
drivers/ufs/core/ufs-rpmb.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index 373b60aba916..684fb37705c7 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -28,10 +28,6 @@
#define UFS_RPMB_SEC_PROTOCOL 0xEC /* JEDEC UFS application */
#define UFS_RPMB_SEC_PROTOCOL_ID 0x01 /* JEDEC UFS RPMB protocol ID, CDB byte3 */
-static const struct bus_type ufs_rpmb_bus_type = {
- .name = "ufs_rpmb",
-};
-
/* UFS RPMB device structure */
struct ufs_rpmb_dev {
u8 region_id;
@@ -208,7 +204,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
ufs_rpmb->sdev = sdev;
ufs_rpmb->region_id = region;
ufs_rpmb->dev.parent = &sdev->sdev_gendev;
- ufs_rpmb->dev.bus = &ufs_rpmb_bus_type;
ufs_rpmb->dev.release = ufs_rpmb_device_release;
dev_set_name(&ufs_rpmb->dev, "ufs_rpmb%d", region);
--
2.55.0.1007.g17ff1f9808-goog
prev parent reply other threads:[~2026-09-13 3:36 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-13 3:36 [PATCH v4 0/3] rpmb: Fix request serialisation and teardown races Stanley Jhu
2026-09-13 3:36 ` [PATCH v4 1/3] rpmb: core: Guard frame requests and teardown with mutex Stanley Jhu
2026-09-13 17:43 ` Bean Huo
2026-09-13 3:36 ` [PATCH v4 2/3] scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF Stanley Jhu
2026-09-13 3:47 ` sashiko-bot
2026-09-13 5:07 ` Stanley Jhu
2026-09-13 3:36 ` Stanley Jhu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260913033633.3159296-4-stanleyjhu@google.com \
--to=stanleyjhu@google.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=alex.bennee@linaro.org \
--cc=alim.akhtar@samsung.com \
--cc=arnd@arndb.de \
--cc=avri.altman@sandisk.com \
--cc=beanhuo@micron.com \
--cc=bvanassche@acm.org \
--cc=can.guo@oss.qualcomm.com \
--cc=gregkh@linuxfoundation.org \
--cc=jenswi@kernel.org \
--cc=linusw@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=mkp@kernel.org \
--cc=shyamsaini@linux.microsoft.com \
--cc=tomas.winkler@intel.com \
--cc=ulfh@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox