[PATCH 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[PATCH 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[shao.mingyin]

Two independent fixes in the UFS stack, found while reading the probe and
remove paths and the task-management hooks.

Patch 1 is in the core RPMB glue.  ufs_rpmb_probe() registers a child
device whose parent is the RPMB device, then registers an rpmb_dev on top
of it.  device_add() takes a reference on the parent, and
rpmb_dev_unregister() is only called from ufs_rpmb_device_release(), i.e.
when that reference count drops to zero.  The remove path and the probe
error path call device_unregister() on the child directly, so the
reference held by the rpmb_dev never goes away, the release callback never
runs, and the RPMB child stays registered while the devm-allocated
ufs_rpmb is freed together with the host.  Unregister the rpmb_dev first,
as mmc_blk_remove_rpmb_part() does, and let the release callback tolerate
an already unregistered device.

Patch 2 is in the Exynos host driver.  The nexus type masks are built with
(1 << tag); controllers can expose 32 unified task tags, and tag 31
shifts a 32-bit int into its sign bit.  Commit 01aad16c2257 fixed the
same expression in exynos_ufs_post_link() and noted that the UTMRL access
should be changed as well, but the four remaining mask computations were
missed.

The patches share no code: patch 1 is the core RPMB glue, patch 2 is
confined to the Exynos host hooks, so they can be applied in any order and
need review from different people.  Both carry Fixes: and Cc: stable.

Related work: an earlier series by Stanley Jhu ("scsi: ufs: rpmb: Fix bus
registration and device lifecycle", v3, September 2026) also calls
rpmb_dev_unregister() in ufs_rpmb_remove() to break the cyclic refcount, but
it is not in linux-next as of next-20261030.  This patch is the narrower fix:
unregister the rpmb_dev before the child device and let release tolerate an
already unregistered device.

Testing: both apply to next-20261030, pass checkpatch.pl --strict with
0 errors/0 warnings/0 checks, and the two touched objects build with W=1.
There is no Exynos board and no RPMB device on this machine, so neither
path was exercised at runtime; both fixes come from code inspection.
Patch 2 is the easier one to confirm: with UBSAN enabled, tag 31 would
report shift-out-of-bounds before the patch.

Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c

[PATCH 1/2] scsi: ufs: core: unregister RPMB devices before their parent

[shao.mingyin]

ufs_rpmb_probe() registers a child device whose parent is the UFS RPMB
device and then registers an rpmb_dev on top of it.  device_add() takes a
reference on the parent, and rpmb_dev_unregister() is only called from
ufs_rpmb_device_release(), i.e. when the parent's reference count drops to
zero.  ufs_rpmb_remove() and the probe error path call
device_unregister(&ufs_rpmb->dev) directly, which leaves the reference
held by the rpmb_dev and the release callback never runs: the RPMB child
stays registered while the devm-allocated ufs_rpmb is freed together with
the host.

Unregister the rpmb_dev first, as mmc_blk_remove_rpmb_part() does, and let
the release callback tolerate an already unregistered device.

Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index 65f2d71cf073..1ed57d50c3ff 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -149,11 +149,19 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
 	return ret;
 }
 
+static void ufs_rpmb_unregister_device(struct ufs_rpmb_dev *ufs_rpmb)
+{
+	rpmb_dev_unregister(ufs_rpmb->rdev);
+	ufs_rpmb->rdev = NULL;
+	device_unregister(&ufs_rpmb->dev);
+}
+
 static void ufs_rpmb_device_release(struct device *dev)
 {
 	struct ufs_rpmb_dev *ufs_rpmb = dev_get_drvdata(dev);
 
-	rpmb_dev_unregister(ufs_rpmb->rdev);
+	if (ufs_rpmb->rdev)
+		rpmb_dev_unregister(ufs_rpmb->rdev);
 }
 
 /* UFS RPMB device registration */
@@ -250,7 +258,7 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
 	kfree(cid);
 	list_for_each_entry_safe(it, tmp, &hba->rpmbs, node) {
 		list_del(&it->node);
-		device_unregister(&it->dev);
+		ufs_rpmb_unregister_device(it);
 	}
 
 	return ret;
@@ -270,7 +278,7 @@ void ufs_rpmb_remove(struct ufs_hba *hba)
 		/* Remove from list first */
 		list_del(&ufs_rpmb->node);
 		/* Unregister device */
-		device_unregister(&ufs_rpmb->dev);
+		ufs_rpmb_unregister_device(ufs_rpmb);
 	}
 
 	dev_info(hba->dev, "All UFS RPMB devices unregistered\n");

[PATCH 2/2] scsi: ufs: exynos: use BIT() for the nexus type tag mask

[shao.mingyin]

exynos_ufs_specify_nexus_t_xfer_req() and
exynos_ufs_specify_nexus_t_tm_req() set and clear the task tag bit with
'(1 << tag)'.  tag is an int in the range 0..nutrs-1 supplied by the UFS
core, and controllers can have 32 unified task tags, so tag == 31 shifts a
32-bit int into its sign bit, which is undefined behaviour and trips
UBSAN's shift-out-of-bounds check.

Commit 01aad16c2257 ("scsi: ufs: exynos: Fix programming of
HCI_UTRL_NEXUS_TYPE") fixed the same pattern in exynos_ufs_post_link()
with BIT() and noted that the UTMRL access should be changed as well; the
four remaining mask computations were missed.  Use BIT(tag) there too.

Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c
index 3bcbc9ebbb28..ee47958253bb 100644
--- a/drivers/ufs/host/ufs-exynos.c
+++ b/drivers/ufs/host/ufs-exynos.c
@@ -997,9 +997,9 @@ static void exynos_ufs_specify_nexus_t_xfer_req(struct ufs_hba *hba,
 	type =  hci_readl(ufs, HCI_UTRL_NEXUS_TYPE);
 
 	if (is_scsi_cmd)
-		hci_writel(ufs, type | (1 << tag), HCI_UTRL_NEXUS_TYPE);
+		hci_writel(ufs, type | BIT(tag), HCI_UTRL_NEXUS_TYPE);
 	else
-		hci_writel(ufs, type & ~(1 << tag), HCI_UTRL_NEXUS_TYPE);
+		hci_writel(ufs, type & ~BIT(tag), HCI_UTRL_NEXUS_TYPE);
 }
 
 static void exynos_ufs_specify_nexus_t_tm_req(struct ufs_hba *hba,
@@ -1013,13 +1013,13 @@ static void exynos_ufs_specify_nexus_t_tm_req(struct ufs_hba *hba,
 	switch (func) {
 	case UFS_ABORT_TASK:
 	case UFS_QUERY_TASK:
-		hci_writel(ufs, type | (1 << tag), HCI_UTMRL_NEXUS_TYPE);
+		hci_writel(ufs, type | BIT(tag), HCI_UTMRL_NEXUS_TYPE);
 		break;
 	case UFS_ABORT_TASK_SET:
 	case UFS_CLEAR_TASK_SET:
 	case UFS_LOGICAL_RESET:
 	case UFS_QUERY_TASK_SET:
-		hci_writel(ufs, type & ~(1 << tag), HCI_UTMRL_NEXUS_TYPE);
+		hci_writel(ufs, type & ~BIT(tag), HCI_UTMRL_NEXUS_TYPE);
 		break;
 	}
 }