[PATCH v6 0/3] rpmb: Fix request serialisation and teardown races

[Stanley Jhu <stanleyjhu@google.com>]

Jens, Martin,

Patch 1/3 serializes requests and provider unregistration in
drivers/misc/rpmb-core.c. Patches 2/3 and 3/3 fix UFS RPMB device
lifetime and drop the unregistered bus in drivers/ufs/core/ufs-rpmb.c so
regions register again after commit 36f35b8df697 ("driver core: reject
devices with unregistered buses").

Patches 2/3 and 3/3 depend on 1/3 at runtime to avoid a use-after-free
on host unbind. Jens, if 1/3 looks good to you, could you give an
Acked-by so Martin can take all three patches in order through the SCSI
tree?

Changes since v5:
- Rebase onto mkp/scsi.git for-next.
- 1/3: clear descr.route_frames under rdev->lock instead of dead flag.
- 2/3: pin sdev_gendev via get_device(), drop Bean's tag on 1/3, 2/3.
- v5: https://lore.kernel.org/r/20260914144910.931518-1-stanleyjhu@google.com

Stanley Jhu (3):
  rpmb: core: Guard frame requests and teardown with mutex
  scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF
  scsi: ufs: rpmb: Drop the unregistered ufs_rpmb bus

 drivers/misc/rpmb-core.c    | 20 ++++++++-
 drivers/ufs/core/ufs-rpmb.c | 84 +++++++++++++++++++------------------
 include/linux/rpmb.h        |  3 ++
 3 files changed, 65 insertions(+), 42 deletions(-)


base-commit: 0fc91e802801819a0c51d30b6eecac63ab4f85d2
-- 
2.56.0.567.gdb80ae8cd5-goog