* [PATCH v6 1/3] rpmb: core: Guard frame requests and teardown with mutex
2026-11-12 0:41 [PATCH v6 0/3] rpmb: Fix request serialisation and teardown races Stanley Jhu
@ 2026-11-12 0:41 ` Stanley Jhu
2026-11-12 0:41 ` [PATCH v6 2/3] scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF Stanley Jhu
2026-11-12 0:41 ` [PATCH v6 3/3] scsi: ufs: rpmb: Drop the unregistered ufs_rpmb bus Stanley Jhu
2 siblings, 0 replies; 4+ messages in thread
From: Stanley Jhu @ 2026-11-12 0:41 UTC (permalink / raw)
To: Martin K . Petersen, Jens Wiklander, linux-scsi
Cc: Greg Kroah-Hartman, Arnd Bergmann, Bart Van Assche, Avri Altman,
Alim Akhtar, Bean Huo, Bean Huo, Alexey Charkov, Can Guo,
Ulf Hansson, Linus Walleij, Shyam Saini, Alex Bennée,
James E . J . Bottomley, linux-kernel
rpmb_route_frames() invokes the provider callback without serialization,
which causes two races:
1. Concurrent callers on the same rpmb_dev interleave multi-frame
authenticated sequences on the region's single result register and
receive each other's responses without error.
2. rpmb_dev_unregister() calls device_del() and allows the parent
provider device to be freed while an in-flight rpmb_route_frames()
call still dereferences rdev->dev.parent, causing a use-after-free.
Serialize rpmb_route_frames() and rpmb_dev_unregister() with a mutex in
struct rpmb_dev and clear descr.route_frames on unregistration so new
requests fail with -ENODEV. Also update the stale kerneldoc note
advising providers to unregister from their parent release callback,
which cannot run while the child rpmb_dev still holds a parent
reference.
Fixes: 1e9046e3a154 ("rpmb: add Replay Protected Memory Block (RPMB) subsystem")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
Jens, if this looks good to you, an Acked-by would let Martin take
the whole series through the SCSI tree. Patches 2/3 and 3/3 depend
on this one.
drivers/misc/rpmb-core.c | 20 ++++++++++++++++++--
include/linux/rpmb.h | 3 +++
2 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/rpmb-core.c b/drivers/misc/rpmb-core.c
index ecf14acf230a..0fda893dd74d 100644
--- a/drivers/misc/rpmb-core.c
+++ b/drivers/misc/rpmb-core.c
@@ -45,6 +45,8 @@ EXPORT_SYMBOL_GPL(rpmb_dev_put);
* @rsp: rpmb response frames
* @rsp_len: length of rpmb response frames in bytes
*
+ * Context: Might sleep.
+ *
* Returns: < 0 on failure
*/
int rpmb_route_frames(struct rpmb_dev *rdev, u8 *req,
@@ -53,6 +55,10 @@ int rpmb_route_frames(struct rpmb_dev *rdev, u8 *req,
if (!req || !req_len || !rsp || !rsp_len)
return -EINVAL;
+ guard(mutex)(&rdev->lock);
+ if (!rdev->descr.route_frames)
+ return -ENODEV;
+
return rdev->descr.route_frames(rdev->dev.parent, req, req_len,
rsp, rsp_len);
}
@@ -62,6 +68,7 @@ static void rpmb_dev_release(struct device *dev)
{
struct rpmb_dev *rdev = to_rpmb_dev(dev);
+ mutex_destroy(&rdev->lock);
ida_free(&rpmb_ida, rdev->id);
kfree(rdev->descr.dev_id);
kfree(rdev);
@@ -123,8 +130,9 @@ EXPORT_SYMBOL_GPL(rpmb_interface_unregister);
* rpmb_dev_unregister() - unregister RPMB partition from the RPMB subsystem
* @rdev: the rpmb device to unregister
*
- * This function should be called from the release function of the
- * underlying device used when the RPMB device was registered.
+ * This function should be called from the remove or unbind callback of the
+ * underlying device used when the RPMB device was registered, never from
+ * a device release callback.
*
* Returns: < 0 on failure
*/
@@ -133,6 +141,12 @@ int rpmb_dev_unregister(struct rpmb_dev *rdev)
if (!rdev)
return -EINVAL;
+ scoped_guard(mutex, &rdev->lock) {
+ if (!rdev->descr.route_frames)
+ return 0;
+ rdev->descr.route_frames = NULL;
+ }
+
device_del(&rdev->dev);
rpmb_dev_put(rdev);
@@ -164,6 +178,7 @@ struct rpmb_dev *rpmb_dev_register(struct device *dev,
rdev = kzalloc_obj(*rdev);
if (!rdev)
return ERR_PTR(-ENOMEM);
+ mutex_init(&rdev->lock);
rdev->descr = *descr;
rdev->descr.dev_id = kmemdup(descr->dev_id, descr->dev_id_len,
GFP_KERNEL);
@@ -194,6 +209,7 @@ struct rpmb_dev *rpmb_dev_register(struct device *dev,
err_free_dev_id:
kfree(rdev->descr.dev_id);
err_free_rdev:
+ mutex_destroy(&rdev->lock);
kfree(rdev);
return ERR_PTR(ret);
}
diff --git a/include/linux/rpmb.h b/include/linux/rpmb.h
index ed3f8e431eff..11a5d2646e38 100644
--- a/include/linux/rpmb.h
+++ b/include/linux/rpmb.h
@@ -7,6 +7,7 @@
#define __RPMB_H__
#include <linux/device.h>
+#include <linux/mutex.h>
#include <linux/types.h>
/**
@@ -48,12 +49,14 @@ struct rpmb_descr {
* struct rpmb_dev - device which can support RPMB partition
*
* @dev : device
+ * @lock : serialises requests and protects them against teardown
* @id : device_id
* @list_node : linked list node
* @descr : RPMB description
*/
struct rpmb_dev {
struct device dev;
+ struct mutex lock;
int id;
struct list_head list_node;
struct rpmb_descr descr;
--
2.56.0.567.gdb80ae8cd5-goog
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v6 2/3] scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF
2026-11-12 0:41 [PATCH v6 0/3] rpmb: Fix request serialisation and teardown races Stanley Jhu
2026-11-12 0:41 ` [PATCH v6 1/3] rpmb: core: Guard frame requests and teardown with mutex Stanley Jhu
@ 2026-11-12 0:41 ` Stanley Jhu
2026-11-12 0:41 ` [PATCH v6 3/3] scsi: ufs: rpmb: Drop the unregistered ufs_rpmb bus Stanley Jhu
2 siblings, 0 replies; 4+ messages in thread
From: Stanley Jhu @ 2026-11-12 0:41 UTC (permalink / raw)
To: Martin K . Petersen, Jens Wiklander, linux-scsi
Cc: Greg Kroah-Hartman, Arnd Bergmann, Bart Van Assche, Avri Altman,
Alim Akhtar, Bean Huo, Bean Huo, Alexey Charkov, Can Guo,
Ulf Hansson, Linus Walleij, Shyam Saini, Alex Bennée,
James E . J . Bottomley, linux-kernel
Region device lifetime in ufs-rpmb fails on host removal in three ways:
1. ufs_rpmb_probe() allocates struct ufs_rpmb_dev with devm_kzalloc() on
the host device even though it embeds a reference-counted struct
device, so devres frees the memory on host unbind regardless of live
references.
2. Probe takes no reference on hba->ufs_rpmb_wlun, so scsi_remove_host()
frees the scsi_device while an RPMB request is still in flight.
3. Child rpmb_dev holds a parent reference on ufs_rpmb->dev until
rpmb_dev_unregister() runs, which sits inside
ufs_rpmb_device_release() and therefore never runs on unbind.
Allocate struct ufs_rpmb_dev with kzalloc_obj() and free it in
ufs_rpmb_device_release(), hold a get_device() reference on the WLUN
across the region lifetime, call rpmb_dev_unregister() explicitly during
removal and probe unwind, and reject requests when the WLUN is offline.
Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Cc: stable@vger.kernel.org
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
drivers/ufs/core/ufs-rpmb.c | 79 +++++++++++++++++++++----------------
1 file changed, 44 insertions(+), 35 deletions(-)
diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index 65f2d71cf073..11d2d8e789d0 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -14,6 +14,7 @@
#include <linux/module.h>
#include <linux/device.h>
#include <linux/kernel.h>
+#include <linux/slab.h>
#include <linux/types.h>
#include <linux/rpmb.h>
#include <linux/string.h>
@@ -36,13 +37,14 @@ struct ufs_rpmb_dev {
u8 region_id;
struct device dev;
struct rpmb_dev *rdev;
- struct ufs_hba *hba;
+ struct scsi_device *sdev;
struct list_head node;
};
-static int ufs_sec_submit(struct ufs_hba *hba, u16 spsp, void *buffer, size_t len, bool send)
+static int ufs_sec_submit(struct ufs_rpmb_dev *ufs_rpmb, u16 spsp,
+ void *buffer, size_t len, bool send)
{
- struct scsi_device *sdev = hba->ufs_rpmb_wlun;
+ struct scsi_device *sdev = ufs_rpmb->sdev;
struct scsi_failure failure_defs[] = {
{
.sense_key = UNIT_ATTENTION,
@@ -62,6 +64,9 @@ static int ufs_sec_submit(struct ufs_hba *hba, u16 spsp, void *buffer, size_t le
};
u8 cdb[12] = { };
+ if (!sdev || !scsi_device_online(sdev))
+ return -ENODEV;
+
cdb[0] = send ? SECURITY_PROTOCOL_OUT : SECURITY_PROTOCOL_IN;
cdb[1] = UFS_RPMB_SEC_PROTOCOL;
put_unaligned_be16(spsp, &cdb[2]);
@@ -74,13 +79,12 @@ static int ufs_sec_submit(struct ufs_hba *hba, u16 spsp, void *buffer, size_t le
/* UFS RPMB route frames implementation */
static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_len, u8 *resp,
- unsigned int resp_len)
+ unsigned int resp_len)
{
struct ufs_rpmb_dev *ufs_rpmb = dev_get_drvdata(dev);
struct rpmb_frame *frm_out = (struct rpmb_frame *)req;
bool need_result_read = true;
u16 req_type, protocol_id;
- struct ufs_hba *hba;
int ret;
if (!ufs_rpmb) {
@@ -88,8 +92,6 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
return -ENODEV;
}
- hba = ufs_rpmb->hba;
-
/* req_resp is at the end of an RPMB frame. */
if (req_len < sizeof(*frm_out))
return -EINVAL;
@@ -122,7 +124,7 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
protocol_id = ufs_rpmb->region_id << 8 | UFS_RPMB_SEC_PROTOCOL_ID;
- ret = ufs_sec_submit(hba, protocol_id, req, req_len, true);
+ ret = ufs_sec_submit(ufs_rpmb, protocol_id, req, req_len, true);
if (ret) {
dev_err(dev, "Command failed with ret=%d\n", ret);
return ret;
@@ -133,7 +135,8 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
memset(frm_resp, 0, sizeof(*frm_resp));
put_unaligned_be16(RPMB_RESULT_READ, &frm_resp->req_resp);
- ret = ufs_sec_submit(hba, protocol_id, resp, resp_len, true);
+ ret = ufs_sec_submit(ufs_rpmb, protocol_id, resp, resp_len,
+ true);
if (ret) {
dev_err(dev, "Result read request failed with ret=%d\n", ret);
return ret;
@@ -141,7 +144,8 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
}
if (!ret) {
- ret = ufs_sec_submit(hba, protocol_id, resp, resp_len, false);
+ ret = ufs_sec_submit(ufs_rpmb, protocol_id, resp, resp_len,
+ false);
if (ret)
dev_err(dev, "Response read failed with ret=%d\n", ret);
}
@@ -151,23 +155,31 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
static void ufs_rpmb_device_release(struct device *dev)
{
- struct ufs_rpmb_dev *ufs_rpmb = dev_get_drvdata(dev);
+ struct ufs_rpmb_dev *ufs_rpmb =
+ container_of(dev, struct ufs_rpmb_dev, dev);
- rpmb_dev_unregister(ufs_rpmb->rdev);
+ put_device(&ufs_rpmb->sdev->sdev_gendev);
+ kfree(ufs_rpmb);
}
/* UFS RPMB device registration */
int ufs_rpmb_probe(struct ufs_hba *hba)
{
+ struct rpmb_descr descr = {
+ .type = RPMB_TYPE_UFS,
+ .route_frames = ufs_rpmb_route_frames,
+ .reliable_wr_count = hba->dev_info.rpmb_io_size,
+ };
+ struct scsi_device *sdev = hba->ufs_rpmb_wlun;
struct ufs_rpmb_dev *ufs_rpmb, *it, *tmp;
u8 dev_id[UFS_RPMB_ID_LEN];
struct rpmb_dev *rdev;
- char *cid = NULL;
+ char *cid;
int region;
u32 cap;
int ret;
- if (!hba->ufs_rpmb_wlun || hba->dev_info.b_advanced_rpmb_en) {
+ if (!sdev || hba->dev_info.b_advanced_rpmb_en) {
dev_info(hba->dev, "Skip OP-TEE RPMB registration\n");
return -ENODEV;
}
@@ -178,25 +190,22 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
return -EINVAL;
}
- struct rpmb_descr descr = {
- .type = RPMB_TYPE_UFS,
- .route_frames = ufs_rpmb_route_frames,
- .reliable_wr_count = hba->dev_info.rpmb_io_size,
- };
-
for (region = 0; region < ARRAY_SIZE(hba->dev_info.rpmb_region_size); region++) {
cap = hba->dev_info.rpmb_region_size[region];
if (!cap)
continue;
- ufs_rpmb = devm_kzalloc(hba->dev, sizeof(*ufs_rpmb), GFP_KERNEL);
+ ufs_rpmb = kzalloc_obj(*ufs_rpmb);
if (!ufs_rpmb) {
ret = -ENOMEM;
goto err_out;
}
- ufs_rpmb->hba = hba;
- ufs_rpmb->dev.parent = &hba->ufs_rpmb_wlun->sdev_gendev;
+ get_device(&sdev->sdev_gendev);
+
+ ufs_rpmb->sdev = sdev;
+ ufs_rpmb->region_id = region;
+ ufs_rpmb->dev.parent = &sdev->sdev_gendev;
ufs_rpmb->dev.bus = &ufs_rpmb_bus_type;
ufs_rpmb->dev.release = ufs_rpmb_device_release;
dev_set_name(&ufs_rpmb->dev, "ufs_rpmb%d", region);
@@ -207,16 +216,14 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
ret = device_register(&ufs_rpmb->dev);
if (ret) {
dev_err(hba->dev, "Failed to register UFS RPMB device %d\n", region);
- put_device(&ufs_rpmb->dev);
- goto err_out;
+ goto err_put;
}
/* Create unique ID by appending region number to device_id */
cid = kasprintf(GFP_KERNEL, "%s-R%d", hba->dev_info.device_id, region);
if (!cid) {
- device_unregister(&ufs_rpmb->dev);
ret = -ENOMEM;
- goto err_out;
+ goto err_unreg;
}
blake2b(NULL, 0, cid, strlen(cid), dev_id, UFS_RPMB_ID_LEN);
@@ -227,29 +234,30 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
/* Register RPMB device */
rdev = rpmb_dev_register(&ufs_rpmb->dev, &descr);
+ kfree(cid);
if (IS_ERR(rdev)) {
dev_err(hba->dev, "Failed to register UFS RPMB device.\n");
- device_unregister(&ufs_rpmb->dev);
ret = PTR_ERR(rdev);
- goto err_out;
+ goto err_unreg;
}
- kfree(cid);
- cid = NULL;
-
ufs_rpmb->rdev = rdev;
- ufs_rpmb->region_id = region;
-
list_add_tail(&ufs_rpmb->node, &hba->rpmbs);
dev_info(hba->dev, "UFS RPMB region %d registered (capacity=%u)\n", region, cap);
}
return 0;
+
+err_unreg:
+ device_unregister(&ufs_rpmb->dev);
+ goto err_out;
+err_put:
+ put_device(&ufs_rpmb->dev);
err_out:
- kfree(cid);
list_for_each_entry_safe(it, tmp, &hba->rpmbs, node) {
list_del(&it->node);
+ rpmb_dev_unregister(it->rdev);
device_unregister(&it->dev);
}
@@ -269,6 +277,7 @@ void ufs_rpmb_remove(struct ufs_hba *hba)
dev_info(hba->dev, "Removing UFS RPMB region %d\n", ufs_rpmb->region_id);
/* Remove from list first */
list_del(&ufs_rpmb->node);
+ rpmb_dev_unregister(ufs_rpmb->rdev);
/* Unregister device */
device_unregister(&ufs_rpmb->dev);
}
--
2.56.0.567.gdb80ae8cd5-goog
^ permalink raw reply [flat|nested] 4+ messages in thread