[PATCH v2 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[PATCH v2 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[shao.mingyin]

Two independent fixes in the UFS stack, found while reading the probe and
remove paths and the task-management hooks.

Patch 1 is in the core RPMB glue.  ufs_rpmb_probe() registers a child
device whose parent is the RPMB device, then registers an rpmb_dev on top
of it.  device_add() takes a reference on the parent, and
rpmb_dev_unregister() is only called from ufs_rpmb_device_release(), i.e.
when that reference count drops to zero.  The remove path and the probe
error path call device_unregister() on the child directly, so the
reference held by the rpmb_dev never goes away, the release callback never
runs, and the RPMB child stays registered while the devm-allocated
ufs_rpmb is freed together with the host.  Unregister the rpmb_dev first,
as mmc_blk_remove_rpmb_part() does, and let the release callback tolerate
an already unregistered device.

Patch 2 is in the Exynos host driver.  The nexus type masks are built with
(1 << tag); controllers can expose 32 unified task tags, and tag 31
shifts a 32-bit int into its sign bit.  Commit 01aad16c2257 fixed the
same expression in exynos_ufs_post_link() and noted that the UTMRL access
should be changed as well, but the four remaining mask computations were
missed.

The patches share no code: patch 1 is the core RPMB glue, patch 2 is
confined to the Exynos host hooks, so they can be applied in any order and
need review from different people.  Both carry Fixes: and Cc: stable.

Related work: Dmitry Baryshkov's "scsi: ufs: rpmb: register and unregister
the ufs_rpmb bus" (September 2026) is still under review; the teardown fix
in patch 1 becomes reachable once that patch lands.  Stanley Jhu's earlier
series ("scsi: ufs: rpmb: Fix bus registration and device lifecycle", v3,
September 2026) also calls rpmb_dev_unregister() in ufs_rpmb_remove() to
break the cyclic refcount, but it is not in linux-next as of next-20261030.
This patch is the narrower fix: unregister the rpmb_dev before the child
device and let release tolerate an already unregistered device.

Testing: both apply to v7.4-rc1 (Martin's for-next tip, 6628e7d4c6b2), pass
checkpatch.pl --strict with 0 errors/0 warnings/0 checks, and the two
touched objects build with W=1.

Patch 1 was exercised on QEMU/x86-64 with a synthetic hba and a fake RPMB
WLUN, on top of Dmitry's still unmerged "scsi: ufs: rpmb: register and
unregister the ufs_rpmb bus" patch - without it device_register() fails
with -EINVAL and the teardown path is unreachable.  Before this patch,
ufs_rpmb_remove() leaves the rpmb0 class device registered because the
child device is never released; with it, rpmb0 is gone.

Patch 2 was exercised with a synthetic hook that calls both nexus helpers
with tag 31 in a UBSAN kernel.  The unpatched and the patched code write
the same value (0x80000000), because GCC wraps the undefined signed shift
under -fno-strict-overflow; no runtime symptom was observed, and the
patch is a well-definedness cleanup that matches the BIT() usage added by
01aad16c2257.  There is no Exynos board on this machine, so the driver
itself was not probed.

Changes in v2:
- Rebased onto Martin's for-next (v7.4-rc1, 6628e7d4c6b2).  v1 was generated
  against linux-next next-20261030 (7649ba73f9e7), which is not an ancestor
  of for-next, so the series did not apply there.  No code changes.
- Patch 2: dropped the claim that the shift trips UBSAN.  Testing shows GCC
  wraps it under -fno-strict-overflow, so it is a well-definedness cleanup.
- Refreshed the testing paragraph for the new base.

v1: https://lore.kernel.org/all/20261103185229490gmhePBF5_11x_thf4X-Rw@zte.com.cn/

Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4

[PATCH v2 1/2] scsi: ufs: core: unregister RPMB devices before their parent

[shao.mingyin]

ufs_rpmb_probe() registers a child device whose parent is the UFS RPMB
device and then registers an rpmb_dev on top of it.  device_add() takes a
reference on the parent, and rpmb_dev_unregister() is only called from
ufs_rpmb_device_release(), i.e. when the parent's reference count drops to
zero.  ufs_rpmb_remove() and the probe error path call
device_unregister(&ufs_rpmb->dev) directly, which leaves the reference
held by the rpmb_dev and the release callback never runs: the RPMB child
stays registered while the devm-allocated ufs_rpmb is freed together with
the host.

Unregister the rpmb_dev first, as mmc_blk_remove_rpmb_part() does, and let
the release callback tolerate an already unregistered device.

Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
v2: rebased onto v7.4-rc1 (for-next); no code changes.

 drivers/ufs/core/ufs-rpmb.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index 65f2d71cf073..1ed57d50c3ff 100644
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -149,11 +149,19 @@ static int ufs_rpmb_route_frames(struct device *dev, u8 *req, unsigned int req_l
 	return ret;
 }
 
+static void ufs_rpmb_unregister_device(struct ufs_rpmb_dev *ufs_rpmb)
+{
+	rpmb_dev_unregister(ufs_rpmb->rdev);
+	ufs_rpmb->rdev = NULL;
+	device_unregister(&ufs_rpmb->dev);
+}
+
 static void ufs_rpmb_device_release(struct device *dev)
 {
 	struct ufs_rpmb_dev *ufs_rpmb = dev_get_drvdata(dev);
 
-	rpmb_dev_unregister(ufs_rpmb->rdev);
+	if (ufs_rpmb->rdev)
+		rpmb_dev_unregister(ufs_rpmb->rdev);
 }
 
 /* UFS RPMB device registration */
@@ -250,7 +258,7 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
 	kfree(cid);
 	list_for_each_entry_safe(it, tmp, &hba->rpmbs, node) {
 		list_del(&it->node);
-		device_unregister(&it->dev);
+		ufs_rpmb_unregister_device(it);
 	}
 
 	return ret;
@@ -270,7 +278,7 @@ void ufs_rpmb_remove(struct ufs_hba *hba)
 		/* Remove from list first */
 		list_del(&ufs_rpmb->node);
 		/* Unregister device */
-		device_unregister(&ufs_rpmb->dev);
+		ufs_rpmb_unregister_device(ufs_rpmb);
 	}
 
 	dev_info(hba->dev, "All UFS RPMB devices unregistered\n");

[PATCH v2 2/2] scsi: ufs: exynos: use BIT() for the nexus type tag mask

[shao.mingyin]

exynos_ufs_specify_nexus_t_xfer_req() and
exynos_ufs_specify_nexus_t_tm_req() set and clear the task tag bit with
'(1 << tag)'.  tag is an int in the range 0..nutrs-1 supplied by the UFS
core, and controllers can have 32 unified task tags, so tag == 31 shifts a
32-bit int into its sign bit, which is undefined behaviour.  GCC happens
to wrap the result to 0x80000000 with the kernel's -fno-strict-overflow,
so there is no runtime symptom today, but the expression is not well
defined.

Commit 01aad16c2257 ("scsi: ufs: exynos: Fix programming of
HCI_UTRL_NEXUS_TYPE") fixed the same pattern in exynos_ufs_post_link()
with BIT() and noted that the UTMRL access should be changed as well; the
four remaining mask computations were missed.  Use BIT(tag) there too.

Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>
---
v2: rebased onto v7.4-rc1 (for-next); no code changes.

 drivers/ufs/host/ufs-exynos.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/ufs/host/ufs-exynos.c b/drivers/ufs/host/ufs-exynos.c
index 3bcbc9ebbb28..ee47958253bb 100644
--- a/drivers/ufs/host/ufs-exynos.c
+++ b/drivers/ufs/host/ufs-exynos.c
@@ -997,9 +997,9 @@ static void exynos_ufs_specify_nexus_t_xfer_req(struct ufs_hba *hba,
 	type =  hci_readl(ufs, HCI_UTRL_NEXUS_TYPE);
 
 	if (is_scsi_cmd)
-		hci_writel(ufs, type | (1 << tag), HCI_UTRL_NEXUS_TYPE);
+		hci_writel(ufs, type | BIT(tag), HCI_UTRL_NEXUS_TYPE);
 	else
-		hci_writel(ufs, type & ~(1 << tag), HCI_UTRL_NEXUS_TYPE);
+		hci_writel(ufs, type & ~BIT(tag), HCI_UTRL_NEXUS_TYPE);
 }
 
 static void exynos_ufs_specify_nexus_t_tm_req(struct ufs_hba *hba,
@@ -1013,13 +1013,13 @@ static void exynos_ufs_specify_nexus_t_tm_req(struct ufs_hba *hba,
 	switch (func) {
 	case UFS_ABORT_TASK:
 	case UFS_QUERY_TASK:
-		hci_writel(ufs, type | (1 << tag), HCI_UTMRL_NEXUS_TYPE);
+		hci_writel(ufs, type | BIT(tag), HCI_UTMRL_NEXUS_TYPE);
 		break;
 	case UFS_ABORT_TASK_SET:
 	case UFS_CLEAR_TASK_SET:
 	case UFS_LOGICAL_RESET:
 	case UFS_QUERY_TASK_SET:
-		hci_writel(ufs, type & ~(1 << tag), HCI_UTMRL_NEXUS_TYPE);
+		hci_writel(ufs, type & ~BIT(tag), HCI_UTMRL_NEXUS_TYPE);
 		break;
 	}
 }

Re: [PATCH v2 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[Bart Van Assche]

[-- Attachment #1: Type: text/plain, Size: 252 bytes --]

On 11/3/26 10:59 AM, shao.mingyin@zte.com.cn wrote:
> Two independent fixes in the UFS stack, found while reading the probe and
> remove paths and the task-management hooks.

Please take a look at the attached review report from an LLM.

Thanks,

Bart.

[-- Attachment #2: review.md --]
[-- Type: text/markdown, Size: 9948 bytes --]

### Overview

Series: [[PATCH v2 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB](https://lore.kernel.org/linux-scsi/202611040259247915t_cYYK0k5pPbEqfdTAQu@zte.com.cn/) (rebased onto `v7.4-rc1` / `mkp-scsi/for-next`, applies cleanly).

* **Patch 1/2 (`drivers/ufs/core/ufs-rpmb.c`):** **Needs changes / likely superseded.** It partially addresses the parent–child refcount cycle in [`ufs_rpmb_remove()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L260-L277), but leaves dead code in [`ufs_rpmb_device_release()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L152-L157), leaves [`struct ufs_rpmb_dev`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L35-L41) (which embeds `struct device`) allocated via `devm_kzalloc()`—exposing a use-after-free on unbind—and conflicts directly with Stanley Jhu's reviewed v5 series already on the list.
* **Patch 2/2 (`drivers/ufs/host/ufs-exynos.c`):** **Code change is fine as a `for-next` cleanup, but commit message and stable/Fixes tags need adjustment.**

---

### Series-Wide Issues

1. **Missing author name in `From:` header (`checkpatch.pl` warning):**
   ZTE's mailer sends `From: <shao.mingyin@zte.com.cn>` with no display name and no in-body `From:` line. Applying the mbox with `git am` / `b4 am` sets the commit author to `shao.mingyin@zte.com.cn <shao.mingyin@zte.com.cn>` and triggers [checkpatch.pl](file:///usr/local/google/home/bvanassche/software/linux-kernel/scripts/checkpatch.pl):
   ```text
   WARNING: From:/Signed-off-by: email name mismatch: 'From: shao.mingyin@zte.com.cn' != 'Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>'
   ```
   Generating the patches with `git format-patch --from="Shao Mingyin <shao.mingyin@zte.com.cn>"` adds an in-body `From:` header that survives the corporate MTA.
2. **Unrelated patches bundled together:**
   As the cover letter notes, Patch 1 (UFS core OP-TEE RPMB glue) and Patch 2 (Exynos host driver) share no code, context, or reviewers. Sending them separately avoids tying the simple Exynos cleanup to the active UFS RPMB rework.

---

### Patch 1/2: `scsi: ufs: core: unregister RPMB devices before their parent`

1. **Overlaps with Stanley Jhu's active v5 series (and cites outdated related work):**
   * The cover letter cites Stanley Jhu's v3 series and Dmitry Baryshkov's September 20 patch ([`[PATCH] scsi: ufs: rpmb: register and unregister the ufs_rpmb bus`](https://lore.kernel.org/linux-scsi/20260920-fix-ufs-rpmb-v1-1-560b842c589d@oss.qualcomm.com/)).
   * Dmitry's patch fails to link when `CONFIG_SCSI_UFSHCD=m` (`multiple definition of 'init_module'` / `'cleanup_module'`, reported by LKP), whereas Stanley Jhu posted a **v5** series on September 14 ([`[PATCH v5 0/3] rpmb: Fix request serialisation and teardown races`](https://lore.kernel.org/all/20260914144910.931518-1-stanleyjhu@google.com/), all three patches `Reviewed-by: Bean Huo`) that drops the unused `ufs_rpmb_bus_type`, breaks this same refcount cycle, decouples `ufs_rpmb` from devres, pins the RPMB WLUN `scsi_device`, and guards `rpmb_route_frames()` against teardown.

2. **`if (ufs_rpmb->rdev)` in `ufs_rpmb_device_release()` is dead code:**
   ```c
   static void ufs_rpmb_device_release(struct device *dev)
   {
   	struct ufs_rpmb_dev *ufs_rpmb = dev_get_drvdata(dev);

   	if (ufs_rpmb->rdev)
   		rpmb_dev_unregister(ufs_rpmb->rdev);
   }
   ```
   `ufs_rpmb->rdev` can **never** be non-`NULL` when [`ufs_rpmb_device_release()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L152-L157) runs:
   * On the probe error paths before `ufs_rpmb->rdev = rdev` ([ufs-rpmb.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L207-L235)), `ufs_rpmb->rdev` is still `NULL`.
   * Once [`rpmb_dev_register()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/misc/rpmb-core.c#L154-L199) succeeds, `rdev->dev.parent` points to `&ufs_rpmb->dev` ([rpmb-core.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/misc/rpmb-core.c#L182)) and holds a parent reference until `device_del(&rdev->dev)` inside [`rpmb_dev_unregister()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/misc/rpmb-core.c#L131-L141). The only caller of `rpmb_dev_unregister()` is the new `ufs_rpmb_unregister_device()`, which clears `ufs_rpmb->rdev = NULL` before calling `device_unregister(&ufs_rpmb->dev)`.

3. **Broken `struct device` lifetime (`devm_kzalloc` + Use-After-Free):**
   * [`ufs_rpmb_probe()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L192) allocates [`struct ufs_rpmb_dev`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L35-L41)—which embeds `struct device dev`—using `devm_kzalloc(hba->dev, ...)`.
   * Once Patch 1 breaks the parent–child refcount cycle, `ufs_rpmb_device_release()` becomes an effective no-op that still dereferences `ufs_rpmb->rdev` instead of freeing `ufs_rpmb`. If anything holds a reference to `&ufs_rpmb->dev` across HBA driver unbind (e.g., open sysfs attributes, `CONFIG_DEBUG_KOBJECT_RELEASE=y` delayed release, or an OP-TEE client holding `rdev` via `rpmb_dev_get()`), `devres_release_all(hba->dev)` frees `ufs_rpmb` while `&ufs_rpmb->dev` is still live, causing a slab-use-after-free in `kobject_cleanup()` / `ufs_rpmb_device_release()` (and in [`ufs_rpmb_route_frames()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c#L76-L150) if a request is in flight).
   * Compare with [`mmc_blk_alloc_rpmb_part()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/mmc/core/block.c#L2870-L2929) and [`mmc_blk_rpmb_device_release()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/mmc/core/block.c#L2714-L2721) (which the commit message cites as its model): MMC allocates `struct mmc_rpmb_data` with `kzalloc_obj()` and frees it with `kfree()` inside the `.release` callback, and never calls `rpmb_dev_unregister()` from `.release`.
   * (Also, because [`ufshcd_add_lus()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufshcd.c#L9358) ignores the return value of `ufs_rpmb_probe()`, `devm_kzalloc()` leaks memory on `hba->dev` until HBA removal whenever `ufs_rpmb_probe()` fails.)

4. **Minor naming / description nits (if kept):**
   * Recent commits to [ufs-rpmb.c](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufs-rpmb.c) use the subject prefix `scsi: ufs: rpmb: <Capitalized verb>...`.
   * The commit message ambiguously refers to both `&hba->ufs_rpmb_wlun->sdev_gendev` ("the UFS RPMB device") and `&ufs_rpmb->dev` / `&rdev->dev` ("child"/"parent") without distinguishing the three `struct device` layers (`sdev_gendev` -> `ufs_rpmb->dev` -> `rdev->dev`).

---

### Patch 2/2: `scsi: ufs: exynos: use BIT() for the nexus type tag mask`

The code change in [`exynos_ufs_specify_nexus_t_xfer_req()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/host/ufs-exynos.c#L991-L1003) and [`exynos_ufs_specify_nexus_t_tm_req()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/host/ufs-exynos.c#L1005-L1025) is clean, type-safe on both 32-bit and 64-bit builds (`type` is `u32`, so `type & ~BIT(tag)` zero-extends the upper 32 bits before masking), and matches [`exynos_ufs_post_link()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/host/ufs-exynos.c#L1192-L1193).

However, the commit metadata and description have three issues:

1. **Drop `Cc: stable@vger.kernel.org` (and likely `Fixes:`):**
   * The kernel builds with `-fno-strict-overflow` ([Makefile](file:///usr/local/google/home/bvanassche/software/linux-kernel/Makefile#L1175)), under which both GCC and Clang define two's-complement signed left-shift into the sign bit (`1 << 31` == `0x80000000`, and neither compiler emits a `-fsanitize=shift` check for `tag == 31`).
   * Unlike commit `01aad16c2257` ("scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE"), which shifted by `hba->nutrs == 32` (shift exponent `>= 32`, genuinely undefined even with `-fno-strict-overflow` and producing `0` on hardware), `tag` here is at most `31` and has no runtime bug, as the commit message itself states. Per [stable-kernel-rules.rst](file:///usr/local/google/home/bvanassche/software/linux-kernel/Documentation/process/stable-kernel-rules.rst#L15-L31), pure cleanups with no user-visible bug must not carry `Cc: stable@vger.kernel.org`.

2. **Inaccurate `tag` range and UFS terminology in the commit message:**
   * `nutrs` is the number of **UTP transfer request** slots, not "unified task tags".
   * Only [`exynos_ufs_specify_nexus_t_xfer_req()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/host/ufs-exynos.c#L991-L1003) receives `tag` in `0..nutrs - 1` (`0..31`, [`MASK_TRANSFER_REQUESTS_SLOTS_SDB`](file:///usr/local/google/home/bvanassche/software/linux-kernel/include/ufs/ufshci.h#L73)). [`exynos_ufs_specify_nexus_t_tm_req()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/host/ufs-exynos.c#L1005-L1025) receives a task management tag in `0..nutmrs - 1`, which per [`ufshcd_hba_capabilities()`](file:///usr/local/google/home/bvanassche/software/linux-kernel/drivers/ufs/core/ufshcd.c#L2533-L2543) and [`MASK_TASK_MANAGEMENT_REQUEST_SLOTS`](file:///usr/local/google/home/bvanassche/software/linux-kernel/include/ufs/ufshci.h#L76) (`0x00070000`) is `0..7` and never reaches bit 31 (converting it to `BIT(tag)` is purely for consistency).

3. **Subject capitalization nit:**
   `scsi: ufs: exynos: Use BIT() for the nexus type tag mask` (capital `Use` to match SCSI/UFS commit conventions).

Re: [PATCH v2 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[shao.mingyin]

On 11/3/26 11:28, Bart Van Assche wrote:
> Please take a look at the attached review report from an LLM.

Thanks, I went through it and verified the points locally, including a
KASAN reproduction of the devm lifetime problem with
CONFIG_DEBUG_KOBJECT_RELEASE: devres frees ufs_rpmb when the host
detaches while the delayed kobject release of &ufs_rpmb->dev still runs.

I'm withdrawing patch 1/2.  The ordering it adds is already part of
Stanley's v5 series (2/3, "Decouple device lifecycle from devres to avoid
UAF", Reviewed-by: Bean Huo); that patch also allocates ufs_rpmb with
kzalloc(), frees it in the release callback, pins the RPMB WLUN and
guards rpmb_route_frames() against teardown.  Mine only breaks the
refcount cycle and leaves the ownership unchanged, so it is incomplete
and a duplicate.

I'll resend the Exynos BIT() change separately, as a cleanup without
Cc: stable and without Fixes:, and with the nutrs/nutmrs description
fixed.

Thanks,
Shao