[PATCH v2] mmc: block: fix RPMB device unregister ordering

From: Ao Sun

Date: Mon Jul 06 2026 - 07:44:58 EST


From: Ao Sun <ao.sun@xxxxxxxxxxxxx>

Since commit 7852028a35f0 ("mmc: block: register RPMB partition with
the RPMB subsystem"), each mmc RPMB partition is represented by two
device objects:
- the mmc-owned device (`rpmb->dev`, backing the legacy /dev/mmcblkXrpmb
char device) and
- the rpmb-core device (`rdev`, backing /dev/rpmbN).

The child RPMB device holds a reference to its parent, so the
parent's release callback cannot be invoked if the child device
is still registered.

Remove rpmb_dev_unregister() from the parent release handler and
unregister the child RPMB device in the remove path before tearing
down the parent device.

Also delete the extra blank line between mmc_blk_remove_rpmb_part()
and {.

Fixes: 7852028a35f0 ("mmc: block: register RPMB partition with the RPMB subsystem")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiazi Li <jiazi.li@xxxxxxxxxxxxx>
Signed-off-by: Ao Sun <ao.sun@xxxxxxxxxxxxx>
Reviewed-by: Avri Altman <avri.altman@xxxxxxxxxxx>
---
Changes in v2:
- add background describing the two RPMB device objects
- add Fixes and Cc
- collect Reviewed-by
---
drivers/mmc/core/block.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 0274e8d07660..54a923ba4f1e 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2715,7 +2715,6 @@ static void mmc_blk_rpmb_device_release(struct device *dev)
{
struct mmc_rpmb_data *rpmb = dev_get_drvdata(dev);

- rpmb_dev_unregister(rpmb->rdev);
mmc_blk_put(rpmb->md);
ida_free(&mmc_rpmb_ida, rpmb->id);
kfree(rpmb);
@@ -2930,8 +2929,8 @@ static int mmc_blk_alloc_rpmb_part(struct mmc_card *card,
}

static void mmc_blk_remove_rpmb_part(struct mmc_rpmb_data *rpmb)
-
{
+ rpmb_dev_unregister(rpmb->rdev);
cdev_device_del(&rpmb->chrdev, &rpmb->dev);
put_device(&rpmb->dev);
}
--
2.34.1