Re: [PATCH] scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

[Bean Huo]

On Thu, 2026-07-23 at 03:45 +0000, Ao Sun wrote:
> From: Ao Sun <ao.sun@xxxxxxxxxxxxx>
> 
> Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL
> pointer dereference in the device teardown path if ufs_rpmb_probe()
> fails.
> 
> Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS
> devices")
> Signed-off-by: Jiazi Li <jiazi.li@xxxxxxxxxxxxx>
> Signed-off-by: Ao Sun <ao.sun@xxxxxxxxxxxxx>
> ---
>  drivers/ufs/core/ufs-rpmb.c | 2 --
>  drivers/ufs/core/ufshcd.c   | 1 +
>  2 files changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
> index ffad049872b9..62120dc2e9da 100644
> --- a/drivers/ufs/core/ufs-rpmb.c
> +++ b/drivers/ufs/core/ufs-rpmb.c
> @@ -152,8 +152,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
>                 return -EINVAL;
>         }
>  
> -       INIT_LIST_HEAD(&hba->rpmbs);
> -
>         struct rpmb_descr descr = {
>                 .type = RPMB_TYPE_UFS,
>                 .route_frames = ufs_rpmb_route_frames,
> diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
> index d3044a3089b5..60227069db06 100644
> --- a/drivers/ufs/core/ufshcd.c
> +++ b/drivers/ufs/core/ufshcd.c
> @@ -10988,6 +10988,7 @@ int ufshcd_alloc_host(struct device *dev, struct
> ufs_hba **hba_handle)
>         hba->nop_out_timeout = NOP_OUT_TIMEOUT;
>         ufshcd_set_sg_entry_size(hba, sizeof(struct ufshcd_sg_entry));
>         INIT_LIST_HEAD(&hba->clk_list_head);
> +       INIT_LIST_HEAD(&hba->rpmbs);
>         spin_lock_init(&hba->outstanding_lock);
>  
>         *hba_handle = hba;


Thanks for splitting this out, this is much easier to reason about.

For the two lifetime issues Sashiko reported (the container/rdev circular
reference and the devm_kzalloc() ownership), both are real but pre-existing and
independent of this fix. Let's keep this patch focused on the NULL deref and
handle those in the teardown-order series, this one can go in on its own.

Reviewed-by: Bean Huo <beanhuo@xxxxxxxxxx>

Kind regards,
Bean