[PATCH 0/2] scsi: ufs: rpmb: Fix device lifetime UAF and unregistered bus regression

[Stanley Jhu]

This series fixes two architectural defects in the UFS OP-TEE RPMB
driver: a use-after-free (UAF) during controller unbind or shutdown, and
an unregistered bus rejection by the driver core.

Patch 1: Decouple RPMB device lifecycle from devres
- Problem: struct ufs_rpmb_dev embeds a struct device but was allocated
  via devres tied to the parent controller. When the controller unbinds,
  devres prematurely frees the structure while external references
  remain, causing a UAF Oops on SLUB-poisoned memory
  (0x006b6b6b6b6b6b9c). Additionally, in-flight I/O lacks transport
  pinning to the underlying SCSI device.
- Solution: Transition to a reference-counted device lifecycle, pin the
  underlying SCSI device and host hierarchy during probe, and enforce
  proper subsystem unregistration and offline state validation.

Patch 2: Register and unregister ufs_rpmb_bus_type
- Problem: The driver assigns devices to ufs_rpmb_bus_type without
  registering the bus with the driver core, causing device_register()
  to fail with -EINVAL during probe.
- Solution: Register the bus during UFS core initialization and
  unregister it on exit, using IS_REACHABLE(CONFIG_RPMB) to provide clean
  fallback stubs and prevent modular build breakages.

Verification:
- QEMU ARM64 with virtual UFS 4.0 PCI controller:
  * Verified /sys/bus/ufs_rpmb registration and successful device probe.
  * Verified probe, unbind, and shutdown complete without leaks or Oops.
- checkpatch.pl: 0 errors, 0 warnings across all patches.

Stanley Jhu (2):
  scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF
  scsi: ufs: rpmb: Register and unregister ufs_rpmb_bus_type

 drivers/ufs/core/ufs-rpmb.c    | 96 ++++++++++++++++++++------------
 drivers/ufs/core/ufshcd-priv.h | 11 ++++-
 drivers/ufs/core/ufshcd.c      | 16 ++++++-
 3 files changed, 84 insertions(+), 39 deletions(-)

-- 
2.55.0.979.g7e5102b832-goog