[PATCH v3 0/2] scsi: ufs: rpmb: Fix bus registration and device lifecycle

[Stanley Jhu]

This series fixes bus registration and device lifecycle defects in the
UFS OP-TEE RPMB driver.

Why:
1. ufs_rpmb_bus_type was never registered with bus_register(), causing
   device_register() in ufs_rpmb_probe() to unconditionally fail with
   -EINVAL.
2. struct ufs_rpmb_dev embeds struct device but was allocated via
   devm_kzalloc() tied to hba->dev. On host unbind, devres frees the
   structure prematurely while external references remain active,
   causing a Use-After-Free (UAF) Oops.

What:
- Patch 1: Register ufs_rpmb_bus_type during ufshcd_core_init() and
  unregister it in ufshcd_core_exit(), with stubs for !CONFIG_RPMB.
- Patch 2: Allocate ufs_rpmb with kzalloc_obj() and free it via kfree()
  in ufs_rpmb_device_release(). Pin the underlying SCSI WLUN via
  scsi_device_get/put() and unregister in ufs_rpmb_remove().

Differences from v2:
- Drop generic RPMB core changes (sent as a separate patch).
- Reorder patches so bus registration comes first for bisectability.
- Call rpmb_dev_unregister() in ufs_rpmb_remove() to break cyclic refcount.
- Pin underlying SCSI WLUN via scsi_device_get/put().

Tested:
- Verified clean probe, RPMB I/O, and unbind on QEMU ARM64 without UAF.

Stanley Jhu (2):
  scsi: ufs: rpmb: Register and unregister ufs_rpmb_bus_type
  scsi: ufs: rpmb: Decouple device lifecycle from devres to avoid UAF

 drivers/ufs/core/ufs-rpmb.c    | 107 ++++++++++++++++++++-------------
 drivers/ufs/core/ufshcd-priv.h |  13 +++-
 drivers/ufs/core/ufshcd.c      |  16 ++++-
 3 files changed, 91 insertions(+), 45 deletions(-)

-- 
2.55.0.1007.g17ff1f9808-goog