[PATCH] misc: tifm: don't clear dev->driver in tifm_device_remove()

[Joshua Mulloy]

tifm_device_remove() sets sock->dev.driver to NULL after calling the
driver's remove() callback. Since commit a995fe1a3aa7 ("rust: driver:
drop device private data post unbind"), device_unbind_cleanup()
dereferences dev->driver after the bus remove() callback has returned,
so removing a card from a TI FlashMedia reader oopses:

  BUG: kernel NULL pointer dereference, address: 0000000000000090
  Workqueue: tifm tifm_7xx1_switch_media [tifm_7xx1]
  RIP: 0010:device_unbind_cleanup+0x16/0xb0
  Call Trace:
   device_release_driver_internal+0x220/0x260
   device_release_driver+0x12/0x20
   bus_remove_device+0xf9/0x1c0
   device_del+0x161/0x3b0
   device_unregister+0x17/0x70
   tifm_7xx1_switch_media.cold+0x6b/0xbd [tifm_7xx1]
   process_one_work+0x1ac/0x3d0
   worker_thread+0x1b8/0x360
   kthread+0xf7/0x130
   ret_from_fork+0x195/0x2a0
   ret_from_fork_asm+0x1a/0x30

The driver core clears dev->driver itself in device_unbind_cleanup(), so
there is no need for the bus code to do it. Remove the assignment.

The problem was found and the fix written with the help of an AI coding
assistant. Tested on a Dell Precision M6500 (TI PCIxx12 FlashMedia,
104c:803b) running a 7.0 kernel: removing an SD card oopsed every time
without the fix; with it, insert, read and remove work.

Fixes: a995fe1a3aa7 ("rust: driver: drop device private data post unbind")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Joshua Mulloy <joshuamulloy@xxxxxxxxx>
---
Runtime-tested only on 7.0 (Ubuntu 7.0.0-38), with the patched tifm_core
built as an out-of-tree module; on current mainline it has only been
compile-tested (W=1, no warnings).

memstick_device_remove() in drivers/memstick/core/memstick.c has the same
pattern; a separate patch for it goes to the memstick maintainers. A grep
found no other bus .remove() callbacks that clear dev->driver, but if
you'd rather handle this in device_unbind_cleanup() instead, that would
make both patches unnecessary.

 drivers/misc/tifm_core.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c
index aac8f0933..03d1324bc 100644
--- a/drivers/misc/tifm_core.c
+++ b/drivers/misc/tifm_core.c
@@ -97,7 +97,6 @@ static void tifm_device_remove(struct device *dev)
 		sock->card_event = tifm_dummy_event;
 		sock->data_event = tifm_dummy_event;
 		drv->remove(sock);
-		sock->dev.driver = NULL;
 	}
 
 	put_device(dev);

base-commit: 6addb4f385570ebc11c4eb499a4f1c149f313e84
-- 
2.53.0