[PATCH 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[shao.mingyin]

Two independent fixes in the UFS stack, found while reading the probe and
remove paths and the task-management hooks.

Patch 1 is in the core RPMB glue.  ufs_rpmb_probe() registers a child
device whose parent is the RPMB device, then registers an rpmb_dev on top
of it.  device_add() takes a reference on the parent, and
rpmb_dev_unregister() is only called from ufs_rpmb_device_release(), i.e.
when that reference count drops to zero.  The remove path and the probe
error path call device_unregister() on the child directly, so the
reference held by the rpmb_dev never goes away, the release callback never
runs, and the RPMB child stays registered while the devm-allocated
ufs_rpmb is freed together with the host.  Unregister the rpmb_dev first,
as mmc_blk_remove_rpmb_part() does, and let the release callback tolerate
an already unregistered device.

Patch 2 is in the Exynos host driver.  The nexus type masks are built with
(1 << tag); controllers can expose 32 unified task tags, and tag 31
shifts a 32-bit int into its sign bit.  Commit 01aad16c2257 fixed the
same expression in exynos_ufs_post_link() and noted that the UTMRL access
should be changed as well, but the four remaining mask computations were
missed.

The patches share no code: patch 1 is the core RPMB glue, patch 2 is
confined to the Exynos host hooks, so they can be applied in any order and
need review from different people.  Both carry Fixes: and Cc: stable.

Related work: an earlier series by Stanley Jhu ("scsi: ufs: rpmb: Fix bus
registration and device lifecycle", v3, September 2026) also calls
rpmb_dev_unregister() in ufs_rpmb_remove() to break the cyclic refcount, but
it is not in linux-next as of next-20261030.  This patch is the narrower fix:
unregister the rpmb_dev before the child device and let release tolerate an
already unregistered device.

Testing: both apply to next-20261030, pass checkpatch.pl --strict with
0 errors/0 warnings/0 checks, and the two touched objects build with W=1.
There is no Exynos board and no RPMB device on this machine, so neither
path was exercised at runtime; both fixes come from code inspection.
Patch 2 is the easier one to confirm: with UBSAN enabled, tag 31 would
report shift-out-of-bounds before the patch.

Signed-off-by: Shao Mingyin <shao.mingyin@xxxxxxxxxx>
---
base-commit: 7649ba73f9e7e1e04d0b46213e39c79ae09dd55c