Re: [PATCH v2 0/2] scsi: ufs: fix an RPMB teardown cycle and a shift UB

[shao.mingyin]

On 11/3/26 11:28, Bart Van Assche wrote:
> Please take a look at the attached review report from an LLM.

Thanks, I went through it and verified the points locally, including a
KASAN reproduction of the devm lifetime problem with
CONFIG_DEBUG_KOBJECT_RELEASE: devres frees ufs_rpmb when the host
detaches while the delayed kobject release of &ufs_rpmb->dev still runs.

I'm withdrawing patch 1/2.  The ordering it adds is already part of
Stanley's v5 series (2/3, "Decouple device lifecycle from devres to avoid
UAF", Reviewed-by: Bean Huo); that patch also allocates ufs_rpmb with
kzalloc(), frees it in the release callback, pins the RPMB WLUN and
guards rpmb_route_frames() against teardown.  Mine only breaks the
refcount cycle and leaves the ownership unchanged, so it is incomplete
and a duplicate.

I'll resend the Exynos BIT() change separately, as a cleanup without
Cc: stable and without Fixes:, and with the nutrs/nutmrs description
fixed.

Thanks,
Shao