scsi: ufs: core: Initialize hba->rpmbs list in ufshcd

Initialize the hba->rpmbs list in ufshcd_alloc_host() to prevent NULL
pointer dereference in the device teardown path if ufs_rpmb_probe()
fails.

Fixes: b06b8c421485 ("scsi: ufs: core: Add OP-TEE based RPMB driver for UFS devices")
Co-developed-by: Jiazi Li <jiazi.li@transsion.com>
Signed-off-by: Jiazi Li <jiazi.li@transsion.com>
Signed-off-by: Ao Sun <ao.sun@transsion.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Link: https://patch.msgid.link/20260723034440.217-1-ao.sun@transsion.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/ufs/core/ufs-rpmb.c b/drivers/ufs/core/ufs-rpmb.c
index ffad049872b9a30d36806b7b5f7e55105d6a0878..62120dc2e9da7958796651131aa8225b94cf415b 100644 (file)
--- a/drivers/ufs/core/ufs-rpmb.c
+++ b/drivers/ufs/core/ufs-rpmb.c
@@ -152,8 +152,6 @@ int ufs_rpmb_probe(struct ufs_hba *hba)
                return -EINVAL;
        }
 
-       INIT_LIST_HEAD(&hba->rpmbs);
-
        struct rpmb_descr descr = {
                .type = RPMB_TYPE_UFS,
                .route_frames = ufs_rpmb_route_frames,

diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 34228beb3f59f83ed2d7107ad86d723506d41507..13e6357a8bbb5dcfe825861ea42ea6427bb76463 100644 (file)
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -10958,6 +10958,7 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle)
        hba->nop_out_timeout = NOP_OUT_TIMEOUT;
        ufshcd_set_sg_entry_size(hba, sizeof(struct ufshcd_sg_entry));
        INIT_LIST_HEAD(&hba->clk_list_head);
+       INIT_LIST_HEAD(&hba->rpmbs);
        spin_lock_init(&hba->outstanding_lock);
 
        *hba_handle = hba;