From 2b23952d70d43321a90dd8a06bcaab04a1a73118 Mon Sep 17 00:00:00 2001 From: Joshua Mulloy Date: Sun, 4 Oct 2026 06:25:25 -0400 Subject: [PATCH] misc: tifm: don't clear dev->driver in tifm_device_remove() tifm_device_remove() sets sock->dev.driver to NULL after calling the driver's remove() callback. Since commit a995fe1a3aa7 ("rust: driver: drop device private data post unbind"), device_unbind_cleanup() dereferences dev->driver after the bus remove() callback has returned, so removing a card from a TI FlashMedia reader oopses: BUG: kernel NULL pointer dereference, address: 0000000000000090 Workqueue: tifm tifm_7xx1_switch_media [tifm_7xx1] RIP: 0010:device_unbind_cleanup+0x16/0xb0 Call Trace: device_release_driver_internal+0x220/0x260 device_release_driver+0x12/0x20 bus_remove_device+0xf9/0x1c0 device_del+0x161/0x3b0 device_unregister+0x17/0x70 tifm_7xx1_switch_media.cold+0x6b/0xbd [tifm_7xx1] process_one_work+0x1ac/0x3d0 worker_thread+0x1b8/0x360 kthread+0xf7/0x130 ret_from_fork+0x195/0x2a0 ret_from_fork_asm+0x1a/0x30 The driver core clears dev->driver itself in device_unbind_cleanup(), so there is no need for the bus code to do it. Remove the assignment. The problem was found and the fix written with the help of an AI coding assistant. Tested on a Dell Precision M6500 (TI PCIxx12 FlashMedia, 104c:803b) running a 7.0 kernel: removing an SD card oopsed every time without the fix; with it, insert, read and remove work. Fixes: a995fe1a3aa7 ("rust: driver: drop device private data post unbind") Cc: stable@kernel.org Assisted-by: LLM Signed-off-by: Joshua Mulloy Link: https://patch.msgid.link/20261004102525.34356-1-joshuamulloy@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/misc/tifm_core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c index aac8f0933e43..03d1324bc253 100644 --- a/drivers/misc/tifm_core.c +++ b/drivers/misc/tifm_core.c @@ -97,7 +97,6 @@ static void tifm_device_remove(struct device *dev) sock->card_event = tifm_dummy_event; sock->data_event = tifm_dummy_event; drv->remove(sock); - sock->dev.driver = NULL; } put_device(dev);