7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joshua Mulloy [ Upstream commit 2b23952d70d43321a90dd8a06bcaab04a1a73118 ] tifm_device_remove() sets sock->dev.driver to NULL after calling the driver's remove() callback. Since commit a995fe1a3aa7 ("rust: driver: drop device private data post unbind"), device_unbind_cleanup() dereferences dev->driver after the bus remove() callback has returned, so removing a card from a TI FlashMedia reader oopses: BUG: kernel NULL pointer dereference, address: 0000000000000090 Workqueue: tifm tifm_7xx1_switch_media [tifm_7xx1] RIP: 0010:device_unbind_cleanup+0x16/0xb0 Call Trace: device_release_driver_internal+0x220/0x260 device_release_driver+0x12/0x20 bus_remove_device+0xf9/0x1c0 device_del+0x161/0x3b0 device_unregister+0x17/0x70 tifm_7xx1_switch_media.cold+0x6b/0xbd [tifm_7xx1] process_one_work+0x1ac/0x3d0 worker_thread+0x1b8/0x360 kthread+0xf7/0x130 ret_from_fork+0x195/0x2a0 ret_from_fork_asm+0x1a/0x30 The driver core clears dev->driver itself in device_unbind_cleanup(), so there is no need for the bus code to do it. Remove the assignment. The problem was found and the fix written with the help of an AI coding assistant. Tested on a Dell Precision M6500 (TI PCIxx12 FlashMedia, 104c:803b) running a 7.0 kernel: removing an SD card oopsed every time without the fix; with it, insert, read and remove work. Fixes: a995fe1a3aa7 ("rust: driver: drop device private data post unbind") Cc: stable@kernel.org Assisted-by: LLM Signed-off-by: Joshua Mulloy Link: https://patch.msgid.link/20261004102525.34356-1-joshuamulloy@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/misc/tifm_core.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/misc/tifm_core.c b/drivers/misc/tifm_core.c index aac8f0933e435..03d1324bc2534 100644 --- a/drivers/misc/tifm_core.c +++ b/drivers/misc/tifm_core.c @@ -97,7 +97,6 @@ static void tifm_device_remove(struct device *dev) sock->card_event = tifm_dummy_event; sock->data_event = tifm_dummy_event; drv->remove(sock); - sock->dev.driver = NULL; } put_device(dev); -- 2.53.0