This is an automated email from the ASF dual-hosted git repository. jerpelea pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/nuttx.git
commit 65f1e068c67682e08b7d0c5130b897a3bea733e2 Author: Bowen Wang <[email protected]> AuthorDate: Sun Nov 8 12:24:17 2026 +0800 drivers/rpmsg: do not hold rdev->lock while releasing the endpoints rpmsg_device_destory() walks rdev->endpoints with rdev->lock held and calls ns_unbind_cb() or rpmsg_destroy_ept() on each one. rpmsg_destroy_ept() sends NS_DESTROY, and the send may wait for a free tx buffer with metal_sleep_usec(). That is fine while metal_mutex is an rmutex, but sleeping is not allowed once the next patch turns it into a spinlock. The transport has stopped delivering messages by the time the device is destroyed, so nothing else walks the list. Drop the lock around the loop. openamp still takes rdev->lock inside rpmsg_destroy_ept() when it unlinks each endpoint. Signed-off-by: Bowen Wang <[email protected]> --- drivers/rpmsg/rpmsg.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/rpmsg/rpmsg.c b/drivers/rpmsg/rpmsg.c index 9dd33013370..5ce5cb4b20c 100644 --- a/drivers/rpmsg/rpmsg.c +++ b/drivers/rpmsg/rpmsg.c @@ -523,9 +523,10 @@ void rpmsg_device_destroy(FAR struct rpmsg_s *rpmsg) up_read(&g_rpmsg_lock); - /* Release all ept attached to current rpmsg device */ + /* Release all ept attached to current rpmsg device. rdev->lock is not + * held: rpmsg_destroy_ept() sends NS_DESTROY and may wait for a tx buffer. + */ - metal_mutex_acquire(&rdev->lock); metal_list_for_each_safe(&rdev->endpoints, tmp, node) { ept = metal_container_of(node, struct rpmsg_endpoint, node); @@ -538,8 +539,6 @@ void rpmsg_device_destroy(FAR struct rpmsg_s *rpmsg) rpmsg_destroy_ept(ept); } } - - metal_mutex_release(&rdev->lock); } int rpmsg_register(FAR const char *path, FAR struct rpmsg_s *rpmsg,
