While reviewing drivers/misc/fastrpc.c, I noticed a potential lifetime issue around struct fastrpc_buf *remote_heap; In fastrpc_init_create_static_process(), the error path err_map: frees fl->cctx->remote_heap but does not clear the pointer(set to NULL). Later, in fastrpc_rpmsg_remove(), the code frees cctx->remote_heap again if it is non-NULL.
Call paths (as I understand them) 1) First free (ioctl error path): fastrpc_fops.unlocked_ioctl → fastrpc_device_ioctl() FASTRPC_IOCTL_INIT_CREATE_STATIC → fastrpc_init_create_static_process() err_map: → fastrpc_buf_free(fl->cctx->remote_heap) (pointer not cleared) 2) Second free (rpmsg remove path): rpmsg driver .remove → fastrpc_rpmsg_remove() if (cctx->remote_heap) fastrpc_buf_free(cctx->remote_heap);
