On 01-10-2026 16:31, Vinayak Katoch wrote:
> When a fastrpc client process dies abnormally without closing its file
> descriptor, fastrpc_device_release() is never called and the compute-cb
> session slot is never freed. The abnormal client death on the DSP side
> triggers a glink channel teardown which propagates up through the rpmsg
> bus and calls fastrpc_rpmsg_remove().
>
> fastrpc_rpmsg_remove() nulls cctx->rpdev before calling
> misc_deregister(). If a concurrent open() enters fastrpc_device_open()
> in this window and fastrpc_session_alloc() returns NULL (sessions
> exhausted by the leaked slot), the error path dereferences
> cctx->rpdev->dev causing a NULL pointer dereference:
>
> Unable to handle kernel NULL pointer dereference at virtual address
> 0000000000000000
> pc : fastrpc_device_open+0x1b8/0x258 [fastrpc]
> Call trace:
> fastrpc_device_open+0x1b8/0x258 [fastrpc] (P)
> misc_open+0xd8/0x1a0
>
> Fix by moving misc_deregister() before rpdev = NULL. misc_open() and
> misc_deregister() both take misc_mtx, so misc_deregister() will either
> block until fastrpc_device_open() completes or prevent new opens from
> entering it entirely.
>
> Fixes: 7c11df42d0c7 ("misc: fastrpc: Fix device_open when no session is
> available")
> Signed-off-by: Vinayak Katoch <[email protected]>
Reviewed-by: Ekansh Gupta <[email protected]>
