[BUG] misc: fastrpc: possible double-free of cctx->remote_heap

[BUG] misc: fastrpc: possible double-free of cctx->remote_heap

[Xingjing Deng]

While reviewing drivers/misc/fastrpc.c, I noticed a potential lifetime
issue around struct fastrpc_buf *remote_heap;
In fastrpc_init_create_static_process(), the error path err_map: frees
fl->cctx->remote_heap but does not clear the pointer(set to NULL).
Later, in fastrpc_rpmsg_remove(), the code frees cctx->remote_heap
again if it is non-NULL.

Call paths (as I understand them)

1) First free (ioctl error path):

fastrpc_fops.unlocked_ioctl → fastrpc_device_ioctl()
FASTRPC_IOCTL_INIT_CREATE_STATIC → fastrpc_init_create_static_process()
err_map: → fastrpc_buf_free(fl->cctx->remote_heap) (pointer not cleared)

2) Second free (rpmsg remove path):

rpmsg driver .remove → fastrpc_rpmsg_remove()
if (cctx->remote_heap) fastrpc_buf_free(cctx->remote_heap);

Re: [BUG] misc: fastrpc: possible double-free of cctx->remote_heap

[Greg KH]

On Mon, Jan 12, 2026 at 04:15:01PM +0800, Xingjing Deng wrote:
> While reviewing drivers/misc/fastrpc.c, I noticed a potential lifetime
> issue around struct fastrpc_buf *remote_heap;
> In fastrpc_init_create_static_process(), the error path err_map: frees
> fl->cctx->remote_heap but does not clear the pointer(set to NULL).
> Later, in fastrpc_rpmsg_remove(), the code frees cctx->remote_heap
> again if it is non-NULL.
> 
> Call paths (as I understand them)
> 
> 1) First free (ioctl error path):
> 
> fastrpc_fops.unlocked_ioctl → fastrpc_device_ioctl()
> FASTRPC_IOCTL_INIT_CREATE_STATIC → fastrpc_init_create_static_process()
> err_map: → fastrpc_buf_free(fl->cctx->remote_heap) (pointer not cleared)
> 
> 2) Second free (rpmsg remove path):
> 
> rpmsg driver .remove → fastrpc_rpmsg_remove()
> if (cctx->remote_heap) fastrpc_buf_free(cctx->remote_heap);
> 

Hi,

Please note, stable@vger is not the email address to be asking about
this, it is only for stable kernel release stuff.

Andn do you have a potential patch to resolve this issue?  That's the
simplest way to get it fixed up and to show what you are discussing.

thanks,

greg k-h

Re: [BUG] misc: fastrpc: possible double-free of cctx->remote_heap

[Xingjing Deng]

Hi,v2 will add the missing tags:
Fixes: 0871561055e66 ("misc: fastrpc: Add support for audiopd")
Cc: stable@vger.kernel.org # 6.2+
I’m having trouble sending v2 via git send-email at the moment; I will
resend the actual v2 patch as soon as SMTP is working (or attach the
generated patch file if needed).
Thanks, Xingjing Deng.

Greg KH <gregkh@linuxfoundation.org> 于2026年1月12日周一 16:20写道：
>
> On Mon, Jan 12, 2026 at 04:15:01PM +0800, Xingjing Deng wrote:
> > While reviewing drivers/misc/fastrpc.c, I noticed a potential lifetime
> > issue around struct fastrpc_buf *remote_heap;
> > In fastrpc_init_create_static_process(), the error path err_map: frees
> > fl->cctx->remote_heap but does not clear the pointer(set to NULL).
> > Later, in fastrpc_rpmsg_remove(), the code frees cctx->remote_heap
> > again if it is non-NULL.
> >
> > Call paths (as I understand them)
> >
> > 1) First free (ioctl error path):
> >
> > fastrpc_fops.unlocked_ioctl → fastrpc_device_ioctl()
> > FASTRPC_IOCTL_INIT_CREATE_STATIC → fastrpc_init_create_static_process()
> > err_map: → fastrpc_buf_free(fl->cctx->remote_heap) (pointer not cleared)
> >
> > 2) Second free (rpmsg remove path):
> >
> > rpmsg driver .remove → fastrpc_rpmsg_remove()
> > if (cctx->remote_heap) fastrpc_buf_free(cctx->remote_heap);
> >
>
> Hi,
>
> Please note, stable@vger is not the email address to be asking about
> this, it is only for stable kernel release stuff.
>
> Andn do you have a potential patch to resolve this issue?  That's the
> simplest way to get it fixed up and to show what you are discussing.
>
> thanks,
>
> greg k-h