Skip to content

Conversation

@Jianping-Li
Copy link

This patch series adds the listed bug fixes that have been missing in upstream fastRPC driver.
following fixes:

  • Add proper checks to fastrpc_buf_free to avoid potential issues.
  • Add multiple fixes for remote heap which is used by Audio PD.

ekanshibu and others added 4 commits January 16, 2026 17:42
…t crash

The fastrpc_buf_free function currently does not handle the case where
the input buffer pointer (buf) is NULL. This can lead to a null pointer
dereference, causing a crash or undefined behavior when the function
attempts to access members of the buf structure. Add a NULL check to
ensure safe handling of NULL pointers and prevent potential crashes.

Link: https://lore.kernel.org/all/6usjefc55acdchitwe3usqtkr6ca4rtaen3at5knwygakdkze7@caqxdadvnz44/
Fixes: c68cfb7 ("misc: fastrpc: Add support for context Invoke method")
Cc: [email protected]
Co-developed-by: Ekansh Gupta <[email protected]>
Signed-off-by: Ekansh Gupta <[email protected]>
Signed-off-by: Jianping Li <[email protected]>
…emory pool

The initially allocated memory is not properly included in the pool,
leading to potential issues with memory management. The issue is
actually a memory leak because the initial memory is never used by
Audio PD. It will immediately make a remote heap request as no memory is
added to the pool initially. Set the number of pages to one to ensure
that the initially allocated memory is correctly added to the Audio PD
memory pool.

Link: https://lore.kernel.org/all/[email protected]/
Fixes: 0871561 ("misc: fastrpc: Add support for audiopd")
Cc: [email protected]
Co-developed-by: Ekansh Gupta <[email protected]>
Signed-off-by: Ekansh Gupta <[email protected]>
Signed-off-by: Jianping Li <[email protected]>
…tion

fastrpc_req_munmap_impl() is called to unmap any buffer. The buffer is
getting removed from the list after it is unmapped from DSP. This can
create potential race conditions if any other thread removes the entry
from list while unmap operation is ongoing. Remove the entry before
calling unmap operation.

Link: https://lore.kernel.org/all/[email protected]/
Fixes: 2419e55 ("misc: fastrpc: add mmap/unmap support")
Cc: [email protected]
Co-developed-by: Ekansh Gupta <[email protected]>
Signed-off-by: Ekansh Gupta <[email protected]>
Signed-off-by: Jianping Li <[email protected]>
… in probe

The entire reserved-memory region is now assigned to DSP VMIDs during
channel setup and stored in cctx->remote_heap. Memory is reclaimed in
rpmsg_remove by revoking DSP permissions and freeing the buffer, tying
heap lifecycle to the rpmsg channel.

Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Jianping Li <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants