Claude review: misc: fastrpc: Add missing bug fixes

Claude review: misc: fastrpc: Add missing bug fixes

[Claude Code Review Bot]

Overall Series Review

Subject: misc: fastrpc: Add missing bug fixes
Author: Jianping Li <jianping.li@oss.qualcomm.com>
Patches: 6
Reviewed: 2026-04-12T11:44:33.724906

---

This v4 series addresses memory handling issues in the FastRPC driver's Audio PD remote heap. Patch 1 is a clear, correct bugfix. Patch 2 is a reasonable race-condition fix. Patch 4 is a clean, standard cleanup. However, **Patch 3 has critical bugs** that will cause kernel crashes at module removal time: the `remote_heap` allocated via `kzalloc` in probe has `NULL` `dev` and `fl` fields, so calling `fastrpc_buf_free()` on it dereferences NULL pointers. There are also resource leak issues and use of potentially uninitialized data. The series should not be merged until Patch 3 is reworked.

---

---
Generated by Claude Code Patch Reviewer

[PATCH v5 0/5] misc: fastrpc: Add missing bug fixes

[Jianping Li]

Add missing bug fixes in memory areas. This patch series fixes multiple memory
handling issues in the FastRPC driver, primarily around the Audio PD remote heap.

The Audio PD uses a reserved memory-region that is shared between HLOS
and the DSP. Allocating and freeing this memory from userspace is unsafe,
as the kernel cannot reliably determine when the DSP has finished using
the buffers.

To address this, the entire reserved memory-region for the Audio PD is
now fully assigned to the DSP during remoteproc boot-up, and its lifetime
is tied to the rpmsg channel.

Patch [v4]: https://lore.kernel.org/all/20260409062617.1182-1-jianping.li@oss.qualcomm.com/

Change in v5:
  - Split reserved-memory handling into separate patches

Change in v4:
  - Fail Audio PD static process creation when no reserved memory-region
    is present, instead of silently proceeding

Change in v3:
  - Adjusted the order of the series, placing NULL check changes that are not bug fixes at the end
  - Modified the commit message to describe the bug background in detail
  - Switch buf->list_lock back to fl->lock
  - Add locking to the operation of audio_init_mem

Changes in v2:
  - Remove the if check outside fastrpc_buf_free
  - Store the spinlock pointer in the struct fastrpc_buf instead
  - Allocate entire reserved memory to audio PD through remote heap

Ekansh Gupta (3):
  misc: fastrpc: Fix initial memory allocation for Audio PD memory pool
  misc: fastrpc: Remove buffer from list prior to unmap operation
  misc: fastrpc: Allow fastrpc_buf_free() to accept NULL

Jianping Li (2):
  misc: fastrpc: Fail Audio PD init when reserved memory is missing
  misc: fastrpc: Allocate entire reserved memory for Audio PD in probe

 drivers/misc/fastrpc.c | 135 ++++++++++++++++++++++-------------------
 1 file changed, 71 insertions(+), 64 deletions(-)

-- 
2.43.0

Claude review: misc: fastrpc: Add missing bug fixes

[Claude Code Review Bot]

Overall Series Review

Subject: misc: fastrpc: Add missing bug fixes
Author: Jianping Li <jianping.li@oss.qualcomm.com>
Patches: 10
Reviewed: 2026-05-16T09:09:53.913817

---

This v5 series addresses multiple memory handling bugs in the FastRPC Audio PD remote heap. The first three patches are self-contained bug fixes with `Fixes:` tags and `Cc: stable`, while patches 4-5 are structural improvements that supersede some of the earlier fixes in mainline.

The series has a **sound overall design**: moving Audio PD reserved-memory allocation to rpmsg probe and tying its lifetime to the channel is the right approach. However, **patch 4 has two memory leak bugs in error paths** and an unconditional `audio_init_mem = false` reset that can affect concurrent users. Patch 2 is solid and correctly addresses the race. Patches 1, 3, and 5 are clean fixes/cleanups.

**Recommendation:** Patches 1, 2, 3, and 5 look good. Patch 4 needs fixes for the error paths in probe and the `err_invoke` label logic before it can be merged.

---

---
Generated by Claude Code Patch Reviewer

Claude review: misc: fastrpc: Add missing bug fixes

[Claude Code Review Bot]

Overall Series Review

Subject: misc: fastrpc: Add missing bug fixes
Author: Jianping Li <jianping.li@oss.qualcomm.com>
Patches: 1
Reviewed: 2026-05-16T09:15:13.576580

---

This is a 5-patch series fixing memory management issues in the FastRPC driver, focused on the Audio PD remote heap. The core problem is well-motivated: userspace-controlled alloc/free of the reserved memory region shared with the DSP is unsafe because the kernel cannot know when the DSP is done with the buffers. The solution moves the reserved memory lifecycle to be tied to the rpmsg channel (probe/remove).

The series has some real fixes (patches 1, 2) and a significant architectural change (patch 4) that restructures how Audio PD memory is handled. However, **patch 4 has several concerning issues** including a memory leak on error, incomplete initialization of the `remote_heap` struct, and questionable use of a spinlock around non-atomic operations. Patch 3 is effectively superseded by patch 4 — it adds validation that patch 4 then restructures, making the Fixes/stable tags on patch 3 questionable.

---
Generated by Claude Code Patch Reviewer