Re: [PATCH] remoteproc: qcom_q6v5_wcss: Fix missing subdev cleanup in q6v5_wcss_remove()

[Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>]

On 10/6/26 9:29 AM, Anup Vishwakarma wrote:
> q6v5_wcss_remove() omits the cleanup for the sysmon, glink, and ssr
> subdevices that are registered in q6v5_wcss_probe(). This leaves these
> subdevices registered in the rproc subdev list after driver unbind,
> which can cause use-after-free if the rproc framework subsequently
> accesses them.
> 
> Additionally, rproc_del() is currently called after the subdev cleanup,
> but it must be called first. rproc_del() internally calls rproc_stop(),
> which invokes rproc_stop_subdevices() and rproc_unprepare_subdevices()
> to run each subdev's stop/unprepare callbacks. If subdevices are removed
> from the list before rproc_del(), those callbacks are never invoked.
> The correct order, as used in sibling drivers such as adsp_remove() and
> wcnss_remove(), is to call rproc_del() first, then remove the subdevices.
> 
> Fix both issues by calling rproc_del() first, then removing all
> registered subdevices. qcom_remove_sysmon_subdev() already handles a
> NULL argument gracefully, so it can be called unconditionally for
> platforms where the sysmon subdev is not registered.
> 
> Fixes: 8a226e2c71bb ("remoteproc: wcss: add support for rpmsg communication")
> Signed-off-by: Anup Vishwakarma <anup.vishwakarma@oss.qualcomm.com>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>

Konrad