[BUG] misc: fastrpc: possible double-free of cctx->remote_heap

While reviewing drivers/misc/fastrpc.c, I noticed a potential lifetime issue around struct fastrpc_buf *remote_heap; In fastrpc_init_create_static_process(), the error path err_map: frees fl->cctx->remote_heap but does not clear the pointer(set to NULL). Later, in fastrpc_rpmsg_remove(), the code frees cctx->remote_heap again if it is non-NULL.

Call paths (as I understand them)

1) First free (ioctl error path):

fastrpc_fops.unlocked_ioctl → fastrpc_device_ioctl() FASTRPC_IOCTL_INIT_CREATE_STATIC → fastrpc_init_create_static_process() err_map: → fastrpc_buf_free(fl->cctx->remote_heap) (pointer not cleared)

2) Second free (rpmsg remove path):

rpmsg driver .remove → fastrpc_rpmsg_remove() if (cctx->remote_heap) fastrpc_buf_free(cctx->remote_heap);