Attempt to fix NULL pointer dereference

chardev.c

@@ -95,6 +95,8 @@ int tenstorrent_register_device(struct tenstorrent_device *tt_dev)
 	tt_dev->dev.id = tt_dev->ordinal;
 	dev_set_name(&tt_dev->dev, TENSTORRENT "/%d", tt_dev->ordinal);
 
+	INIT_LIST_HEAD(&tt_dev->open_fds_list);
+
 	cdev_init(&tt_dev->chardev, &chardev_fops);
 	return cdev_device_add(&tt_dev->chardev, &tt_dev->dev);
 }
@@ -376,6 +378,10 @@ static int tt_cdev_open(struct inode *inode, struct file *file)
 	private_data->device = tt_dev;
 	file->private_data = private_data;
 
+	mutex_lock(&tt_dev->chardev_mutex);
+	list_add(&private_data->open_fd, &tt_dev->open_fds_list);
+	mutex_unlock(&tt_dev->chardev_mutex);
+
 	increment_cdev_open_count(tt_dev);
 
 	return 0;
@@ -400,6 +406,10 @@ static int tt_cdev_release(struct inode *inode, struct file *file)
 
 	tenstorrent_device_put(tt_dev);
 
+	mutex_lock(&tt_dev->chardev_mutex);
+	list_del(&priv->open_fd);
+	mutex_unlock(&tt_dev->chardev_mutex);
+
 	kfree(file->private_data);
 	file->private_data = NULL;
 	return 0;

chardev_private.h

@@ -33,6 +33,8 @@ struct chardev_private {
 	struct list_head peer_mappings; // struct peer_resource_mapping.list
 
 	DECLARE_BITMAP(resource_lock, TENSTORRENT_RESOURCE_LOCK_COUNT);
+
+	struct list_head open_fd;	// node in struct tenstorrent_device.open_fds_list
 };
 
 struct chardev_private *get_tenstorrent_priv(struct file *f);

device.h

@@ -37,6 +37,8 @@ struct tenstorrent_device {
 
 	struct tt_hwmon_context hwmon_context;
 	struct tt_attribute_data *attributes;
+
+	struct list_head open_fds_list;	// List of struct chardev_private, linked through open_fds field
 };
 
 struct tenstorrent_device_class {

enumerate.c

@@ -8,12 +8,15 @@
 #include <linux/mutex.h>
 #include <linux/version.h>
 #include <linux/pm.h>
+#include <linux/list.h>
 
 #include "enumerate.h"
 #include "interrupt.h"
 #include "chardev.h"
 #include "grayskull.h"
 #include "module.h"
+#include "memory.h"
+#include "chardev_private.h"
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 0, 0)
 #define pci_enable_pcie_error_reporting(dev) do { } while (0)
@@ -116,6 +119,11 @@ static int tenstorrent_pci_probe(struct pci_dev *dev, const struct pci_device_id
 static void tenstorrent_pci_remove(struct pci_dev *dev)
 {
 	struct tenstorrent_device *tt_dev = pci_get_drvdata(dev);
+	struct chardev_private *priv, *tmp;
+
+	list_for_each_entry_safe(priv, tmp, &tt_dev->open_fds_list, open_fd) {
+		tenstorrent_memory_cleanup(priv);
+	}
 
 	if (tt_dev->attributes) {
 		struct tt_attribute_data *data = tt_dev->attributes;

memory.c

@@ -763,6 +763,8 @@ void tenstorrent_memory_cleanup(struct chardev_private *priv)
 	unsigned int i;
 	struct peer_resource_mapping *peer_mapping, *tmp_peer_mapping;
 
+	mutex_lock(&priv->mutex);
+
 	hash_for_each_safe(priv->dmabufs, i, tmp_dmabuf, dmabuf, hash_chain) {
 		dma_free_coherent(&tt_dev->pdev->dev, dmabuf->size, dmabuf->ptr, dmabuf->phys);
 
@@ -780,4 +782,6 @@ void tenstorrent_memory_cleanup(struct chardev_private *priv)
 		list_del(&peer_mapping->list);
 		kfree(peer_mapping);
 	}
+
+	mutex_unlock(&priv->mutex);
 }