Skip to content

Commit 4b25a54

Browse files
committed
lib-manager: fix use-after-free
module_adapter_free() called in lib_manager_module_free() frees the device object, dereferencing it after that is invalid and can lead to exceptions. Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
1 parent d677107 commit 4b25a54

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

src/library_manager/lib_manager.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -650,16 +650,16 @@ static struct comp_dev *lib_manager_module_create(const struct comp_driver *drv,
650650
static void lib_manager_module_free(struct comp_dev *dev)
651651
{
652652
struct processing_module *mod = comp_mod(dev);
653-
const struct comp_ipc_config *const config = &mod->dev->ipc_config;
653+
uint32_t component_id = mod->dev->ipc_config.id;
654654
int ret;
655655

656656
/* This call invalidates dev, mod and config pointers! */
657657
module_adapter_free(dev);
658658

659659
/* Free module resources allocated in L2 memory. */
660-
ret = lib_manager_free_module(config->id);
660+
ret = lib_manager_free_module(component_id);
661661
if (ret < 0)
662-
comp_err(dev, "lib_manager_free_module() failed!");
662+
tr_err(&lib_manager_tr, "lib_manager_free_module() failed!");
663663
}
664664

665665
static void lib_manager_prepare_module_adapter(struct comp_driver *drv, const struct sof_uuid *uuid)

0 commit comments

Comments
 (0)