Skip to content

Commit b45e8ee

Browse files
committed
lib-manager: fix use-after-free
module_adapter_free() called in lib_manager_module_free() frees the device object, dereferencing it after that is invalid and can lead to exceptions. Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
1 parent d677107 commit b45e8ee

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

src/library_manager/lib_manager.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -649,17 +649,16 @@ static struct comp_dev *lib_manager_module_create(const struct comp_driver *drv,
649649

650650
static void lib_manager_module_free(struct comp_dev *dev)
651651
{
652-
struct processing_module *mod = comp_mod(dev);
653-
const struct comp_ipc_config *const config = &mod->dev->ipc_config;
652+
uint32_t component_id = dev->ipc_config.id;
654653
int ret;
655654

656655
/* This call invalidates dev, mod and config pointers! */
657656
module_adapter_free(dev);
658657

659658
/* Free module resources allocated in L2 memory. */
660-
ret = lib_manager_free_module(config->id);
659+
ret = lib_manager_free_module(component_id);
661660
if (ret < 0)
662-
comp_err(dev, "lib_manager_free_module() failed!");
661+
tr_err(&lib_manager_tr, "lib_manager_free_module() failed!");
663662
}
664663

665664
static void lib_manager_prepare_module_adapter(struct comp_driver *drv, const struct sof_uuid *uuid)

0 commit comments

Comments
 (0)