Skip to content

Commit f4e20f3

Browse files
committed
lib_manager: fix potential issue with llext_unload
The function llext_unload was modifying a stack variable and not the actual private member holding the reference. This could have lead to a double free or invalid access to a freed llext structure. Signed-off-by: Luca Burelli <l.burelli@arduino.cc>
1 parent 28ba78b commit f4e20f3

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

src/library_manager/lib_manager.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -554,15 +554,17 @@ static struct comp_dev *lib_manager_module_create(const struct comp_driver *drv,
554554
static void lib_manager_module_free(struct comp_dev *dev)
555555
{
556556
struct processing_module *mod = comp_mod(dev);
557-
struct llext *llext = mod->priv.llext;
558557
const struct comp_ipc_config *const config = &mod->dev->ipc_config;
559558
const uint32_t module_id = config->id;
560-
int ret;
559+
int ret = 0;
561560

562561
/* This call invalidates dev, mod and config pointers! */
563562
module_adapter_free(dev);
564563

565-
if (!llext || !llext_unload(&llext)) {
564+
if (mod->priv.llext) {
565+
ret = llext_unload(&mod->priv.llext);
566+
}
567+
if (!ret) {
566568
/* Free module resources allocated in L2 memory. */
567569
ret = lib_manager_free_module(module_id);
568570
if (ret < 0)

0 commit comments

Comments
 (0)