From b45e8ee517df54877c470dca956ee5a401f3a6c0 Mon Sep 17 00:00:00 2001 From: Guennadi Liakhovetski Date: Thu, 21 Aug 2025 14:41:47 +0200 Subject: [PATCH] lib-manager: fix use-after-free module_adapter_free() called in lib_manager_module_free() frees the device object, dereferencing it after that is invalid and can lead to exceptions. Signed-off-by: Guennadi Liakhovetski --- src/library_manager/lib_manager.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/library_manager/lib_manager.c b/src/library_manager/lib_manager.c index c153c61a308b..31308d846e2a 100644 --- a/src/library_manager/lib_manager.c +++ b/src/library_manager/lib_manager.c @@ -649,17 +649,16 @@ static struct comp_dev *lib_manager_module_create(const struct comp_driver *drv, static void lib_manager_module_free(struct comp_dev *dev) { - struct processing_module *mod = comp_mod(dev); - const struct comp_ipc_config *const config = &mod->dev->ipc_config; + uint32_t component_id = dev->ipc_config.id; int ret; /* This call invalidates dev, mod and config pointers! */ module_adapter_free(dev); /* Free module resources allocated in L2 memory. */ - ret = lib_manager_free_module(config->id); + ret = lib_manager_free_module(component_id); if (ret < 0) - comp_err(dev, "lib_manager_free_module() failed!"); + tr_err(&lib_manager_tr, "lib_manager_free_module() failed!"); } static void lib_manager_prepare_module_adapter(struct comp_driver *drv, const struct sof_uuid *uuid)