Skip to content

module_adapter: generic: Fix use after free #10297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dbaluta merged 2 commits into from
Oct 19, 2025
Merged

module_adapter: generic: Fix use after free #10297

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c952d07
module_adapter: generic: Introduce mod_generic_init
dbaluta Oct 16, 2025
fb17ec9
module_adapter: generic: Fix use after free
dbaluta Oct 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 24 additions & 9 deletions src/audio/module_adapter/module/generic.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,10 +71,20 @@ int module_load_config(struct comp_dev *dev, const void *cfg, size_t size)
return ret;
}

static void mod_resource_init(struct processing_module *mod)
{
struct module_data *md = &mod->priv;
/* Init memory list */
list_init(&md->resources.res_list);
list_init(&md->resources.free_cont_list);
list_init(&md->resources.cont_chunk_list);
md->resources.heap_usage = 0;
md->resources.heap_high_water_mark = 0;
}

int module_init(struct processing_module *mod)
{
int ret;
struct module_data *md = &mod->priv;
struct comp_dev *dev = mod->dev;
const struct module_interface *const interface = dev->drv->adapter_ops;

Expand All @@ -99,14 +109,9 @@ int module_init(struct processing_module *mod)
return -EIO;
}

/* Init memory list */
list_init(&md->resources.res_list);
list_init(&md->resources.free_cont_list);
list_init(&md->resources.cont_chunk_list);
md->resources.heap_usage = 0;
md->resources.heap_high_water_mark = 0;
mod_resource_init(mod);
#if CONFIG_MODULE_MEMORY_API_DEBUG && defined(__ZEPHYR__)
md->resources.rsrc_mngr = k_current_get();
mod->priv.resources.rsrc_mngr = k_current_get();
#endif
/* Now we can proceed with module specific initialization */
ret = interface->init(mod);
Expand All @@ -117,7 +122,7 @@ int module_init(struct processing_module *mod)

comp_dbg(dev, "done");
#if CONFIG_IPC_MAJOR_3
md->state = MODULE_INITIALIZED;
mod->priv.state = MODULE_INITIALIZED;
#endif

return 0;
Expand Down Expand Up @@ -594,13 +599,23 @@ void mod_free_all(struct processing_module *mod)
list_item_del(&container->list);
Copy link
Contributor

@jsarha jsarha Oct 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually also this list_item_del()-call could be removed now that &res->res_list is also reinitialized at the end of the function when mod_resource_init() is called.

}

list_for_item_safe(list, _list, &res->free_cont_list) {
struct module_resource *container =
container_of(list, struct module_resource, list);

list_item_del(&container->list);
Copy link
Contributor

@jsarha jsarha Oct 17, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There should be no need to do this anymore, after the mod_resource_init(mod) call was added. It will reinitialize &res->free_cont_list at the end of the function. No need to remove the containers one by one.

}

list_for_item_safe(list, _list, &res->cont_chunk_list) {
struct container_chunk *chunk =
container_of(list, struct container_chunk, chunk_list);

list_item_del(&chunk->chunk_list);
rfree(chunk);
}

/* Make sure resource lists and accounting are reset */
mod_resource_init(mod);
}
EXPORT_SYMBOL(mod_free_all);

Expand Down
Loading