Skip to content

Commit 53da97f

Browse files
Daniel Balutadbaluta
authored andcommitted
module_adapter: generic: Fix use after free
Remove any containers from the free container list so that we don't keep pointers to containers that are no longer used and will be freed when container chunks are released below. Leaving those nodes in the free container list would cause use-after-free on subsequent allocations. While at it, make sure all resource lists are reset. Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
1 parent b2a138b commit 53da97f

File tree

1 file changed

+13
-0
lines changed

1 file changed

+13
-0
lines changed

src/audio/module_adapter/module/generic.c

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,13 +594,26 @@ void mod_free_all(struct processing_module *mod)
594594
list_item_del(&container->list);
595595
}
596596

597+
list_for_item_safe(list, _list, &res->free_cont_list) {
598+
struct module_resource *container =
599+
container_of(list, struct module_resource, list);
600+
601+
list_item_del(&container->list);
602+
}
603+
597604
list_for_item_safe(list, _list, &res->cont_chunk_list) {
598605
struct container_chunk *chunk =
599606
container_of(list, struct container_chunk, chunk_list);
600607

601608
list_item_del(&chunk->chunk_list);
602609
rfree(chunk);
603610
}
611+
612+
/* Make sure resource lists and accounting are reset */
613+
list_init(&res->res_list);
614+
list_init(&res->free_cont_list);
615+
list_init(&res->cont_chunk_list);
616+
res->heap_usage = 0;
604617
}
605618
EXPORT_SYMBOL(mod_free_all);
606619

0 commit comments

Comments
 (0)