Skip to content

Commit 36c01fc

Browse files
committed
lib_manager: fix potential issue with llext_unload
The function llext_unload was modifying a stack variable and not the actual private member holding the reference. This could have lead to a double free or invalid access to a freed llext structure. Signed-off-by: Luca Burelli <l.burelli@arduino.cc>
1 parent 7d21e90 commit 36c01fc

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

src/library_manager/lib_manager.c

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -553,15 +553,17 @@ static struct comp_dev *lib_manager_module_create(const struct comp_driver *drv,
553553
static void lib_manager_module_free(struct comp_dev *dev)
554554
{
555555
struct processing_module *mod = comp_mod(dev);
556-
struct llext *llext = mod->priv.llext;
557556
const struct comp_ipc_config *const config = &mod->dev->ipc_config;
558557
const uint32_t module_id = config->id;
559-
int ret;
558+
int ret = 0;
560559

561560
/* This call invalidates dev, mod and config pointers! */
562561
module_adapter_free(dev);
563562

564-
if (!llext || !llext_unload(&llext)) {
563+
if (mod->priv.llext) {
564+
ret = llext_unload(&mod->priv.llext);
565+
}
566+
if (!ret) {
565567
/* Free module resources allocated in L2 memory. */
566568
ret = lib_manager_free_module(module_id);
567569
if (ret < 0)

0 commit comments

Comments
 (0)