On 05-02-20, 15:32, Dan Carpenter wrote:
> When we call kobject_put() and it's the last reference to the kobject
> then it calls gb_audio_module_release() and frees module. We dereference
> "module" on the next line which is a use after free.
>
> Fixes: c77f85bbc91a ("greybus: audio: Fix
On Wed, Feb 5, 2020 at 6:02 PM Dan Carpenter wrote:
>
> When we call kobject_put() and it's the last reference to the kobject
> then it calls gb_audio_module_release() and frees module. We dereference
> "module" on the next line which is a use after free.
>
> Fixes: c77f85bbc91a ("greybus:
When we call kobject_put() and it's the last reference to the kobject
then it calls gb_audio_module_release() and frees module. We dereference
"module" on the next line which is a use after free.
Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'")
Signed-off-by: Dan Carpenter