Re: [greybus-dev] [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()

2020-02-06 Thread Viresh Kumar
On 05-02-20, 15:32, Dan Carpenter wrote: > When we call kobject_put() and it's the last reference to the kobject > then it calls gb_audio_module_release() and frees module. We dereference > "module" on the next line which is a use after free. > > Fixes: c77f85bbc91a ("greybus: audio: Fix

Re: [PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()

2020-02-06 Thread Vaibhav Agarwal
On Wed, Feb 5, 2020 at 6:02 PM Dan Carpenter wrote: > > When we call kobject_put() and it's the last reference to the kobject > then it calls gb_audio_module_release() and frees module. We dereference > "module" on the next line which is a use after free. > > Fixes: c77f85bbc91a ("greybus:

[PATCH] staging: greybus: use after free in gb_audio_manager_remove_all()

2020-02-05 Thread Dan Carpenter
When we call kobject_put() and it's the last reference to the kobject then it calls gb_audio_module_release() and frees module. We dereference "module" on the next line which is a use after free. Fixes: c77f85bbc91a ("greybus: audio: Fix incorrect counting of 'ida'") Signed-off-by: Dan Carpenter