lib_manager: fix potential issue with llext_unload

The function llext_unload was modifying a stack variable and not the actual private member holding the reference. This could have lead to a double free or invalid access to a freed llext structure. Signed-off-by: Luca Burelli <[email protected]>
thesofproject · Feb 13, 2025 · 36c01fc · 36c01fc
1 parent 7d21e90
commit 36c01fc
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/library_manager/lib_manager.c b/src/library_manager/lib_manager.c
@@ -553,15 +553,17 @@ static struct comp_dev *lib_manager_module_create(const struct comp_driver *drv,
 static void lib_manager_module_free(struct comp_dev *dev)
 {
 	struct processing_module *mod = comp_mod(dev);
-	struct llext *llext = mod->priv.llext;
 	const struct comp_ipc_config *const config = &mod->dev->ipc_config;
 	const uint32_t module_id = config->id;
-	int ret;
+	int ret = 0;
 
 	/* This call invalidates dev, mod and config pointers! */
 	module_adapter_free(dev);
 
-	if (!llext || !llext_unload(&llext)) {
+	if (mod->priv.llext) {
+		ret = llext_unload(&mod->priv.llext);
+	}
+	if (!ret) {
 		/* Free module resources allocated in L2 memory. */
 		ret = lib_manager_free_module(module_id);
 		if (ret < 0)