gb_audio_manager_dump_module() drops modules_rwsem before dereferencing the module. A concurrent gb_audio_manager_remove() can free the module between the lookup and the dump.

Keep the read lock held while dumping the module so removal cannot free it during the access.

Signed-off-by: linfordWu linfordwu@163.com --- drivers/staging/greybus/audio_manager.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c index 118ada9b909..1b91acc084f 100644 --- a/drivers/staging/greybus/audio_manager.c +++ b/drivers/staging/greybus/audio_manager.c @@ -117,12 +117,13 @@ int gb_audio_manager_dump_module(int id)

down_read(&modules_rwsem); module = gb_audio_manager_get_locked(id); - up_read(&modules_rwsem); - - if (!module) + if (!module) { + up_read(&modules_rwsem); return -EINVAL; + }

gb_audio_manager_module_dump(module); + up_read(&modules_rwsem); return 0; } EXPORT_SYMBOL_GPL(gb_audio_manager_dump_module);