[PATCH] staging: greybus: fix use-after-free in dump_module

[PATCH] staging: greybus: fix use-after-free in dump_module

[linfordWu]

gb_audio_manager_dump_module() drops modules_rwsem before dereferencing
the module. A concurrent gb_audio_manager_remove() can free the module
between the lookup and the dump.

Keep the read lock held while dumping the module so removal cannot free
it during the access.

Signed-off-by: linfordWu <linfordwu@163.com>
---
 drivers/staging/greybus/audio_manager.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
index 118ada9b909..1b91acc084f 100644
--- a/drivers/staging/greybus/audio_manager.c
+++ b/drivers/staging/greybus/audio_manager.c
@@ -117,12 +117,13 @@ int gb_audio_manager_dump_module(int id)
 
 	down_read(&modules_rwsem);
 	module = gb_audio_manager_get_locked(id);
-	up_read(&modules_rwsem);
-
-	if (!module)
+	if (!module) {
+		up_read(&modules_rwsem);
 		return -EINVAL;
+	}
 
 	gb_audio_manager_module_dump(module);
+	up_read(&modules_rwsem);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(gb_audio_manager_dump_module);
-- 
2.43.0

Re: [PATCH] staging: greybus: fix use-after-free in dump_module

[Dan Carpenter]

On Fri, Oct 30, 2026 at 11:03:55PM +0800, linfordWu wrote:
> gb_audio_manager_dump_module() drops modules_rwsem before dereferencing
> the module. A concurrent gb_audio_manager_remove() can free the module
> between the lookup and the dump.
> 
> Keep the read lock held while dumping the module so removal cannot free
> it during the access.
> 

The patch is correct, but it needs a Fixes tag.

> Signed-off-by: linfordWu <linfordwu@163.com>

The Signed-off-by line is supposed to be a bit formal like signing a
legal document so normally people would use capital letters.

Don't resend patches until after 24 hours and follow all the other
rules.
https://staticthinking.wordpress.com/2022/07/27/how-to-send-a-v2-patch/

regards,
dan carpenter

Re: [PATCH] staging: greybus: fix use-after-free in dump_module

[Greg Kroah-Hartman]

On Fri, Oct 30, 2026 at 11:03:55PM +0800, linfordWu wrote:
> gb_audio_manager_dump_module() drops modules_rwsem before dereferencing
> the module. A concurrent gb_audio_manager_remove() can free the module
> between the lookup and the dump.
> 
> Keep the read lock held while dumping the module so removal cannot free
> it during the access.

How was this found and tested?

> Signed-off-by: linfordWu <linfordwu@163.com>

Real name please.

thanks,

greg k-h