-
Dan Carpenter authored
When we call kobject_put() and it's the last reference to the kobject then it calls gb_audio_module_release() and frees module. We dereference "module" on the next line which is a use after free. Fixes: c77f85bb ("greybus: audio: Fix incorrect counting of 'ida'") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Acked-by:
Viresh Kumar <viresh.kumar@linaro.org> Reviewed-by:
Vaibhav Agarwal <vaibhav.sr@gmail.com> Link: https://lore.kernel.org/r/20200205123217.jreendkyxulqsool@kili.mountainSigned-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
b7db5810