[PATCH] staging: greybus: fix use-after-free in dump_module

[linfordWu]

gb_audio_manager_dump_module() drops modules_rwsem before dereferencing
the module. A concurrent gb_audio_manager_remove() can free the module
between the lookup and the dump.

Keep the read lock held while dumping the module so removal cannot free
it during the access.

Signed-off-by: linfordWu <linfordwu@xxxxxxx>
---
 drivers/staging/greybus/audio_manager.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/greybus/audio_manager.c b/drivers/staging/greybus/audio_manager.c
index 118ada9b909..1b91acc084f 100644
--- a/drivers/staging/greybus/audio_manager.c
+++ b/drivers/staging/greybus/audio_manager.c
@@ -117,12 +117,13 @@ int gb_audio_manager_dump_module(int id)
 
 	down_read(&modules_rwsem);
 	module = gb_audio_manager_get_locked(id);
-	up_read(&modules_rwsem);
-
-	if (!module)
+	if (!module) {
+		up_read(&modules_rwsem);
 		return -EINVAL;
+	}
 
 	gb_audio_manager_module_dump(module);
+	up_read(&modules_rwsem);
 	return 0;
 }
 EXPORT_SYMBOL_GPL(gb_audio_manager_dump_module);
-- 
2.43.0