soc: qcom: pil: Fix use-after-free bug when loading firmware images
Currently, the function pil_load_segs() allocates memory, creates kthreads, and calls wait_for_completion_interruptible() to synchronize the threads. However, if the completion received a terminate signal, the allocated memory that is being used by the threads (under execution) is freed. When the thread(s) tries to access this memory, it leads to a use-after-free bug. As a solution, replace the kthreads and completions with work items as this provides an implicit synchronization. After spawning the work items, we simply now call flush_work() which waits until the thread's execution is finished, thus avoiding the use-after-free bug. The PIL code creates it own high priority & unbounded workqueue to schedule the work items. Change-Id: Ieffdecfe333a96f9762c7dfbc693c6c1f39a10ce Signed-off-by:Raghavendra Rao Ananta <rananta@codeaurora.org> [vgutta@codeaurora.org: Resolved trivial merge conflicts] Signed-off-by:
Venkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
Loading
Please register or sign in to comment