Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit dea78350 authored by Raghavendra Rao Ananta's avatar Raghavendra Rao Ananta Committed by Venkata Narendra Kumar Gutta
Browse files

soc: qcom: pil: Fix use-after-free bug when loading firmware images



Currently, the function pil_load_segs() allocates memory, creates
kthreads, and calls wait_for_completion_interruptible() to synchronize
the threads. However, if the completion received a terminate signal,
the allocated memory that is being used by the threads (under execution)
is freed. When the thread(s) tries to access this memory, it leads to
a use-after-free bug.

As a solution, replace the kthreads and completions with work items
as this provides an implicit synchronization. After spawning the
work items, we simply now call flush_work() which waits until
the thread's execution is finished, thus avoiding the use-after-free
bug. The PIL code creates it own high priority & unbounded workqueue
to schedule the work items.

Change-Id: Ieffdecfe333a96f9762c7dfbc693c6c1f39a10ce
Signed-off-by: default avatarRaghavendra Rao Ananta <rananta@codeaurora.org>
[vgutta@codeaurora.org: Resolved trivial merge conflicts]
Signed-off-by: default avatarVenkata Narendra Kumar Gutta <vnkgutta@codeaurora.org>
parent 3fd8df66
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment