soc: qcom: pil: Fix use-after-free bug when loading firmware images
Currently, the function pil_load_segs() allocates memory, creates
kthreads, and calls wait_for_completion_interruptible() to synchronize
the threads. However, if the completion received a terminate signal,
the allocated memory that is being used by the threads (under execution)
is freed. When the thread(s) tries to access this memory, it leads to
a use-after-free bug.
As a solution, replace the kthreads and completions with work items
as this provides an implicit synchronization. After spawning the
work items, we simply now call flush_work() which waits until
the thread's execution is finished, thus avoiding the use-after-free
bug. The PIL code creates it own high priority & unbounded workqueue
to schedule the work items.
Change-Id: Ieffdecfe333a96f9762c7dfbc693c6c1f39a10ce
Signed-off-by:
Raghavendra Rao Ananta <rananta@codeaurora.org>
Loading
Please register or sign in to comment