Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cec5913c authored by Liping Zhang's avatar Liping Zhang Committed by Pablo Neira Ayuso
Browse files

netfilter: IDLETIMER: fix race condition when destroy the target 



Workqueue maybe still in running while we destroy the IDLETIMER target,
thus cause a use after free error, add cancel_work_sync() to avoid such
situation.

Signed-off-by: default avatarLiping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 70d72b7e

net/netfilter/xt_IDLETIMER.c

+1 −0
Original line number Diff line number Diff line
@@ -236,6 +236,7 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par) 


		list_del(&info->timer->entry);

		del_timer_sync(&info->timer->timer);

		cancel_work_sync(&info->timer->work);

		sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);

		kfree(info->timer->attr.attr.name);

		kfree(info->timer);