Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02562c26 authored by Patrick Daly's avatar Patrick Daly Committed by Susheel Yadagiri
Browse files

netfilter: xt_HARDIDLETIMER: Fix use after free condition 



Force any pending hardidletimer_tg_work() to complete before freeing
the associated work struct.

CRs-Fixed: 814707
Change-Id: I57b2f0dcd24f05ddb472d6007525d1722f9fe0b0
Signed-off-by: default avatarPatrick Daly <pdaly@codeaurora.org>
parent 114513c1

net/netfilter/xt_HARDIDLETIMER.c

+2 −1
Original line number Diff line number Diff line
@@ -4,7 +4,7 @@ 
 * Netfilter module to trigger a timer when packet matches.

 * After timer expires a kevent will be sent.

 *

 * Copyright (c) 2014, The Linux Foundation. All rights reserved.

 * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

 *

 * Copyright (C) 2004, 2010 Nokia Corporation

 *
@@ -299,6 +299,7 @@ static void hardidletimer_tg_destroy(const struct xt_tgdtor_param *par) 


		list_del(&info->timer->entry);

		alarm_cancel(&info->timer->alarm);

		cancel_work_sync(&info->timer->work);

		sysfs_remove_file(hardidletimer_tg_kobj,

				&info->timer->attr.attr);

		kfree(info->timer->attr.attr.name);