Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8a6e77d5 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

decnet: proper socket refcounting 



Better use sk_reset_timer() / sk_stop_timer() helpers to make sure we
dont access already freed/reused memory later.

Reported-by: default avatarSasha Levin <levinsasha928@gmail.com>
Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Tested-by: default avatarSasha Levin <levinsasha928@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fc0b927d

net/decnet/dn_timer.c

+5 −12
Original line number Diff line number Diff line
@@ -36,16 +36,13 @@ static void dn_slow_timer(unsigned long arg); 


void dn_start_slow_timer(struct sock *sk)

{

	sk->sk_timer.expires	= jiffies + SLOW_INTERVAL;

	sk->sk_timer.function	= dn_slow_timer;

	sk->sk_timer.data	= (unsigned long)sk;



	add_timer(&sk->sk_timer);

	setup_timer(&sk->sk_timer, dn_slow_timer, (unsigned long)sk);

	sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);

}



void dn_stop_slow_timer(struct sock *sk)

{

	del_timer(&sk->sk_timer);

	sk_stop_timer(sk, &sk->sk_timer);

}



static void dn_slow_timer(unsigned long arg)
@@ -53,12 +50,10 @@ static void dn_slow_timer(unsigned long arg) 
	struct sock *sk = (struct sock *)arg;

	struct dn_scp *scp = DN_SK(sk);



	sock_hold(sk);

	bh_lock_sock(sk);



	if (sock_owned_by_user(sk)) {

		sk->sk_timer.expires = jiffies + HZ / 10;

		add_timer(&sk->sk_timer);

		sk_reset_timer(sk, &sk->sk_timer, jiffies + HZ / 10);

		goto out;

	}
@@ -100,9 +95,7 @@ static void dn_slow_timer(unsigned long arg) 
			scp->keepalive_fxn(sk);

	}



	sk->sk_timer.expires = jiffies + SLOW_INTERVAL;



	add_timer(&sk->sk_timer);

	sk_reset_timer(sk, &sk->sk_timer, jiffies + SLOW_INTERVAL);

out:

	bh_unlock_sock(sk);

	sock_put(sk);