summaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorLiping Zhang <liping.zhang@spreadtrum.com>2016-04-21 00:47:08 -0700
committerPablo Neira Ayuso <pablo@netfilter.org>2016-04-29 14:28:48 +0200
commitcec5913c1515e5619907016658838af4eff78dd3 (patch)
tree2234e8be967f350c2d39fd7c7b154ef4973e5442 /net
parent70d72b7e060e0a16b9ded9d0fbd3dff109743de3 (diff)
downloadlinux-cec5913c1515e5619907016658838af4eff78dd3.tar.bz2
netfilter: IDLETIMER: fix race condition when destroy the target
Workqueue maybe still in running while we destroy the IDLETIMER target, thus cause a use after free error, add cancel_work_sync() to avoid such situation. Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net')
-rw-r--r--net/netfilter/xt_IDLETIMER.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 29d2c31f406c..daf45da448fa 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -236,6 +236,7 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
list_del(&info->timer->entry);
del_timer_sync(&info->timer->timer);
+ cancel_work_sync(&info->timer->work);
sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
kfree(info->timer->attr.attr.name);
kfree(info->timer);