[PATCH] netfilter: IDLETIMER: fix race condition when destroy the target

[PATCH] netfilter: IDLETIMER: fix race condition when destroy the target

[Liping Zhang]

From: Liping Zhang <liping.zhang@spreadtrum.com>

Workqueue maybe still in running while we destroy the IDLETIMER target,
thus cause a use after free error, add cancel_work_sync() to avoid such
situation.

Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
---
 net/netfilter/xt_IDLETIMER.c |    1 +
 1 file changed, 1 insertion(+)

diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c
index 29d2c31..daf45da 100644
--- a/net/netfilter/xt_IDLETIMER.c
+++ b/net/netfilter/xt_IDLETIMER.c
@@ -236,6 +236,7 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par)
 
 		list_del(&info->timer->entry);
 		del_timer_sync(&info->timer->timer);
+		cancel_work_sync(&info->timer->work);
 		sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);
 		kfree(info->timer->attr.attr.name);
 		kfree(info->timer);
-- 
1.7.9.5

Re: [PATCH] netfilter: IDLETIMER: fix race condition when destroy the target

[Pablo Neira Ayuso]

On Thu, Apr 21, 2016 at 12:47:08AM -0700, Liping Zhang wrote:
> From: Liping Zhang <liping.zhang@spreadtrum.com>
> 
> Workqueue maybe still in running while we destroy the IDLETIMER target,
> thus cause a use after free error, add cancel_work_sync() to avoid such
> situation.

Applied, thanks.