Duoming Zhou fd819ad3ec ax25: fix use-after-free bugs caused by ax25_ds_del_timer ... When the ax25 device is detaching, the ax25_dev_device_down() calls ax25_ds_del_timer() to cleanup the slave_timer. When the timer handler is running, the ax25_ds_del_timer() that calls del_timer() in it will return directly. As a result, the use-after-free bugs could happen, one of the scenarios is shown below: (Thread 1) | (Thread 2) | ax25_ds_timeout() ax25_dev_device_down() | ax25_ds_del_timer() | del_timer() | ax25_dev_put() //FREE | | ax25_dev-> //USE In order to mitigate bugs, when the device is detaching, use timer_shutdown_sync() to stop the timer. Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Duoming Zhou <duoming@zju.edu.cn> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://lore.kernel.org/r/20240329015023.9223-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2024-04-02 17:59:44 -07:00
..
af_ax25.c	net: implement lockless SO_PRIORITY	2023-10-01 19:09:54 +01:00
ax25_addr.c
ax25_dev.c	ax25: fix use-after-free bugs caused by ax25_ds_del_timer	2024-04-02 17:59:44 -07:00
ax25_ds_in.c
ax25_ds_subr.c
ax25_ds_timer.c
ax25_iface.c
ax25_in.c
ax25_ip.c
ax25_out.c
ax25_route.c
ax25_std_in.c
ax25_std_subr.c
ax25_std_timer.c
ax25_subr.c
ax25_timer.c
ax25_uid.c
Kconfig	ax25: Kconfig: Update link for linux-ax25.org	2023-09-18 12:56:58 +01:00
Makefile
sysctl_net_ax25.c