Messages in this thread | | | Date | Thu, 22 Sep 2022 06:35:10 -0700 | From | Jakub Kicinski <> | Subject | Re: [PATCH] mISDN: fix use-after-free bugs in l1oip timer handlers |
| |
On Tue, 20 Sep 2022 19:57:16 +0800 Duoming Zhou wrote: > - if (timer_pending(&hc->keep_tl)) > - del_timer(&hc->keep_tl); > + del_timer_sync(&hc->keep_tl); > > - if (timer_pending(&hc->timeout_tl)) > - del_timer(&hc->timeout_tl); > + del_timer_sync(&hc->timeout_tl); > > cancel_work_sync(&hc->workq);
There needs to be some more cleverness here. hc->workq and hc->socket_thread can kick those timers right back in.
| |