path: root/net/llc/llc_c_ac.c
diff options
authorCong Wang <xiyou.wangcong@gmail.com>2018-04-19 12:25:38 -0700
committerDavid S. Miller <davem@davemloft.net>2018-04-22 14:55:03 -0400
commitb905ef9ab90115d001c1658259af4b1c65088779 (patch)
tree2eba79255f0ba6a79192f88ee1a3c6caf7326cf9 /net/llc/llc_c_ac.c
parentl2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file overflow (diff)
llc: delete timers synchronously in llc_sk_free()
The connection timers of an llc sock could be still flying after we delete them in llc_sk_free(), and even possibly after we free the sock. We could just wait synchronously here in case of troubles. Note, I leave other call paths as they are, since they may not have to wait, at least we can change them to synchronously when needed. Also, move the code to net/llc/llc_conn.c, which is apparently a better place. Reported-by: <syzbot+f922284c18ea23a8e457@syzkaller.appspotmail.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/llc/llc_c_ac.c')
1 files changed, 1 insertions, 8 deletions
diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
index 163121192aca..4d78375f9872 100644
--- a/net/llc/llc_c_ac.c
+++ b/net/llc/llc_c_ac.c
@@ -1099,14 +1099,7 @@ int llc_conn_ac_inc_tx_win_size(struct sock *sk, struct sk_buff *skb)
int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb)
- struct llc_sock *llc = llc_sk(sk);
- del_timer(&llc->pf_cycle_timer.timer);
- del_timer(&llc->ack_timer.timer);
- del_timer(&llc->rej_sent_timer.timer);
- del_timer(&llc->busy_state_timer.timer);
- llc->ack_must_be_send = 0;
- llc->ack_pf = 0;
+ llc_sk_stop_all_timers(sk, false);
return 0;