mirror of https://github.com/torvalds/linux.git
c9efde1e53
llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc
structure while its timers and state machine work may still be active.
Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state
and the skb queues. If teardown happens in parallel with a queued/running
work item, it can lead to UAF and other shutdown races.
Stop all SHDLC timers and cancel sm_work synchronously before purging the
queues and freeing the context.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes:
|
||
|---|---|---|
| .. | ||
| hci | ||
| nci | ||
| Kconfig | ||
| Makefile | ||
| af_nfc.c | ||
| core.c | ||
| digital.h | ||
| digital_core.c | ||
| digital_dep.c | ||
| digital_technology.c | ||
| llcp.h | ||
| llcp_commands.c | ||
| llcp_core.c | ||
| llcp_sock.c | ||
| netlink.c | ||
| nfc.h | ||
| rawsock.c | ||