Re: [PATCH 1/1] ipv4: ipmr_expire_timer causes crash when removing net namespace
From: Eric Dumazet <hidden>
Date: 2012-08-21 05:29:56
On Mon, 2012-08-20 at 17:15 -0700, Francesco Ruggeri wrote:
I
+static void ipmr_free_table(struct mr_table *mrt)
+{
+ del_timer(&mrt->ipmr_expire_timer);
+ mroute_clean_tables(mrt);
+ kfree(mrt);
+}Seems racy to me. del_timer() doesnt make sure timer is completely disabled. Probably need spin_lock_bh(&mfc_unres_lock) / spin_unlock_bh(&mfc_unres_lock), and maybe del_timer_sync()