Unverified Commit a1cff93a authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15107 netfilter: IDLETIMER: Fix for possible ABBA deadlock 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/M55GEN4ZDIOBALFV7XCEBA6UPT4KTLAA/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBJCF5 
 
Link:https://gitee.com/openeuler/kernel/pulls/15107

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents f23eea12 2f47d959

net/netfilter/xt_IDLETIMER.c

+28 −24
Original line number Diff line number Diff line
@@ -409,21 +409,23 @@ static void idletimer_tg_destroy(const struct xt_tgdtor_param *par) 


	mutex_lock(&list_mutex);



	if (--info->timer->refcnt == 0) {

	if (--info->timer->refcnt > 0) {

		pr_debug("decreased refcnt of timer %s to %u\n",

			 info->label, info->timer->refcnt);

		mutex_unlock(&list_mutex);

		return;

	}



	pr_debug("deleting timer %s\n", info->label);



	list_del(&info->timer->entry);

	mutex_unlock(&list_mutex);



	timer_shutdown_sync(&info->timer->timer);

	cancel_work_sync(&info->timer->work);

	sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);

	kfree(info->timer->attr.attr.name);

	kfree(info->timer);

	} else {

		pr_debug("decreased refcnt of timer %s to %u\n",

			 info->label, info->timer->refcnt);

	}



	mutex_unlock(&list_mutex);

}



static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par)
@@ -434,10 +436,18 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par) 


	mutex_lock(&list_mutex);



	if (--info->timer->refcnt == 0) {

	if (--info->timer->refcnt > 0) {

		pr_debug("decreased refcnt of timer %s to %u\n",

			 info->label, info->timer->refcnt);

		mutex_unlock(&list_mutex);

		return;

	}



	pr_debug("deleting timer %s\n", info->label);



	list_del(&info->timer->entry);

	mutex_unlock(&list_mutex);



	if (info->timer->timer_type & XT_IDLETIMER_ALARM) {

		alarm_cancel(&info->timer->alarm);

	} else {
@@ -447,12 +457,6 @@ static void idletimer_tg_destroy_v1(const struct xt_tgdtor_param *par) 
	sysfs_remove_file(idletimer_tg_kobj, &info->timer->attr.attr);

	kfree(info->timer->attr.attr.name);

	kfree(info->timer);

	} else {

		pr_debug("decreased refcnt of timer %s to %u\n",

			 info->label, info->timer->refcnt);

	}



	mutex_unlock(&list_mutex);

}