From: WANG Cong <xiyou.wangcong@gmail.com>
Date: Tue, 31 Mar 2015 18:01:47 +0000 (-0700)
Subject: ip6mr: call del_timer_sync() in ip6mr_free_table()
X-Git-Tag: v2.6.32.70~43
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=977dc430a2b849161cb4018f568e403d724d2595;p=thirdparty%2Fkernel%2Fstable.git

ip6mr: call del_timer_sync() in ip6mr_free_table()

commit 7ba0c47c34a1ea5bc7a24ca67309996cce0569b5 upstream.

We need to wait for the flying timers, since we
are going to free the mrtable right after it.

Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Ben Hutchings <ben@decadent.org.uk>
[ wt: 2.6.32 has a single table hence a single timer. ip6_mr_init() has
  the same del_timer() call on the error path, but we don't need to
  change it since at this point the timer hasn't been started yet ]
Signed-off-by: Willy Tarreau <w@1wt.eu>
---

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 716153941fc47..937f915699832 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1098,7 +1098,7 @@ reg_pernet_fail:
 void ip6_mr_cleanup(void)
 {
 	unregister_netdevice_notifier(&ip6_mr_notifier);
-	del_timer(&ipmr_expire_timer);
+	del_timer_sync(&ipmr_expire_timer);
 	unregister_pernet_subsys(&ip6mr_net_ops);
 	kmem_cache_destroy(mrt_cachep);
 }