x25_link_terminated() cancels the T20 restart timer with timer_delete(). If the callback is already running on another CPU, the cancel does not wait. The callback can then rearm the timer before x25_link_device_down() removes the neighbour and drops its last reference. This frees the neighbour while its embedded timer is active, leading to a use-after-free on expiry. Shut the timer down synchronously in __x25_remove_neigh() before dropping the list-owned reference. timer_shutdown_sync() also prevents the callback's unconditional rearm. The callback does not acquire x25_neigh_list_lock, so it is safe to wait while neighbour removal keeps the list protected. Also purge queued frames before releasing the neighbour, restoring the cleanup removed by commit 7eed751b3b2a ("net/x25: handle additional netdev events"). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Felix Hoffmann --- Tested with a two-vCPU KASAN, timer debugobjects and lockdep kernel using a deterministic callback/teardown race. All 10 timer callbacks completed without a KASAN, debugobjects, lockdep, warning, oops, or panic report. Build-tested with W=1 under allmodconfig and allyesconfig. The reproducer is available privately on request. net/x25/x25_link.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c index d1e8cd81c214..876333cb16ae 100644 --- a/net/x25/x25_link.c +++ b/net/x25/x25_link.c @@ -298,6 +298,9 @@ void x25_link_device_up(struct net_device *dev) */ static void __x25_remove_neigh(struct x25_neigh *nb) { + timer_shutdown_sync(&nb->t20timer); + skb_queue_purge(&nb->queue); + if (nb->node.next) { list_del(&nb->node); x25_neigh_put(nb); -- 2.43.0