[PATCH net] net: x25: shut down T20 timer before freeing neighbour

[Felix Hoffmann <f3lix.dev@gmx.de>]

x25_link_terminated() cancels the T20 restart timer with
timer_delete(). If the callback is already running on another CPU, the
cancel does not wait. The callback can then rearm the timer before
x25_link_device_down() removes the neighbour and drops its last
reference. This frees the neighbour while its embedded timer is active,
leading to a use-after-free on expiry.

Shut the timer down synchronously in __x25_remove_neigh() before
dropping the list-owned reference. timer_shutdown_sync() also prevents
the callback's unconditional rearm. The callback does not acquire
x25_neigh_list_lock, so it is safe to wait while neighbour removal keeps
the list protected.

Also purge queued frames before releasing the neighbour, restoring the
cleanup removed by commit 7eed751b3b2a ("net/x25: handle additional
netdev events").

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
---
Tested with a two-vCPU KASAN, timer debugobjects and lockdep kernel using
a deterministic callback/teardown race. All 10 timer callbacks completed
without a KASAN, debugobjects, lockdep, warning, oops, or panic report.

Build-tested with W=1 under allmodconfig and allyesconfig.

The reproducer is available privately on request.

 net/x25/x25_link.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index d1e8cd81c214..876333cb16ae 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -298,6 +298,9 @@ void x25_link_device_up(struct net_device *dev)
  */
 static void __x25_remove_neigh(struct x25_neigh *nb)
 {
+	timer_shutdown_sync(&nb->t20timer);
+	skb_queue_purge(&nb->queue);
+
 	if (nb->node.next) {
 		list_del(&nb->node);
 		x25_neigh_put(nb);
-- 
2.43.0