From: WANG Cong <xiyou.wangcong@gmail.com>
Date: Tue, 31 Mar 2015 18:01:47 +0000 (-0700)
Subject: ip6mr: call del_timer_sync() in ip6mr_free_table()
X-Git-Tag: v3.2.75~57
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=64344727d8b615a46f5b0e0630f992cc0122058f;p=pandora-kernel.git

ip6mr: call del_timer_sync() in ip6mr_free_table()

commit 7ba0c47c34a1ea5bc7a24ca67309996cce0569b5 upstream.

We need to wait for the flying timers, since we
are going to free the mrtable right after it.

Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---

diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 99ee86d42cc1..fe28667a7b9c 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -334,7 +334,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
 
 static void ip6mr_free_table(struct mr6_table *mrt)
 {
-	del_timer(&mrt->ipmr_expire_timer);
+	del_timer_sync(&mrt->ipmr_expire_timer);
 	mroute_clean_tables(mrt);
 	kfree(mrt);
 }