In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
batman-adv: tp_meter: directly shut down timer on cleanup<\/p>\n
batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by
\ntimer_delete() to guard against the timer handler re-arming itself between
\nthe two calls. This double-deletion hack relied on the sending status being
\nset to 0 to suppress re-arming.<\/p>\n
Replace both calls with a single timer_shutdown_sync(). This function both
\nwaits for any running timer callback to complete (like timer_delete_sync())
\nand permanently disarms the timer so it cannot be re-armed afterwards,
\nmaking re-arming prevention unconditional and self-documenting.<\/p>\n
The re-arming property is also required because otherwise:<\/p>\n
1. context 0 (batadv_tp_recv_ack()) checks in
\n batadv_tp_reset_sender_timer() if sending is still 1 -> it is
\n2. context 1 changes in batadv_tp_sender_shutdown() sending to 0 and in
\n this process forces the kthread to stop timer in
\n batadv_tp_sender_cleanup()
\n3. context 0 continues in batadv_tp_reset_sender_timer() and rearms the
\n timer -> but the reference for it is already gone<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
batman-adv: tp_meter: directly shut down timer on cleanup<\/p>\n
batadv_tp_sender_cleanup() was calling timer_delete_sync() followed by
\nt<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15068","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15068","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}