Re: [PATCH] mISDN: fix use-after-free bugs in l1oip timer handlers

[Jakub Kicinski]

On Tue, 20 Sep 2022 19:57:16 +0800 Duoming Zhou wrote:
> -	if (timer_pending(&hc->keep_tl))
> -		del_timer(&hc->keep_tl);
> +	del_timer_sync(&hc->keep_tl);
>  
> -	if (timer_pending(&hc->timeout_tl))
> -		del_timer(&hc->timeout_tl);
> +	del_timer_sync(&hc->timeout_tl);
>  
>  	cancel_work_sync(&hc->workq);

There needs to be some more cleverness here.
hc->workq and hc->socket_thread can kick those timers right back in.