Re: [PATCH net] sctp: fix addr_wq_timer race in sctp_free_addr_wq()

On Fri, 10 Jul 2026 14:23:43 -0400 Xin Long wrote:
> sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete()
> while holding addr_wq_lock. However, timer_delete() does not guarantee that
> a currently running timer handler has completed.
> 
> This allows a race with sctp_addr_wq_timeout_handler(), where the handler
> may still run after addr_waitq has been freed, acquire addr_wq_lock, and
> access freed memory, leading to a use-after-free.
> 
> Fix this by calling timer_shutdown_sync() before taking addr_wq_lock.  This
> guarantees that any in-flight timer handler has finished and prevents the
> timer from being re-armed during teardown, making subsequent cleanup safe.

This version did not apply when it was posted (IDK if it applies now)
Please rebase and repost if it's still needed?
-- 
pw-bot: cr