ax25: Fix NULL pointer dereferences in ax25 timers

[mirror_ubuntu-jammy-kernel.git] / net / ax25 / ax25_subr.c

diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 15ab812c4fe4b29cfdec023ddeadd7f45bd77e1a..3a476e4f6cd0b3f82836104c6119d99a7e795d6d 100644 (file)
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -261,12 +261,20 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
 {
        ax25_clear_queues(ax25);
 
-       if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
-               ax25_stop_heartbeat(ax25);
-       ax25_stop_t1timer(ax25);
-       ax25_stop_t2timer(ax25);
-       ax25_stop_t3timer(ax25);
-       ax25_stop_idletimer(ax25);
+       if (reason == ENETUNREACH) {
+               del_timer_sync(&ax25->timer);
+               del_timer_sync(&ax25->t1timer);
+               del_timer_sync(&ax25->t2timer);
+               del_timer_sync(&ax25->t3timer);
+               del_timer_sync(&ax25->idletimer);
+       } else {
+               if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY))
+                       ax25_stop_heartbeat(ax25);
+               ax25_stop_t1timer(ax25);
+               ax25_stop_t2timer(ax25);
+               ax25_stop_t3timer(ax25);
+               ax25_stop_idletimer(ax25);
+       }
 
        ax25->state = AX25_STATE_0;