Commit 329f0b9b authored Mar 09, 2026 by Yuan Tan Committed by Florian Westphal Mar 10, 2026

netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels



IDLETIMER revision 0 rules reuse existing timers by label and always call
mod_timer() on timer->timer.

If the label was created first by revision 1 with XT_IDLETIMER_ALARM,
the object uses alarm timer semantics and timer->timer is never initialized.
Reusing that object from revision 0 causes mod_timer() on an uninitialized
timer_list, triggering debugobjects warnings and possible panic when
panic_on_warn=1.

Fix this by rejecting revision 0 rule insertion when an existing timer with
the same label is of ALARM type.

Fixes: 68983a35 ("netfilter: xtables: Add snapshot of hardidletimer target")
Co-developed-by: Yifan Wu <yifanwucs@gmail.com>
Signed-off-by: Yifan Wu <yifanwucs@gmail.com>
Co-developed-by: Juefei Pu <tomapufckgml@gmail.com>
Signed-off-by: Juefei Pu <tomapufckgml@gmail.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Xin Liu <dstsmallbird@foxmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>

parent 6dcee849

net/netfilter/xt_IDLETIMER.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -318,6 +318,12 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par)

		info->timer = __idletimer_tg_find_by_label(info->label);
		if (info->timer) {
		if (info->timer->timer_type & XT_IDLETIMER_ALARM) {
		pr_debug("Adding/Replacing rule with same label and different timer type is not allowed\n");
		mutex_unlock(&list_mutex);
		return -EINVAL;
		}

		info->timer->refcnt++;
		mod_timer(&info->timer->timer,
		secs_to_jiffies(info->timeout) + jiffies);