ip6mr: call del_timer_sync() in ip6mr_free_table()

commit 7ba0c47c upstream.

We need to wait for the flying timers, since we
are going to free the mrtable right after it.

Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Ben Hutchings <ben@decadent.org.uk>
[ wt: 2.6.32 has a single table hence a single timer. ip6_mr_init() has
  the same del_timer() call on the error path, but we don't need to
  change it since at this point the timer hasn't been started yet ]
Signed-off-by: Willy Tarreau <w@1wt.eu>

net/ipv6/ip6mr.c

@@ -1098,7 +1098,7 @@ int __init ip6_mr_init(void)
 void ip6_mr_cleanup(void)
 {
 	unregister_netdevice_notifier(&ip6_mr_notifier);
-	del_timer(&ipmr_expire_timer);
+	del_timer_sync(&ipmr_expire_timer);
 	unregister_pernet_subsys(&ip6mr_net_ops);
 	kmem_cache_destroy(mrt_cachep);
 }