Merge branch 'tipc-fix-two-race-issues-in-tipc_conn_alloc'
authorJakub Kicinski <kuba@kernel.org>
Tue, 22 Nov 2022 04:45:28 +0000 (20:45 -0800)
committerJakub Kicinski <kuba@kernel.org>
Tue, 22 Nov 2022 04:45:29 +0000 (20:45 -0800)
commit3349c272de07c75ebe0e6362b58db2d4502e75d2
tree7783a039437196000a9f7497af45c7617abb481e
parent1f0dd412e34e177621769866bef347f0b22364df
parenta7b42969d63f47320853a802efd879fbdc4e010e
Merge branch 'tipc-fix-two-race-issues-in-tipc_conn_alloc'

Xin Long says:

====================
tipc: fix two race issues in tipc_conn_alloc

The race exists beteen tipc_topsrv_accept() and tipc_conn_close(),
one is allocating the con while the other is freeing it and there
is no proper lock protecting it. Therefore, a null-pointer-defer
and a use-after-free may be triggered, see details on each patch.
====================

Link: https://lore.kernel.org/r/cover.1668807842.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>