On Fri, Dec 22, 2023 at 2:14 AM Dmitry Safonov [off-list ref] wrote:

The freeing and re-allocation of algorithm are protected by cpool_mutex,
so it doesn't fix an actual use-after-free, but avoids a deserved
refcount_warn_saturate() warning.

A trivial fix for the racy behavior.

Fixes: 8c73b26315aa ("net/tcp: Prepare tcp_md5sig_pool for TCP-AO")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Dmitry Safonov <redacted>

Reported-by: syzbot <redacted>
Reviewed-by: Eric Dumazet <edumazet@google.com>