In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race

In the Linux kernel, the following vulnerability has been resolved:

xfrm: espintcp: fix UAF during close

ZDI reported and analyzed a race condition during close for espintcp
sockets:

 1espintcp_close() frees emsg->skb via kfree_skb() without holding
 2any socket lock. Concurrently, the xfrm_trans_reinject work queue
 3invokes esp_output_tcp_finish() -> espintcp_push_skb() ->
 4espintcp_push_msgs() -> skb_send_sock_locked(), which reads the
 5same skb as a data source.

Fix this by adding a synchronize_rcu() call after resetting sk_prot,
since esp_output_tcp_finish() runs under RCU and won't use a socket
with sk_prot == &tcp_prot. Simply taking the socket lock in
espintcp_close() could lead to leaks, if esp_output_tcp_finish()
re-adds an skb in the slot we just freed. After this, the existing
barrier() is no longer needed.