CVE-2026-99054: tipc: destroy topsrv workqueues before closing connections

In the Linux kernel, the following vulnerability has been resolved:

tipc: destroy topsrv workqueues before closing connections

tipctopsrvstop() closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could then queue more work, and in-flight send/recv work could drop the last connection reference during the connidr walk.

That race produced several teardown failures: refcountt addition on 0 from connget() on a connection whose release was blocked on idrlock, a subsequent use-after-free in tipcconnclose(), queuework() on an already destroyed workqueue from the listener data-ready callback, and an RCU stall in tipctopsrvexitnet() while the walk spun under idrlock.

Clear srv->listener under idrlock so it acts as a shutdown flag, skip queuework() once it is NULL, destroy the workqueues to flush in-flight work, and only then close the remaining connections. Refuse tipcconnlookup() after that flag is cleared, and drop idrlock when the teardown walk finds no connection, so an in-flight subscription event cannot pin idrinuse while the walk holds the lock.

v3 supersedes the narrower in-thread diff Tung Quang Nguyen posted on 2026-09-23. It keeps his teardown order and adds the lookup refusal and the empty-idr unlock.