af_key: Do not call xfrm_probe_algs in parallel

[ Upstream commit ba953a9d89a00c078b85f4b190bc1dde66fe16b5 ]

When namespace support was added to xfrm/afkey, it caused the
previously single-threaded call to xfrm_probe_algs to become
multi-threaded.  This is buggy and needs to be fixed with a mutex.

RELEASE_NOTE=Fixed CVE-2022-3028 in the Linux kernel.

cos-patch: security-high
Reported-by: Abhishek Shah <>
Fixes: 283bc9f35bbb ("xfrm: Namespacify xfrm state/policy locks")
Signed-off-by: Herbert Xu <>
Signed-off-by: Steffen Klassert <>
Signed-off-by: Sasha Levin <>
Change-Id: Id852aece0b73fb8cee79d0e910c6fdd90cba5f31
Tested-by: Cusky Presubmit Bot <>
Reviewed-by: Robert Kolchmeyer <>
1 file changed