tree ec8c0a4ea137ab2a5dc316d63044a4c2aa520675
parent ef0d3334ca2448558cea31de5a86eecf33b8e175
author Herbert Xu <herbert@gondor.apana.org.au> 1659607426 +0800
committer Anil Altinay <aaltinay@google.com> 1663193442 +0000

af_key: Do not call xfrm_probe_algs in parallel

[ Upstream commit ba953a9d89a00c078b85f4b190bc1dde66fe16b5 ]

When namespace support was added to xfrm/afkey, it caused the
previously single-threaded call to xfrm_probe_algs to become
multi-threaded.  This is buggy and needs to be fixed with a mutex.

BUG=b/245720223
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2022-3028 in the Linux kernel.

cos-patch: security-high
Reported-by: Abhishek Shah <abhishek.shah@columbia.edu>
Fixes: 283bc9f35bbb ("xfrm: Namespacify xfrm state/policy locks")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Change-Id: Id852aece0b73fb8cee79d0e910c6fdd90cba5f31
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/36939
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>