3 files changed, 18 insertions, 10 deletions

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index ccde54248c8c..e1a63930a967 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -104,10 +104,14 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
         const struct iphdr *iph = ip_hdr(skb);
         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
         struct flowi4 *fl4 = &fl->u.ip4;
+        int oif = 0;
+
+        if (skb_dst(skb))
+                oif = skb_dst(skb)->dev->ifindex;
 
         memset(fl4, 0, sizeof(struct flowi4));
         fl4->flowi4_mark = skb->mark;
-        fl4->flowi4_oif = skb_dst(skb)->dev->ifindex;
+        fl4->flowi4_oif = reverse ? skb->skb_iif : oif;
 
         if (!ip_is_fragment(iph)) {
                 switch (iph->protocol) {
@@ -236,7 +240,7 @@ static struct dst_ops xfrm4_dst_ops = {
         .destroy =              xfrm4_dst_destroy,
         .ifdown =               xfrm4_dst_ifdown,
         .local_out =            __ip_local_out,
-        .gc_thresh =            1024,
+        .gc_thresh =            32768,
 };
 
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 08ed2772b7aa..5f8e128c512d 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -135,10 +135,14 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         struct ipv6_opt_hdr *exthdr;
         const unsigned char *nh = skb_network_header(skb);
         u8 nexthdr = nh[IP6CB(skb)->nhoff];
+        int oif = 0;
+
+        if (skb_dst(skb))
+                oif = skb_dst(skb)->dev->ifindex;
 
         memset(fl6, 0, sizeof(struct flowi6));
         fl6->flowi6_mark = skb->mark;
-        fl6->flowi6_oif = skb_dst(skb)->dev->ifindex;
+        fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
 
         fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
         fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
@@ -285,7 +289,7 @@ static struct dst_ops xfrm6_dst_ops = {
         .destroy =              xfrm6_dst_destroy,
         .ifdown =               xfrm6_dst_ifdown,
         .local_out =            __ip6_local_out,
-        .gc_thresh =            1024,
+        .gc_thresh =            32768,
 };
 
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
index 2906d520eea7..3be02b680268 100644
--- a/net/xfrm/xfrm_ipcomp.c
+++ b/net/xfrm/xfrm_ipcomp.c
@@ -141,14 +141,14 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
         const int plen = skb->len;
         int dlen = IPCOMP_SCRATCH_SIZE;
         u8 *start = skb->data;
-        const int cpu = get_cpu();
-        u8 *scratch = *per_cpu_ptr(ipcomp_scratches, cpu);
-        struct crypto_comp *tfm = *per_cpu_ptr(ipcd->tfms, cpu);
+        struct crypto_comp *tfm;
+        u8 *scratch;
         int err;
 
         local_bh_disable();
+        scratch = *this_cpu_ptr(ipcomp_scratches);
+        tfm = *this_cpu_ptr(ipcd->tfms);
         err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-        local_bh_enable();
         if (err)
                 goto out;
 
@@ -158,13 +158,13 @@ static int ipcomp_compress(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
-        put_cpu();
+        local_bh_enable();
 
         pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
         return 0;
 
 out:
-        put_cpu();
+        local_bh_enable();
         return err;
 }