4 files changed, 8 insertions, 4 deletions

diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index acf00104ef31..30e5746085b8 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -91,6 +91,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
         }
 
         if (!dev->xfrmdev_ops || !dev->xfrmdev_ops->xdo_dev_state_add) {
+                xso->dev = NULL;
                 dev_put(dev);
                 return 0;
         }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 2515cd2bc5db..8ac9d32fb79d 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -429,7 +429,8 @@ resume:
         nf_reset(skb);
 
         if (decaps) {
-                skb->sp->olen = 0;
+                if (skb->sp)
+                        skb->sp->olen = 0;
                 skb_dst_drop(skb);
                 gro_cells_receive(&gro_cells, skb);
                 return 0;
@@ -440,7 +441,8 @@ resume:
 
                 err = x->inner_mode->afinfo->transport_finish(skb, xfrm_gro || async);
                 if (xfrm_gro) {
-                        skb->sp->olen = 0;
+                        if (skb->sp)
+                                skb->sp->olen = 0;
                         skb_dst_drop(skb);
                         gro_cells_receive(&gro_cells, skb);
                         return err;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 0dab1cd79ce4..12213477cd3a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -732,12 +732,12 @@ restart:
                         }
                 }
         }
+out:
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
         if (cnt) {
                 err = 0;
                 xfrm_policy_cache_flush();
         }
-out:
-        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_state_flush);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 2bfbd9121e3b..b997f1395357 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -657,6 +657,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
+                xfrm_dev_state_delete(x);
                 __xfrm_state_put(x);
                 goto out;
         }