5 files changed, 18 insertions, 5 deletions

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 0eb390c205af..da588def3c61 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1552,6 +1552,7 @@ int xfrm_state_walk(struct net *net, struct xfrm_state_walk *walk,
                     int (*func)(struct xfrm_state *, int, void*), void *);
 void xfrm_state_walk_done(struct xfrm_state_walk *walk, struct net *net);
 struct xfrm_state *xfrm_state_alloc(struct net *net);
+void xfrm_state_free(struct xfrm_state *x);
 struct xfrm_state *xfrm_state_find(const xfrm_address_t *daddr,
                                    const xfrm_address_t *saddr,
                                    const struct flowi *fl,
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 684c0bc01e2c..d5635908587f 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -346,6 +346,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
                 skb->sp->xvec[skb->sp->len++] = x;
 
+                skb_dst_force(skb);
+                if (!skb_dst(skb)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
+                        goto drop;
+                }
+
 lock:
                 spin_lock(&x->lock);
 
@@ -385,7 +391,6 @@ lock:
                 XFRM_SKB_CB(skb)->seq.input.low = seq;
                 XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
 
-                skb_dst_force(skb);
                 dev_hold(skb->dev);
 
                 if (crypto_done)
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 4ae87c5ce2e3..fef6b2da3c5d 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -102,6 +102,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
                 skb_dst_force(skb);
                 if (!skb_dst(skb)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
+                        err = -EHOSTUNREACH;
                         goto error_nolock;
                 }
 
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index dc4a9f1fb941..23c92891758a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -426,6 +426,12 @@ static void xfrm_put_mode(struct xfrm_mode *mode)
         module_put(mode->owner);
 }
 
+void xfrm_state_free(struct xfrm_state *x)
+{
+        kmem_cache_free(xfrm_state_cache, x);
+}
+EXPORT_SYMBOL(xfrm_state_free);
+
 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 {
         tasklet_hrtimer_cancel(&x->mtimer);
@@ -452,7 +458,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
         }
         xfrm_dev_state_free(x);
         security_xfrm_state_free(x);
-        kmem_cache_free(xfrm_state_cache, x);
+        xfrm_state_free(x);
 }
 
 static void xfrm_state_gc_task(struct work_struct *work)
@@ -788,7 +794,7 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
 {
         spin_lock_bh(&net->xfrm.xfrm_state_lock);
         si->sadcnt = net->xfrm.state_num;
-        si->sadhcnt = net->xfrm.state_hmask;
+        si->sadhcnt = net->xfrm.state_hmask + 1;
         si->sadhmcnt = xfrm_state_hashmax;
         spin_unlock_bh(&net->xfrm.xfrm_state_lock);
 }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c9a84e22f5d5..277c1c46fe94 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2288,13 +2288,13 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         }
 
-        kfree(x);
+        xfrm_state_free(x);
         kfree(xp);
 
         return 0;
 
 free_state:
-        kfree(x);
+        xfrm_state_free(x);
 nomem:
         return err;
 }