Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Steffen Klassert says:

====================
pull request (net): ipsec 2015-04-09

1) We dereferenced the xfrm outer_mode too early, larval
   SAs don't have it set. Move the dereference of the
   outer mode below the larval SA check to fix it.
   From Alexey Dobriyan.

2) Fix vti6 tunnel uninit on namespace crosssing.
   From Yao Xiwei.

Please pull or let me know if there are problems.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 6 insertions, 7 deletions

diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 5fb9e212eca8..a4ac85052e44 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -288,8 +288,7 @@ static struct ip6_tnl *vti6_locate(struct net *net, struct __ip6_tnl_parm *p,
 static void vti6_dev_uninit(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        struct net *net = dev_net(dev);
-        struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+        struct vti6_net *ip6n = net_generic(t->net, vti6_net_id);
 
         if (dev == ip6n->fb_tnl_dev)
                 RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 85d1d4764612..526c4feb3b50 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -238,11 +238,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
                 skb->sp->xvec[skb->sp->len++] = x;
 
-                if (xfrm_tunnel_check(skb, x, family)) {
-                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
-                        goto drop;
-                }
-
                 spin_lock(&x->lock);
                 if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
@@ -271,6 +266,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 
                 spin_unlock(&x->lock);
 
+                if (xfrm_tunnel_check(skb, x, family)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
+                        goto drop;
+                }
+
                 seq_hi = htonl(xfrm_replay_seqhi(x, seq));
 
                 XFRM_SKB_CB(skb)->seq.input.low = seq;