[IPSEC]: Move state lock into x->type->output

This patch releases the lock on the state before calling x->type->output.
It also adds the lock to the spots where they're currently needed.

Most of those places (all except mip6) are expected to disappear with
async crypto.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 3 deletions

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ff904a711f3a..c51d77564b44 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -29,6 +29,7 @@
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
+#include <linux/spinlock.h>
 #include <linux/string.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
@@ -284,12 +285,14 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq);
+
+        spin_lock_bh(&x->lock);
         err = ah_mac_digest(ahp, skb, ah->auth_data);
-        if (err)
-                goto error_free_iph;
         memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
+        spin_unlock_bh(&x->lock);
 
-        err = 0;
+        if (err)
+                goto error_free_iph;
 
         memcpy(top_iph, tmp_base, sizeof(tmp_base));
         if (tmp_ext) {