Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next

Steffen Klassert says:

====================
Just one patch this time.

1) Drop packets when the matching SA is in larval state and add a
   statistic counter for that. From Fan Du.

Please pull or let me know if there are problems.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 0 deletions

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index ab2bb42fe094..88843996f935 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -163,6 +163,11 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                 skb->sp->xvec[skb->sp->len++] = x;
 
                 spin_lock(&x->lock);
+                if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
+                        goto drop_unlock;
+                }
+
                 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID);
                         goto drop_unlock;