Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (43 commits)
  [IPSEC]: Fix BEET output
  [ICMP]: Dst entry leak in icmp_send host re-lookup code (v2).
  [AX25]: Remove obsolete references to BKL from TODO file.
  [NET]: Fix multicast device ioctl checks
  [IRDA]: Store irnet_socket termios properly.
  [UML]: uml-net: don't set IFF_ALLMULTI in set_multicast_list
  [VLAN]: Don't copy ALLMULTI/PROMISC flags from underlying device
  netxen, phy/marvell, skge: minor checkpatch fixes
  S2io: Handle TX completions on the same CPU as the sender for MIS-X interrupts
  b44: Truncate PHY address
  skge napi->poll() locking bug
  rndis_host: fix oops when query for OID_GEN_PHYSICAL_MEDIUM fails
  cxgb3: Fix lockdep problems with sge.reg_lock
  ehea: Fix IPv6 support
  dm9000: Support promisc and all-multi modes
  dm9601: configure MAC to drop invalid (crc/length) packets
  dm9601: add Hirose USB-100 device ID
  Marvell PHY m88e1111 driver fix
  netxen: fix rx dropped stats
  netxen: remove low level tx lock
  ...

20 files changed, 148 insertions, 42 deletions

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 8fbcefe10c9f..480ea90e7dcd 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -660,7 +660,7 @@ static int vlan_dev_init(struct net_device *dev)
         int subclass = 0;
 
         /* IFF_BROADCAST|IFF_MULTICAST; ??? */
-        dev->flags  = real_dev->flags & ~IFF_UP;
+        dev->flags  = real_dev->flags & ~(IFF_UP | IFF_PROMISC | IFF_ALLMULTI);
         dev->iflink = real_dev->ifindex;
         dev->state  = (real_dev->state & ((1<<__LINK_STATE_NOCARRIER) |
                                           (1<<__LINK_STATE_DORMANT))) |
diff --git a/net/ax25/TODO b/net/ax25/TODO
index 4089c49e45cc..69fb4e368d92 100644
--- a/net/ax25/TODO
+++ b/net/ax25/TODO
@@ -9,10 +9,6 @@ being used.
 Routes to a device being taken down might be deleted by ax25_rt_device_down
 but added by somebody else before the device has been deleted fully.
 
-Massive amounts of lock_kernel / unlock_kernel are just a temporary solution to
-get around the removal of SOCKOPS_WRAP.  A serious locking strategy has to be
-implemented.
-
 The ax25_rt_find_route synopsys is pervert but I somehow had to deal with
 the race caused by the static variable in it's previous implementation.
 
diff --git a/net/core/dev.c b/net/core/dev.c
index fcdf03cf3b3f..460e7f99ce3e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3329,7 +3329,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                         return -EOPNOTSUPP;
 
                 case SIOCADDMULTI:
-                        if (!dev->set_multicast_list ||
+                        if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
                             ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                                 return -EINVAL;
                         if (!netif_device_present(dev))
@@ -3338,7 +3338,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                                           dev->addr_len, 1);
 
                 case SIOCDELMULTI:
-                        if (!dev->set_multicast_list ||
+                        if ((!dev->set_multicast_list && !dev->set_rx_mode) ||
                             ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                                 return -EINVAL;
                         if (!netif_device_present(dev))
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index d9a02b2cc289..19b8e003f150 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -466,6 +466,28 @@ out_neigh_release:
         goto out;
 }
 
+struct pneigh_entry *__pneigh_lookup(struct neigh_table *tbl,
+                struct net *net, const void *pkey, struct net_device *dev)
+{
+        struct pneigh_entry *n;
+        int key_len = tbl->key_len;
+        u32 hash_val = *(u32 *)(pkey + key_len - 4);
+
+        hash_val ^= (hash_val >> 16);
+        hash_val ^= hash_val >> 8;
+        hash_val ^= hash_val >> 4;
+        hash_val &= PNEIGH_HASHMASK;
+
+        for (n = tbl->phash_buckets[hash_val]; n; n = n->next) {
+                if (!memcmp(n->key, pkey, key_len) &&
+                    (n->net == net) &&
+                    (n->dev == dev || !n->dev))
+                        break;
+        }
+
+        return n;
+}
+
 struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
                                     struct net *net, const void *pkey,
                                     struct net_device *dev, int creat)
@@ -2803,6 +2825,7 @@ EXPORT_SYMBOL(neigh_table_init_no_netlink);
 EXPORT_SYMBOL(neigh_update);
 EXPORT_SYMBOL(pneigh_enqueue);
 EXPORT_SYMBOL(pneigh_lookup);
+EXPORT_SYMBOL_GPL(__pneigh_lookup);
 
 #ifdef CONFIG_ARPD
 EXPORT_SYMBOL(neigh_app_ns);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index a13c074dac09..a944e8053e28 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -591,7 +591,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                 }
 
                 if (xfrm_decode_session_reverse(skb_in, &fl, AF_INET))
-                        goto out_unlock;
+                        goto ende;
 
                 if (inet_addr_type(net, fl.fl4_src) == RTN_LOCAL)
                         err = __ip_route_output_key(net, &rt2, &fl);
@@ -601,7 +601,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 
                         fl2.fl4_dst = fl.fl4_src;
                         if (ip_route_output_key(net, &rt2, &fl2))
-                                goto out_unlock;
+                                goto ende;
 
                         /* Ugh! */
                         odst = skb_in->dst;
@@ -614,7 +614,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                 }
 
                 if (err)
-                        goto out_unlock;
+                        goto ende;
 
                 err = xfrm_lookup((struct dst_entry **)&rt2, &fl, NULL,
                                   XFRM_LOOKUP_ICMP);
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index b47030ba162b..9c798abce736 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -39,13 +39,11 @@ static void xfrm4_beet_make_header(struct sk_buff *skb)
 static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ip_beet_phdr *ph;
-        struct iphdr *iph, *top_iph;
+        struct iphdr *top_iph;
         int hdrlen, optlen;
 
-        iph = ip_hdr(skb);
-
         hdrlen = 0;
-        optlen = iph->ihl * 4 - sizeof(*iph);
+        optlen = XFRM_MODE_SKB_CB(skb)->optlen;
         if (unlikely(optlen))
                 hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
 
@@ -53,11 +51,12 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                                     hdrlen);
         skb->mac_header = skb->network_header +
                           offsetof(struct iphdr, protocol);
-        skb->transport_header = skb->network_header + sizeof(*iph);
+        skb->transport_header = skb->network_header + sizeof(*top_iph);
 
         xfrm4_beet_make_header(skb);
 
-        ph = (struct ip_beet_phdr *)__skb_pull(skb, sizeof(*iph) - hdrlen);
+        ph = (struct ip_beet_phdr *)
+                __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl - hdrlen);
 
         top_iph = ip_hdr(skb);
 
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 8dee617ee900..584e6d74e3a9 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -41,7 +41,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->ihl = 5;
         top_iph->version = 4;
 
-        top_iph->protocol = x->inner_mode->afinfo->proto;
+        top_iph->protocol = xfrm_af2proto(skb->dst->ops->family);
 
         /* DS disclosed */
         top_iph->tos = INET_ECN_encapsulate(XFRM_MODE_SKB_CB(skb)->tos,
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index d5a58a818021..8c3180adddbf 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -56,7 +56,7 @@ int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
 
-        err = x->inner_mode->afinfo->extract_output(x, skb);
+        err = xfrm_inner_extract_output(x, skb);
         if (err)
                 return err;
 
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index fdeebe68a379..07735ed280d7 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -52,10 +52,12 @@ int xfrm4_extract_header(struct sk_buff *skb)
 {
         struct iphdr *iph = ip_hdr(skb);
 
+        XFRM_MODE_SKB_CB(skb)->ihl = sizeof(*iph);
         XFRM_MODE_SKB_CB(skb)->id = iph->id;
         XFRM_MODE_SKB_CB(skb)->frag_off = iph->frag_off;
         XFRM_MODE_SKB_CB(skb)->tos = iph->tos;
         XFRM_MODE_SKB_CB(skb)->ttl = iph->ttl;
+        XFRM_MODE_SKB_CB(skb)->optlen = iph->ihl * 4 - sizeof(*iph);
         memset(XFRM_MODE_SKB_CB(skb)->flow_lbl, 0,
                sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 51557c27a0cd..452a2ac4eec8 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -676,6 +676,20 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
         }
 }
 
+static struct pneigh_entry *pndisc_check_router(struct net_device *dev,
+                struct in6_addr *addr, int *is_router)
+{
+        struct pneigh_entry *n;
+
+        read_lock_bh(&nd_tbl.lock);
+        n = __pneigh_lookup(&nd_tbl, &init_net, addr, dev);
+        if (n != NULL)
+                *is_router = (n->flags & NTF_ROUTER);
+        read_unlock_bh(&nd_tbl.lock);
+
+        return n;
+}
+
 static void ndisc_recv_ns(struct sk_buff *skb)
 {
         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
@@ -692,7 +706,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         struct pneigh_entry *pneigh = NULL;
         int dad = ipv6_addr_any(saddr);
         int inc;
-        int is_router;
+        int is_router = 0;
 
         if (ipv6_addr_is_multicast(&msg->target)) {
                 ND_PRINTK2(KERN_WARNING
@@ -790,8 +804,8 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                 if (ipv6_chk_acast_addr(dev, &msg->target) ||
                     (idev->cnf.forwarding &&
                      (ipv6_devconf.proxy_ndp || idev->cnf.proxy_ndp) &&
-                     (pneigh = pneigh_lookup(&nd_tbl, &init_net,
-                                             &msg->target, dev, 0)) != NULL)) {
+                     (pneigh = pndisc_check_router(dev, &msg->target,
+                                                  &is_router)) != NULL)) {
                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
                             skb->pkt_type != PACKET_HOST &&
                             inc != 0 &&
@@ -812,7 +826,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                         goto out;
         }
 
-        is_router = !!(pneigh ? pneigh->flags & NTF_ROUTER : idev->cnf.forwarding);
+        is_router = !!(pneigh ? is_router : idev->cnf.forwarding);
 
         if (dad) {
                 struct in6_addr maddr;
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index 0527d11c1ae3..d6ce400f585f 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -45,6 +45,7 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
         skb->mac_header = skb->network_header +
                           offsetof(struct ipv6hdr, nexthdr);
         skb->transport_header = skb->network_header + sizeof(*top_iph);
+        __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl);
 
         xfrm6_beet_make_header(skb);
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 0c742faaa30b..e20529b4c825 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -45,7 +45,7 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
         memcpy(top_iph->flow_lbl, XFRM_MODE_SKB_CB(skb)->flow_lbl,
                sizeof(top_iph->flow_lbl));
-        top_iph->nexthdr = x->inner_mode->afinfo->proto;
+        top_iph->nexthdr = xfrm_af2proto(skb->dst->ops->family);
 
         dsfield = XFRM_MODE_SKB_CB(skb)->tos;
         dsfield = INET_ECN_encapsulate(dsfield, dsfield);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 79ccfb080733..0af823cf7f1f 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -62,7 +62,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
 
-        err = x->inner_mode->afinfo->extract_output(x, skb);
+        err = xfrm_inner_extract_output(x, skb);
         if (err)
                 return err;
 
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index dc817e035e23..ff1e1db8e236 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -174,10 +174,12 @@ int xfrm6_extract_header(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = ipv6_hdr(skb);
 
+        XFRM_MODE_SKB_CB(skb)->ihl = sizeof(*iph);
         XFRM_MODE_SKB_CB(skb)->id = 0;
         XFRM_MODE_SKB_CB(skb)->frag_off = htons(IP_DF);
         XFRM_MODE_SKB_CB(skb)->tos = ipv6_get_dsfield(iph);
         XFRM_MODE_SKB_CB(skb)->ttl = iph->hop_limit;
+        XFRM_MODE_SKB_CB(skb)->optlen = 0;
         memcpy(XFRM_MODE_SKB_CB(skb)->flow_lbl, iph->flow_lbl,
                sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
 
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index bc2e15ce7004..7873c392ab4c 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -405,7 +405,7 @@ typedef struct irnet_socket
   /* "pppd" interact directly with us on a /dev/ file */
   struct file *         file;           /* File descriptor of this instance */
   /* TTY stuff - to keep "pppd" happy */
-  struct termios        termios;        /* Various tty flags */
+  struct ktermios       termios;        /* Various tty flags */
   /* Stuff for the control channel */
   int                   event_index;    /* Last read in the event log */
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 8b5f486ac80f..e9ef9af4a53b 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1219,7 +1219,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                 x->sel.prefixlen_s = addr->sadb_address_prefixlen;
         }
 
-        if (!x->sel.family)
+        if (x->props.mode == XFRM_MODE_TRANSPORT)
                 x->sel.family = x->props.family;
 
         if (ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]) {
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 62188c6a06dd..75279402ccf4 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -84,14 +84,21 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
 
 int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+        struct xfrm_mode *inner_mode = x->inner_mode;
         int err;
 
         err = x->outer_mode->afinfo->extract_input(x, skb);
         if (err)
                 return err;
 
-        skb->protocol = x->inner_mode->afinfo->eth_proto;
-        return x->inner_mode->input2(x, skb);
+        if (x->sel.family == AF_UNSPEC) {
+                inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
+                if (inner_mode == NULL)
+                        return -EAFNOSUPPORT;
+        }
+
+        skb->protocol = inner_mode->afinfo->eth_proto;
+        return inner_mode->input2(x, skb);
 }
 EXPORT_SYMBOL(xfrm_prepare_input);
 
@@ -101,6 +108,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
         __be32 seq;
         struct xfrm_state *x;
         xfrm_address_t *daddr;
+        struct xfrm_mode *inner_mode;
         unsigned int family;
         int decaps = 0;
         int async = 0;
@@ -207,7 +215,15 @@ resume:
 
                 XFRM_MODE_SKB_CB(skb)->protocol = nexthdr;
 
-                if (x->inner_mode->input(x, skb)) {
+                inner_mode = x->inner_mode;
+
+                if (x->sel.family == AF_UNSPEC) {
+                        inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
+                        if (inner_mode == NULL)
+                                goto drop;
+                }
+
+                if (inner_mode->input(x, skb)) {
                         XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMODEERROR);
                         goto drop;
                 }
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 569d377932c4..2519129c6d21 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -124,7 +124,7 @@ int xfrm_output_resume(struct sk_buff *skb, int err)
                 if (!x)
                         return dst_output(skb);
 
-                err = nf_hook(x->inner_mode->afinfo->family,
+                err = nf_hook(skb->dst->ops->family,
                               NF_INET_POST_ROUTING, skb,
                               NULL, skb->dst->dev, xfrm_output2);
                 if (unlikely(err != 1))
@@ -193,4 +193,20 @@ int xfrm_output(struct sk_buff *skb)
 
         return xfrm_output2(skb);
 }
+
+int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct xfrm_mode *inner_mode;
+        if (x->sel.family == AF_UNSPEC)
+                inner_mode = xfrm_ip2inner_mode(x,
+                                xfrm_af2proto(skb->dst->ops->family));
+        else
+                inner_mode = x->inner_mode;
+
+        if (inner_mode == NULL)
+                return -EAFNOSUPPORT;
+        return inner_mode->afinfo->extract_output(x, skb);
+}
+
 EXPORT_SYMBOL_GPL(xfrm_output);
+EXPORT_SYMBOL_GPL(xfrm_inner_extract_output);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 7ba65e82941c..58f1f9347b54 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -388,6 +388,8 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
         kfree(x->coaddr);
         if (x->inner_mode)
                 xfrm_put_mode(x->inner_mode);
+        if (x->inner_mode_iaf)
+                xfrm_put_mode(x->inner_mode_iaf);
         if (x->outer_mode)
                 xfrm_put_mode(x->outer_mode);
         if (x->type) {
@@ -523,6 +525,8 @@ struct xfrm_state *xfrm_state_alloc(void)
                 x->lft.hard_packet_limit = XFRM_INF;
                 x->replay_maxage = 0;
                 x->replay_maxdiff = 0;
+                x->inner_mode = NULL;
+                x->inner_mode_iaf = NULL;
                 spin_lock_init(&x->lock);
         }
         return x;
@@ -796,7 +800,7 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                               selector.
                          */
                         if (x->km.state == XFRM_STATE_VALID) {
-                                if (!xfrm_selector_match(&x->sel, fl, x->sel.family) ||
+                                if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
                                     !security_xfrm_state_pol_flow_match(x, pol, fl))
                                         continue;
                                 if (!best ||
@@ -1944,6 +1948,7 @@ int xfrm_state_mtu(struct xfrm_state *x, int mtu)
 int xfrm_init_state(struct xfrm_state *x)
 {
         struct xfrm_state_afinfo *afinfo;
+        struct xfrm_mode *inner_mode;
         int family = x->props.family;
         int err;
 
@@ -1962,13 +1967,48 @@ int xfrm_init_state(struct xfrm_state *x)
                 goto error;
 
         err = -EPROTONOSUPPORT;
-        x->inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
-        if (x->inner_mode == NULL)
-                goto error;
 
-        if (!(x->inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
-            family != x->sel.family)
-                goto error;
+        if (x->sel.family != AF_UNSPEC) {
+                inner_mode = xfrm_get_mode(x->props.mode, x->sel.family);
+                if (inner_mode == NULL)
+                        goto error;
+
+                if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL) &&
+                    family != x->sel.family) {
+                        xfrm_put_mode(inner_mode);
+                        goto error;
+                }
+
+                x->inner_mode = inner_mode;
+        } else {
+                struct xfrm_mode *inner_mode_iaf;
+
+                inner_mode = xfrm_get_mode(x->props.mode, AF_INET);
+                if (inner_mode == NULL)
+                        goto error;
+
+                if (!(inner_mode->flags & XFRM_MODE_FLAG_TUNNEL)) {
+                        xfrm_put_mode(inner_mode);
+                        goto error;
+                }
+
+                inner_mode_iaf = xfrm_get_mode(x->props.mode, AF_INET6);
+                if (inner_mode_iaf == NULL)
+                        goto error;
+
+                if (!(inner_mode_iaf->flags & XFRM_MODE_FLAG_TUNNEL)) {
+                        xfrm_put_mode(inner_mode_iaf);
+                        goto error;
+                }
+
+                if (x->props.family == AF_INET) {
+                        x->inner_mode = inner_mode;
+                        x->inner_mode_iaf = inner_mode_iaf;
+                } else {
+                        x->inner_mode = inner_mode_iaf;
+                        x->inner_mode_iaf = inner_mode;
+                }
+        }
 
         x->type = xfrm_get_type(x->id.proto, family);
         if (x->type == NULL)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index f971ca5645f8..5d96f2728dc6 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -288,12 +288,9 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
         memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
         x->props.flags = p->flags;
 
-        /*
-         * Set inner address family if the KM left it as zero.
-         * See comment in validate_tmpl.
-         */
-        if (!x->sel.family)
+        if (x->props.mode == XFRM_MODE_TRANSPORT)
                 x->sel.family = p->family;
+
 }
 
 /*