2 files changed, 28 insertions, 0 deletions

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index cffa5dc66449..6ae4bc5ce8a7 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1601,6 +1601,28 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay
 }
 
 #ifdef CONFIG_XFRM_MIGRATE
+static inline int xfrm_replay_clone(struct xfrm_state *x,
+                                     struct xfrm_state *orig)
+{
+        x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
+                                GFP_KERNEL);
+        if (!x->replay_esn)
+                return -ENOMEM;
+
+        x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
+        x->replay_esn->replay_window = orig->replay_esn->replay_window;
+
+        x->preplay_esn = kmemdup(x->replay_esn,
+                                 xfrm_replay_state_esn_len(x->replay_esn),
+                                 GFP_KERNEL);
+        if (!x->preplay_esn) {
+                kfree(x->replay_esn);
+                return -ENOMEM;
+        }
+
+        return 0;
+}
+
 static inline struct xfrm_algo *xfrm_algo_clone(struct xfrm_algo *orig)
 {
         return kmemdup(orig, xfrm_alg_len(orig), GFP_KERNEL);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f83a3d1da81b..dd78536d40de 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1181,6 +1181,12 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
                         goto error;
         }
 
+        if (orig->replay_esn) {
+                err = xfrm_replay_clone(x, orig);
+                if (err)
+                        goto error;
+        }
+
         memcpy(&x->mark, &orig->mark, sizeof(x->mark));
 
         err = xfrm_init_state(x);