1 files changed, 12 insertions, 17 deletions

diff --git a/net/key/af_key.c b/net/key/af_key.c
index ff5c3d03005e..143d46f6329a 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1253,8 +1253,11 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         struct sadb_x_sa2 *sa2;
         struct sadb_address *saddr, *daddr;
         struct sadb_msg *out_hdr;
+        struct sadb_spirange *range;
         struct xfrm_state *x = NULL;
         int mode;
+        int err;
+        u32 min_spi, max_spi;
         u32 reqid;
         u8 proto;
         unsigned short family;
@@ -1309,25 +1312,17 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         if (x == NULL)
                 return -ENOENT;
 
-        resp_skb = ERR_PTR(-ENOENT);
-
-        spin_lock_bh(&x->lock);
-        if (x->km.state != XFRM_STATE_DEAD) {
-                struct sadb_spirange *range = ext_hdrs[SADB_EXT_SPIRANGE-1];
-                u32 min_spi, max_spi;
+        min_spi = 0x100;
+        max_spi = 0x0fffffff;
 
-                if (range != NULL) {
-                        min_spi = range->sadb_spirange_min;
-                        max_spi = range->sadb_spirange_max;
-                } else {
-                        min_spi = 0x100;
-                        max_spi = 0x0fffffff;
-                }
-                xfrm_alloc_spi(x, htonl(min_spi), htonl(max_spi));
-                if (x->id.spi)
-                        resp_skb = pfkey_xfrm_state2msg(x, 0, 3);
+        range = ext_hdrs[SADB_EXT_SPIRANGE-1];
+        if (range) {
+                min_spi = range->sadb_spirange_min;
+                max_spi = range->sadb_spirange_max;
         }
-        spin_unlock_bh(&x->lock);
+
+        err = xfrm_alloc_spi(x, min_spi, max_spi);
+        resp_skb = err ? ERR_PTR(err) : pfkey_xfrm_state2msg(x, 0, 3);
 
         if (IS_ERR(resp_skb)) {
                 xfrm_state_put(x);