1 files changed, 6 insertions, 3 deletions

diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 479effc97666..e12d0be5f976 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -10,7 +10,7 @@
  *              Split up af-specific functions
  *      Derek Atkins <derek@ihtfp.com>
  *              Add UDP Encapsulation
- *      
+ *
  */
 
 #include <linux/workqueue.h>
@@ -70,6 +70,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
                 x->type->destructor(x);
                 xfrm_put_type(x->type);
         }
+        security_xfrm_state_free(x);
         kfree(x);
 }
 
@@ -343,7 +344,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                               selector.
                          */
                         if (x->km.state == XFRM_STATE_VALID) {
-                                if (!xfrm_selector_match(&x->sel, fl, family))
+                                if (!xfrm_selector_match(&x->sel, fl, family) ||
+                                    !xfrm_sec_ctx_match(pol->security, x->security))
                                         continue;
                                 if (!best ||
                                     best->km.dying > x->km.dying ||
@@ -354,7 +356,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                                 acquire_in_progress = 1;
                         } else if (x->km.state == XFRM_STATE_ERROR ||
                                    x->km.state == XFRM_STATE_EXPIRED) {
-                                if (xfrm_selector_match(&x->sel, fl, family))
+                                if (xfrm_selector_match(&x->sel, fl, family) &&
+                                    xfrm_sec_ctx_match(pol->security, x->security))
                                         error = -ESRCH;
                         }
                 }