2 files changed, 14 insertions, 4 deletions

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index e87377e1d6b6..13b29360d102 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -95,8 +95,13 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         esph->seq_no = htonl(++x->replay.oseq);
         xfrm_aevent_doreplay(x);
 
-        if (esp->conf.ivlen)
+        if (esp->conf.ivlen) {
+                if (unlikely(!esp->conf.ivinitted)) {
+                        get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                        esp->conf.ivinitted = 1;
+                }
                 crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
+        }
 
         do {
                 struct scatterlist *sg = &esp->sgbuf[0];
@@ -378,7 +383,7 @@ static int esp_init_state(struct xfrm_state *x)
                 esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL);
                 if (unlikely(esp->conf.ivec == NULL))
                         goto error;
-                get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                esp->conf.ivinitted = 0;
         }
         if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                 goto error;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index ae50b9511151..e78680a9985b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -99,8 +99,13 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         esph->seq_no = htonl(++x->replay.oseq);
         xfrm_aevent_doreplay(x);
 
-        if (esp->conf.ivlen)
+        if (esp->conf.ivlen) {
+                if (unlikely(!esp->conf.ivinitted)) {
+                        get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                        esp->conf.ivinitted = 1;
+                }
                 crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
+        }
 
         do {
                 struct scatterlist *sg = &esp->sgbuf[0];
@@ -353,7 +358,7 @@ static int esp6_init_state(struct xfrm_state *x)
                 esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL);
                 if (unlikely(esp->conf.ivec == NULL))
                         goto error;
-                get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                esp->conf.ivinitted = 0;
         }
         if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                 goto error;