From 5b703aa02379455a1359b008711720c0cf68d658 Mon Sep 17 00:00:00 2001
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: Sun, 17 Aug 2003 14:14:54 -0700
Subject: [PATCH] [IPSEC]: Fix oops when destroying stillborn states.

---
 net/ipv4/ah4.c     | 3 +++
 net/ipv4/esp4.c    | 3 +++
 net/ipv4/ipcomp.c  | 4 +++-
 net/ipv6/ah6.c     | 3 +++
 net/ipv6/esp6.c    | 3 +++
 net/ipv6/ipcomp6.c | 4 +++-
 6 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 4641b35a273ce..d15c4ce97edac 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -308,6 +308,9 @@ static void ah_destroy(struct xfrm_state *x)
 {
 	struct ah_data *ahp = x->data;
 
+	if (!ahp)
+		return;
+
 	if (ahp->work_icv) {
 		kfree(ahp->work_icv);
 		ahp->work_icv = NULL;
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index b5187c936efe3..ce9eb8a326f6f 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -437,6 +437,9 @@ void esp_destroy(struct xfrm_state *x)
 {
 	struct esp_data *esp = x->data;
 
+	if (!esp)
+		return;
+
 	if (esp->conf.tfm) {
 		crypto_free_tfm(esp->conf.tfm);
 		esp->conf.tfm = NULL;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index a713530ae557b..eb61d3454015e 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -336,6 +336,8 @@ static void ipcomp_free_data(struct ipcomp_data *ipcd)
 static void ipcomp_destroy(struct xfrm_state *x)
 {
 	struct ipcomp_data *ipcd = x->data;
+	if (!ipcd)
+		return;
 	ipcomp_free_data(ipcd);
 	kfree(ipcd);
 }
@@ -354,7 +356,6 @@ static int ipcomp_init_state(struct xfrm_state *x, void *args)
 	x->props.header_len = sizeof(struct ip_comp_hdr);
 	if (x->props.mode)
 		x->props.header_len += sizeof(struct iphdr);
-	x->data = ipcd;
 
 	ipcd->scratch = kmalloc(IPCOMP_SCRATCH_SIZE, GFP_KERNEL);
 	if (!ipcd->scratch)
@@ -373,6 +374,7 @@ static int ipcomp_init_state(struct xfrm_state *x, void *args)
 	calg_desc = xfrm_calg_get_byname(x->calg->alg_name);
 	BUG_ON(!calg_desc);
 	ipcd->threshold = calg_desc->uinfo.comp.threshold;
+	x->data = ipcd;
 	err = 0;
 out:
 	return err;
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c13efb13eaf9c..358b3f3f3d183 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -444,6 +444,9 @@ static void ah6_destroy(struct xfrm_state *x)
 {
 	struct ah_data *ahp = x->data;
 
+	if (!ahp)
+		return;
+
 	if (ahp->work_icv) {
 		kfree(ahp->work_icv);
 		ahp->work_icv = NULL;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 992009213c3c9..db09e37225109 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -342,6 +342,9 @@ void esp6_destroy(struct xfrm_state *x)
 {
 	struct esp_data *esp = x->data;
 
+	if (!esp)
+		return;
+
 	if (esp->conf.tfm) {
 		crypto_free_tfm(esp->conf.tfm);
 		esp->conf.tfm = NULL;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 2101765131c9a..58ddfcab5b84d 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -268,6 +268,8 @@ static void ipcomp6_free_data(struct ipcomp_data *ipcd)
 static void ipcomp6_destroy(struct xfrm_state *x)
 {
 	struct ipcomp_data *ipcd = x->data;
+	if (!ipcd)
+		return;
 	ipcomp6_free_data(ipcd);
 	kfree(ipcd);
 }
@@ -286,7 +288,6 @@ static int ipcomp6_init_state(struct xfrm_state *x, void *args)
 	x->props.header_len = sizeof(struct ipv6_comp_hdr);
 	if (x->props.mode)
 		x->props.header_len += sizeof(struct ipv6hdr);
-	x->data = ipcd;
 	
 	ipcd->scratch = kmalloc(IPCOMP_SCRATCH_SIZE, GFP_KERNEL);
 	if (!ipcd->scratch)
@@ -299,6 +300,7 @@ static int ipcomp6_init_state(struct xfrm_state *x, void *args)
 	calg_desc = xfrm_calg_get_byname(x->calg->alg_name);
 	BUG_ON(!calg_desc);
 	ipcd->threshold = calg_desc->uinfo.comp.threshold;
+	x->data = ipcd;
 	err = 0;
 out:
 	return err;
-- 
2.53.0