[XFRM]: Fix two bugs in xfrm_lookup()

- the found or allocated xfrm_states are not passed correctly to
  xfrm_bundle_create (and to the subsequent frees in case of create
  failing) if the first xfrm_tmpl_resolve failed and the second one
  succeeded.
- error handling is wrong.

net/xfrm/xfrm_policy.c

@@ -783,25 +783,27 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
 
 				__set_task_state(tsk, TASK_INTERRUPTIBLE);
 				add_wait_queue(&km_waitq, &wait);
-				err = xfrm_tmpl_resolve(policy, fl, xfrm, family);
-				if (err == -EAGAIN)
+				nx = xfrm_tmpl_resolve(policy, fl, xfrm, family);
+				if (nx == -EAGAIN)
 					schedule();
 				__set_task_state(tsk, TASK_RUNNING);
 				remove_wait_queue(&km_waitq, &wait);
 
-				if (err == -EAGAIN && signal_pending(current)) {
+				if (nx == -EAGAIN && signal_pending(current)) {
 					err = -ERESTART;
 					goto error;
 				}
-				if (err == -EAGAIN ||
+				if (nx == -EAGAIN ||
 				    genid != atomic_read(&flow_cache_genid)) {
 					xfrm_pol_put(policy);
 					goto restart;
 				}
+				err = nx;
 			}
-			if (err)
+			if (err < 0)
 				goto error;
-		} else if (nx == 0) {
+		}
+		if (nx == 0) {
 			/* Flow passes not transformed. */
 			xfrm_pol_put(policy);
 			return 0;