[IPSEC]: Fix oops when destroying stillborn states.

net/ipv4/ah4.c

@@ -308,6 +308,9 @@ static void ah_destroy(struct xfrm_state *x)
 {
 	struct ah_data *ahp = x->data;
 
+	if (!ahp)
+		return;
+
 	if (ahp->work_icv) {
 		kfree(ahp->work_icv);
 		ahp->work_icv = NULL;

net/ipv4/esp4.c

@@ -437,6 +437,9 @@ void esp_destroy(struct xfrm_state *x)
 {
 	struct esp_data *esp = x->data;
 
+	if (!esp)
+		return;
+
 	if (esp->conf.tfm) {
 		crypto_free_tfm(esp->conf.tfm);
 		esp->conf.tfm = NULL;

net/ipv4/ipcomp.c

@@ -336,6 +336,8 @@ static void ipcomp_free_data(struct ipcomp_data *ipcd)
 static void ipcomp_destroy(struct xfrm_state *x)
 {
 	struct ipcomp_data *ipcd = x->data;
+	if (!ipcd)
+		return;
 	ipcomp_free_data(ipcd);
 	kfree(ipcd);
 }
@@ -354,7 +356,6 @@ static int ipcomp_init_state(struct xfrm_state *x, void *args)
 	x->props.header_len = sizeof(struct ip_comp_hdr);
 	if (x->props.mode)
 		x->props.header_len += sizeof(struct iphdr);
-	x->data = ipcd;
 
 	ipcd->scratch = kmalloc(IPCOMP_SCRATCH_SIZE, GFP_KERNEL);
 	if (!ipcd->scratch)
@@ -373,6 +374,7 @@ static int ipcomp_init_state(struct xfrm_state *x, void *args)
 	calg_desc = xfrm_calg_get_byname(x->calg->alg_name);
 	BUG_ON(!calg_desc);
 	ipcd->threshold = calg_desc->uinfo.comp.threshold;
+	x->data = ipcd;
 	err = 0;
 out:
 	return err;

net/ipv6/ah6.c

@@ -444,6 +444,9 @@ static void ah6_destroy(struct xfrm_state *x)
 {
 	struct ah_data *ahp = x->data;
 
+	if (!ahp)
+		return;
+
 	if (ahp->work_icv) {
 		kfree(ahp->work_icv);
 		ahp->work_icv = NULL;

net/ipv6/esp6.c

@@ -342,6 +342,9 @@ void esp6_destroy(struct xfrm_state *x)
 {
 	struct esp_data *esp = x->data;
 
+	if (!esp)
+		return;
+
 	if (esp->conf.tfm) {
 		crypto_free_tfm(esp->conf.tfm);
 		esp->conf.tfm = NULL;

net/ipv6/ipcomp6.c

@@ -268,6 +268,8 @@ static void ipcomp6_free_data(struct ipcomp_data *ipcd)
 static void ipcomp6_destroy(struct xfrm_state *x)
 {
 	struct ipcomp_data *ipcd = x->data;
+	if (!ipcd)
+		return;
 	ipcomp6_free_data(ipcd);
 	kfree(ipcd);
 }
@@ -286,7 +288,6 @@ static int ipcomp6_init_state(struct xfrm_state *x, void *args)
 	x->props.header_len = sizeof(struct ipv6_comp_hdr);
 	if (x->props.mode)
 		x->props.header_len += sizeof(struct ipv6hdr);
-	x->data = ipcd;
 	
 	ipcd->scratch = kmalloc(IPCOMP_SCRATCH_SIZE, GFP_KERNEL);
 	if (!ipcd->scratch)
@@ -299,6 +300,7 @@ static int ipcomp6_init_state(struct xfrm_state *x, void *args)
 	calg_desc = xfrm_calg_get_byname(x->calg->alg_name);
 	BUG_ON(!calg_desc);
 	ipcd->threshold = calg_desc->uinfo.comp.threshold;
+	x->data = ipcd;
 	err = 0;
 out:
 	return err;