xfrm async resumption hold dev ref until after transport_finish.
When afinfo is NULL (e.g. x->props.family is invalid) and xfrm_gro
is not set, dev_put in transport_finish() and xfrm_gro path is skipped.
This will trigger refcnt leak.

Add dev_put in return path to fix it.

Fixes: 1c428b038400 ("xfrm: hold dev ref until after transport_finish NF_HOOK")
Signed-off-by: Dong Chenchen <dongchenchen2@huawei.com>
---
 net/xfrm/xfrm_input.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index f65291eba1f6..c98a29d80a53 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -765,6 +765,8 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
 			return err;
 		}
 
+		if (unlikely(!afinfo) && async)
+			dev_put(skb->dev);
 		return err;
 	}
 
-- 
2.25.1