target/linux/generic/patches-4.9/616-net_optimize_xfrm_calls.patch

   1 --- a/net/netfilter/nf_nat_core.c
   2 +++ b/net/netfilter/nf_nat_core.c
   3 @@ -95,6 +95,9 @@ int nf_xfrm_me_harder(struct net *net, s
   4         struct dst_entry *dst;
   5         int err;
   6
   7 +       if (skb->dev && !dev_net(skb->dev)->xfrm.policy_count[XFRM_POLICY_OUT])
   8 +               return 0;
   9 +
  10         err = xfrm_decode_session(skb, &fl, family);
  11         if (err < 0)
  12                 return err;