[IPV6] XFRM: add missing xfrm6_policy_check().

net/ipv6/ip6_tunnel.c

@@ -512,6 +512,11 @@ ip6ip6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 	read_lock(&ip6ip6_lock);
 
 	if ((t = ip6ip6_tnl_lookup(&ipv6h->saddr, &ipv6h->daddr)) != NULL) {
+		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+			kfree_skb(skb);
+			return 0;
+		}
+
 		if (!(t->parms.flags & IP6_TNL_F_CAP_RCV)) {
 			t->stat.rx_dropped++;
 			read_unlock(&ip6ip6_lock);