Christian Hopps [off-list ref] wrote:

+static void iptfs_output_queued(struct xfrm_state *x, struct sk_buff_head *list)
+{
+	struct xfrm_iptfs_data *xtfs = x->mode_data;
+	struct sk_buff *skb, *skb2, **nextp;
+	struct skb_shared_info *shi;
+

[..]

+			if (skb->dev)
+				XFRM_INC_STATS(dev_net(skb->dev),
+					       LINUX_MIB_XFRMOUTERROR);

Nit:
Here and in several places you are using dev_net() helper.

I think that if xfrm_state is available, then xs_net(x) makes more sense.

It also avoids the skb->dev conditional.