When the last policy for a direction is replaced by a policy
with equal selector but a higher priority, insertion of the
new policy fails.

in xfrm_policy_insert:

        for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL; p = &pol->next) {
                if (!delpol && memcmp(&policy->selector, &pol->selector, 
sizeof(pol->selector)) == 0) {
                        if (excl) {
                                write_unlock_bh(&xfrm_policy_lock);
                                return -EEXIST;
                        }
                        *p = pol->next;
                        delpol = pol;
X                       if (policy->priority > pol->priority)
X                                continue;
                } else if (policy->priority >= pol->priority)
                        continue;
                if (!newpos)
                        newpos = p;
                if (delpol)
                        break;
        }

If the new policy has a higher priority than the old one, the
loop will be continued in the lines marked with X, but because
there are no further elements, it will leave the loop without
setting newpos.

The problem can be verified with ip xfrm:
# ip xfrm policy list
# ip xfrm policy update dir fwd src 10.0.0.1 dst 10.0.0.2 action allow 
priority 0
# ip xfrm policy list
src 10.0.0.1/32 dst 10.0.0.2/32
        dir fwd priority 0
# ip xfrm policy update dir fwd src 10.0.0.1 dst 10.0.0.2 action allow 
priority 1
# ip xfrm policy list
#

This patch checks for *p != NULL before continuing the loop.

Regards
Patrick