When xfrm6_policy_check() is used, _decode_session6() is called after some
intermediate functions. This function uses IP6CB(), thus TCP_SKB_CB() must be
prepared after the call of xfrm6_policy_check().

Before this patch, scenarii with IPv6 + TCP + IPsec Transport are broken.

Fixes: 971f10ec ("tcp: better TCP_SKB_CB layout to reduce cache line misses")
Reported-by: NHuaibin Wang <huaibin.wang@6wind.com>
Suggested-by: NEric Dumazet <edumazet@google.com>
Signed-off-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>