3 files changed, 7 insertions, 4 deletions

diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index e03b93360f33..a8cd5cf9ff5b 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -132,8 +132,7 @@ static inline int inet_request_bound_dev_if(const struct sock *sk,
 
 static inline struct ip_options_rcu *ireq_opt_deref(const struct inet_request_sock *ireq)
 {
-        return rcu_dereference_check(ireq->ireq_opt,
-                                     refcount_read(&ireq->req.rsk_refcnt) > 0);
+        return rcu_dereference(ireq->ireq_opt);
 }
 
 struct inet_cork {
diff --git a/net/dccp/input.c b/net/dccp/input.c
index d28d46bff6ab..85d6c879383d 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -606,11 +606,13 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
         if (sk->sk_state == DCCP_LISTEN) {
                 if (dh->dccph_type == DCCP_PKT_REQUEST) {
                         /* It is possible that we process SYN packets from backlog,
-                         * so we need to make sure to disable BH right there.
+                         * so we need to make sure to disable BH and RCU right there.
                          */
+                        rcu_read_lock();
                         local_bh_disable();
                         acceptable = inet_csk(sk)->icsk_af_ops->conn_request(sk, skb) >= 0;
                         local_bh_enable();
+                        rcu_read_unlock();
                         if (!acceptable)
                                 return 1;
                         consume_skb(skb);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4cf2f7bb2802..47e08c1b5bc3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6009,11 +6009,13 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
                         if (th->fin)
                                 goto discard;
                         /* It is possible that we process SYN packets from backlog,
-                         * so we need to make sure to disable BH right there.
+                         * so we need to make sure to disable BH and RCU right there.
                          */
+                        rcu_read_lock();
                         local_bh_disable();
                         acceptable = icsk->icsk_af_ops->conn_request(sk, skb) >= 0;
                         local_bh_enable();
+                        rcu_read_unlock();
 
                         if (!acceptable)
                                 return 1;