2 files changed, 12 insertions, 0 deletions

diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index abd07a443219..178bb9833311 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -57,10 +57,16 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
                 if (state == DCCP_TIME_WAIT)
                         timeo = DCCP_TIMEWAIT_LEN;
 
+                /* tw_timer is pinned, so we need to make sure BH are disabled
+                 * in following section, otherwise timer handler could run before
+                 * we complete the initialization.
+                 */
+                local_bh_disable();
                 inet_twsk_schedule(tw, timeo);
                 /* Linkage updates. */
                 __inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
                 inet_twsk_put(tw);
+                local_bh_enable();
         } else {
                 /* Sorry, if we're out of memory, just CLOSE this
                  * socket up.  We've got bigger problems than
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index e36eff0403f4..b079b619b60c 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -310,10 +310,16 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                 if (state == TCP_TIME_WAIT)
                         timeo = TCP_TIMEWAIT_LEN;
 
+                /* tw_timer is pinned, so we need to make sure BH are disabled
+                 * in following section, otherwise timer handler could run before
+                 * we complete the initialization.
+                 */
+                local_bh_disable();
                 inet_twsk_schedule(tw, timeo);
                 /* Linkage updates. */
                 __inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
                 inet_twsk_put(tw);
+                local_bh_enable();
         } else {
                 /* Sorry, if we're out of memory, just CLOSE this
                  * socket up.  We've got bigger problems than