1 files changed, 7 insertions, 1 deletions

diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 87b22c0bc08c..b42f0e26f89e 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -103,10 +103,16 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
                         spin_lock_bh(&queue->syn_wait_lock);
                         while ((req = lopt->syn_table[i]) != NULL) {
                                 lopt->syn_table[i] = req->dl_next;
+                                /* Because of following del_timer_sync(),
+                                 * we must release the spinlock here
+                                 * or risk a dead lock.
+                                 */
+                                spin_unlock_bh(&queue->syn_wait_lock);
                                 atomic_inc(&lopt->qlen_dec);
-                                if (del_timer(&req->rsk_timer))
+                                if (del_timer_sync(&req->rsk_timer))
                                         reqsk_put(req);
                                 reqsk_put(req);
+                                spin_lock_bh(&queue->syn_wait_lock);
                         }
                         spin_unlock_bh(&queue->syn_wait_lock);
                 }