1 files changed, 11 insertions, 2 deletions

diff --git a/net/core/timestamping.c b/net/core/timestamping.c
index 98a52640e7cd..661b5a40ec10 100644
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -21,6 +21,7 @@
 #include <linux/phy.h>
 #include <linux/ptp_classify.h>
 #include <linux/skbuff.h>
+#include <linux/export.h>
 
 static struct sock_filter ptp_filter[] = {
         PTP_FILTER
@@ -57,9 +58,13 @@ void skb_clone_tx_timestamp(struct sk_buff *skb)
         case PTP_CLASS_V2_VLAN:
                 phydev = skb->dev->phydev;
                 if (likely(phydev->drv->txtstamp)) {
+                        if (!atomic_inc_not_zero(&sk->sk_refcnt))
+                                return;
                         clone = skb_clone(skb, GFP_ATOMIC);
-                        if (!clone)
+                        if (!clone) {
+                                sock_put(sk);
                                 return;
+                        }
                         clone->sk = sk;
                         phydev->drv->txtstamp(phydev, clone, type);
                 }
@@ -77,8 +82,11 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         struct sock_exterr_skb *serr;
         int err;
 
-        if (!hwtstamps)
+        if (!hwtstamps) {
+                sock_put(sk);
+                kfree_skb(skb);
                 return;
+        }
 
         *skb_hwtstamps(skb) = *hwtstamps;
         serr = SKB_EXT_ERR(skb);
@@ -87,6 +95,7 @@ void skb_complete_tx_timestamp(struct sk_buff *skb,
         serr->ee.ee_origin = SO_EE_ORIGIN_TIMESTAMPING;
         skb->sk = NULL;
         err = sock_queue_err_skb(sk, skb);
+        sock_put(sk);
         if (err)
                 kfree_skb(skb);
 }