1 files changed, 9 insertions, 4 deletions

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3578357abe30..5f9b102c3b55 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2666,7 +2666,7 @@ static void tcp_process_loss(struct sock *sk, int flag, int num_dupack,
         struct tcp_sock *tp = tcp_sk(sk);
         bool recovered = !before(tp->snd_una, tp->high_seq);
 
-        if ((flag & FLAG_SND_UNA_ADVANCED || tp->fastopen_rsk) &&
+        if ((flag & FLAG_SND_UNA_ADVANCED || rcu_access_pointer(tp->fastopen_rsk)) &&
             tcp_try_undo_loss(sk, false))
                 return;
 
@@ -2990,7 +2990,7 @@ void tcp_rearm_rto(struct sock *sk)
         /* If the retrans timer is currently being used by Fast Open
          * for SYN-ACK retrans purpose, stay put.
          */
-        if (tp->fastopen_rsk)
+        if (rcu_access_pointer(tp->fastopen_rsk))
                 return;
 
         if (!tp->packets_out) {
@@ -6087,6 +6087,8 @@ reset_and_undo:
 
 static void tcp_rcv_synrecv_state_fastopen(struct sock *sk)
 {
+        struct request_sock *req;
+
         tcp_try_undo_loss(sk, false);
 
         /* Reset rtx states to prevent spurious retransmits_timed_out() */
@@ -6096,7 +6098,9 @@ static void tcp_rcv_synrecv_state_fastopen(struct sock *sk)
         /* Once we leave TCP_SYN_RECV or TCP_FIN_WAIT_1,
          * we no longer need req so release it.
          */
-        reqsk_fastopen_remove(sk, tcp_sk(sk)->fastopen_rsk, false);
+        req = rcu_dereference_protected(tcp_sk(sk)->fastopen_rsk,
+                                        lockdep_sock_is_held(sk));
+        reqsk_fastopen_remove(sk, req, false);
 
         /* Re-arm the timer because data may have been sent out.
          * This is similar to the regular data transmission case
@@ -6171,7 +6175,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
 
         tcp_mstamp_refresh(tp);
         tp->rx_opt.saw_tstamp = 0;
-        req = tp->fastopen_rsk;
+        req = rcu_dereference_protected(tp->fastopen_rsk,
+                                        lockdep_sock_is_held(sk));
         if (req) {
                 bool req_stolen;