1 files changed, 10 insertions, 3 deletions

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8f0289b0fb24..4adaf8e1bb63 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -860,6 +860,7 @@ void tcp_wfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct tcp_sock *tp = tcp_sk(sk);
+        unsigned long flags, nval, oval;
         int wmem;
 
         /* Keep one reference on sk_wmem_alloc.
@@ -877,11 +878,17 @@ void tcp_wfree(struct sk_buff *skb)
         if (wmem >= SKB_TRUESIZE(1) && this_cpu_ksoftirqd() == current)
                 goto out;
 
-        if (test_and_clear_bit(TSQ_THROTTLED, &tp->tsq_flags) &&
-            !test_and_set_bit(TSQ_QUEUED, &tp->tsq_flags)) {
-                unsigned long flags;
+        for (oval = READ_ONCE(tp->tsq_flags);; oval = nval) {
                 struct tsq_tasklet *tsq;
 
+                if (!(oval & TSQF_THROTTLED) || (oval & TSQF_QUEUED))
+                        goto out;
+
+                nval = (oval & ~TSQF_THROTTLED) | TSQF_QUEUED;
+                nval = cmpxchg(&tp->tsq_flags, oval, nval);
+                if (nval != oval)
+                        continue;
+
                 /* queue this socket to tasklet queue */
                 local_irq_save(flags);
                 tsq = this_cpu_ptr(&tsq_tasklet);