1 files changed, 6 insertions, 5 deletions

diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 05be564414e9..dd5a6317a801 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -386,15 +386,13 @@ abort:		tcp_write_err(sk);
  *      Timer for Fast Open socket to retransmit SYNACK. Note that the
  *      sk here is the child socket, not the parent (listener) socket.
  */
-static void tcp_fastopen_synack_timer(struct sock *sk)
+static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         int max_retries = icsk->icsk_syn_retries ? :
             sock_net(sk)->ipv4.sysctl_tcp_synack_retries + 1; /* add one more retry for fastopen */
         struct tcp_sock *tp = tcp_sk(sk);
-        struct request_sock *req;
 
-        req = tcp_sk(sk)->fastopen_rsk;
         req->rsk_ops->syn_ack_timeout(req);
 
         if (req->num_timeout >= max_retries) {
@@ -435,11 +433,14 @@ void tcp_retransmit_timer(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct net *net = sock_net(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct request_sock *req;
 
-        if (tp->fastopen_rsk) {
+        req = rcu_dereference_protected(tp->fastopen_rsk,
+                                        lockdep_sock_is_held(sk));
+        if (req) {
                 WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
                              sk->sk_state != TCP_FIN_WAIT1);
-                tcp_fastopen_synack_timer(sk);
+                tcp_fastopen_synack_timer(sk, req);
                 /* Before we receive ACK to our SYN-ACK don't retransmit
                  * anything else (e.g., data or FIN segments).
                  */