1 files changed, 2 insertions, 1 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 45a95e032bdf..89ea0a7018b5 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1895,7 +1895,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                 /* Because we don't lock the socket,
                  * we might find a transient negative value.
                  */
-                rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
+                rx_queue = max_t(int, READ_ONCE(tp->rcv_nxt) -
+                                      tp->copied_seq, 0);
 
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "