1 files changed, 12 insertions, 1 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 412139f4eccd..883df0ad5bfe 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1451,6 +1451,7 @@ process:
 
         if (sk->sk_state == TCP_NEW_SYN_RECV) {
                 struct request_sock *req = inet_reqsk(sk);
+                bool req_stolen = false;
                 struct sock *nsk;
 
                 sk = req->rsk_listener;
@@ -1470,10 +1471,20 @@ process:
                         th = (const struct tcphdr *)skb->data;
                         hdr = ipv6_hdr(skb);
                         tcp_v6_fill_cb(skb, hdr, th);
-                        nsk = tcp_check_req(sk, skb, req, false);
+                        nsk = tcp_check_req(sk, skb, req, false, &req_stolen);
                 }
                 if (!nsk) {
                         reqsk_put(req);
+                        if (req_stolen) {
+                                /* Another cpu got exclusive access to req
+                                 * and created a full blown socket.
+                                 * Try to feed this packet to this socket
+                                 * instead of discarding it.
+                                 */
+                                tcp_v6_restore_cb(skb);
+                                sock_put(sk);
+                                goto lookup;
+                        }
                         goto discard_and_relse;
                 }
                 if (nsk == sk) {