1 files changed, 12 insertions, 2 deletions

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index db148c4a916a..de09f514428c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1198,6 +1198,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
  * @skb: pointer to message buffer.
  */
 static void tipc_sk_conn_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
+                                   struct sk_buff_head *inputq,
                                    struct sk_buff_head *xmitq)
 {
         struct tipc_msg *hdr = buf_msg(skb);
@@ -1215,7 +1216,16 @@ static void tipc_sk_conn_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
                 tipc_node_remove_conn(sock_net(sk), tsk_peer_node(tsk),
                                       tsk_peer_port(tsk));
                 sk->sk_state_change(sk);
-                goto exit;
+
+                /* State change is ignored if socket already awake,
+                 * - convert msg to abort msg and add to inqueue
+                 */
+                msg_set_user(hdr, TIPC_CRITICAL_IMPORTANCE);
+                msg_set_type(hdr, TIPC_CONN_MSG);
+                msg_set_size(hdr, BASIC_H_SIZE);
+                msg_set_hdr_sz(hdr, BASIC_H_SIZE);
+                __skb_queue_tail(inputq, skb);
+                return;
         }
 
         tsk->probe_unacked = false;
@@ -1943,7 +1953,7 @@ static void tipc_sk_proto_rcv(struct sock *sk,
 
         switch (msg_user(hdr)) {
         case CONN_MANAGER:
-                tipc_sk_conn_proto_rcv(tsk, skb, xmitq);
+                tipc_sk_conn_proto_rcv(tsk, skb, inputq, xmitq);
                 return;
         case SOCK_WAKEUP:
                 tipc_dest_del(&tsk->cong_links, msg_orignode(hdr), 0);