1 files changed, 8 insertions, 2 deletions

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 271cd01d57ae..dd28fb239a60 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -844,9 +844,15 @@ static int tcp_packet(struct nf_conn *ct,
                         /* Attempt to reopen a closed/aborted connection.
                          * Delete this connection and look up again. */
                         write_unlock_bh(&tcp_lock);
-                        if (del_timer(&ct->timeout))
+                        /* Only repeat if we can actually remove the timer.
+                         * Destruction may already be in progress in process
+                         * context and we must give it a chance to terminate.
+                         */
+                        if (del_timer(&ct->timeout)) {
                                 ct->timeout.function((unsigned long)ct);
-                        return -NF_REPEAT;
+                                return -NF_REPEAT;
+                        }
+                        return -NF_DROP;
                 }
                 /* Fall through */
         case TCP_CONNTRACK_IGNORE: