2 files changed, 25 insertions, 10 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3f9bc3f0bba0..7881b96d2b72 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1559,7 +1559,17 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
             skb_queue_len(&tp->ucopy.prequeue) == 0)
                 return false;
 
-        skb_dst_force(skb);
+        /* Before escaping RCU protected region, we need to take care of skb
+         * dst. Prequeue is only enabled for established sockets.
+         * For such sockets, we might need the skb dst only to set sk->sk_rx_dst
+         * Instead of doing full sk_rx_dst validity here, let's perform
+         * an optimistic check.
+         */
+        if (likely(sk->sk_rx_dst))
+                skb_dst_drop(skb);
+        else
+                skb_dst_force(skb);
+
         __skb_queue_tail(&tp->ucopy.prequeue, skb);
         tp->ucopy.memory += skb->truesize;
         if (tp->ucopy.memory > sk->sk_rcvbuf) {
@@ -1765,9 +1775,11 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
 
-        dst_hold(dst);
-        sk->sk_rx_dst = dst;
-        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        if (dst) {
+                dst_hold(dst);
+                sk->sk_rx_dst = dst;
+                inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        }
 }
 EXPORT_SYMBOL(inet_sk_rx_dst_set);
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 5b3c70ff7a72..1835480336ac 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -93,13 +93,16 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
-        const struct rt6_info *rt = (const struct rt6_info *)dst;
 
-        dst_hold(dst);
-        sk->sk_rx_dst = dst;
-        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
-        if (rt->rt6i_node)
-                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
+        if (dst) {
+                const struct rt6_info *rt = (const struct rt6_info *)dst;
+
+                dst_hold(dst);
+                sk->sk_rx_dst = dst;
+                inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+                if (rt->rt6i_node)
+                        inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
+        }
 }
 
 static void tcp_v6_hash(struct sock *sk)