1 files changed, 4 insertions, 11 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index d693cb988b78..d746d3b27efb 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -114,16 +114,9 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                 int low = sysctl_local_port_range[0];
                 int high = sysctl_local_port_range[1];
                 int remaining = (high - low) + 1;
-                int rover;
+                int rover = net_random() % (high - low) + low;
 
-                spin_lock(&tcp_hashinfo.portalloc_lock);
-                if (tcp_hashinfo.port_rover < low)
-                        rover = low;
-                else
-                        rover = tcp_hashinfo.port_rover;
-                do {    rover++;
-                        if (rover > high)
-                                rover = low;
+                do {
                         head = &tcp_hashinfo.bhash[inet_bhashfn(rover, tcp_hashinfo.bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
@@ -132,9 +125,9 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                         break;
                 next:
                         spin_unlock(&head->lock);
+                        if (++rover > high)
+                                rover = low;
                 } while (--remaining > 0);
-                tcp_hashinfo.port_rover = rover;
-                spin_unlock(&tcp_hashinfo.portalloc_lock);
 
                 /* Exhausted local port range during search?  It is not
                  * possible for us to be holding one of the bind hash