From 286791deef91c66ba116a7f04eaffcf0b515907f Mon Sep 17 00:00:00 2001
From: Patrick McHardy <kaber@trash.net>
Date: Wed, 9 Jul 2008 15:06:12 -0700
Subject: [PATCH] --- yaml --- r: 98829 b: refs/heads/master c:
 6b69fe0c73c0f5a8dacf8f889db3cc9adee53649 h: refs/heads/master i:   98827:
 e76e9ade5628ff8930a622e3a42c8595be763002 v: v3

---
 [refs]                                       |  2 +-
 trunk/net/netfilter/nf_conntrack_proto_tcp.c | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index c235b57b108e..a5d86064324a 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 32e8d4948bb0b5f3f0ac5cdb71d0ac8e305b29a5
+refs/heads/master: 6b69fe0c73c0f5a8dacf8f889db3cc9adee53649
diff --git a/trunk/net/netfilter/nf_conntrack_proto_tcp.c b/trunk/net/netfilter/nf_conntrack_proto_tcp.c
index 271cd01d57ae..dd28fb239a60 100644
--- a/trunk/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/trunk/net/netfilter/nf_conntrack_proto_tcp.c
@@ -844,9 +844,15 @@ static int tcp_packet(struct nf_conn *ct,
 			/* Attempt to reopen a closed/aborted connection.
 			 * Delete this connection and look up again. */
 			write_unlock_bh(&tcp_lock);
-			if (del_timer(&ct->timeout))
+			/* Only repeat if we can actually remove the timer.
+			 * Destruction may already be in progress in process
+			 * context and we must give it a chance to terminate.
+			 */
+			if (del_timer(&ct->timeout)) {
 				ct->timeout.function((unsigned long)ct);
-			return -NF_REPEAT;
+				return -NF_REPEAT;
+			}
+			return -NF_DROP;
 		}
 		/* Fall through */
 	case TCP_CONNTRACK_IGNORE: