/* Attempt to reopen a closed/aborted connection.
                         * Delete this connection and look up again. */
                        write_unlock_bh(&tcp_lock);
-                       nf_ct_kill(ct);
-                       return -NF_REPEAT;
++
+                       /* Only repeat if we can actually remove the timer.
+                        * Destruction may already be in progress in process
+                        * context and we must give it a chance to terminate.
+                        */
 -                      if (del_timer(&ct->timeout)) {
 -                              ct->timeout.function((unsigned long)ct);
++                      if (nf_ct_kill(ct))
+                               return -NF_REPEAT;
 -                      }
+                       return -NF_DROP;
                }
                /* Fall through */
        case TCP_CONNTRACK_IGNORE: