--- x/net/l2tp/l2tp_core.c
+++ l/net/l2tp/l2tp_core.c
@@ -1474,7 +1474,6 @@ int l2tp_tunnel_register(struct l2tp_tun
 	}
 
 	sk = sock->sk;
-	write_lock(&sk->sk_callback_lock);
 
 	ret = l2tp_validate_socket(sk, net, tunnel->encap);
 	if (ret < 0)
@@ -1507,12 +1506,15 @@ int l2tp_tunnel_register(struct l2tp_tun
 		};
 
 		setup_udp_tunnel_sock(net, sock, &udp_cfg);
+		write_lock(&sk->sk_callback_lock);
 	} else {
+		write_lock(&sk->sk_callback_lock);
 		rcu_assign_sk_user_data(sk, tunnel);
 	}
 
 	tunnel->old_sk_destruct = sk->sk_destruct;
 	sk->sk_destruct = &l2tp_tunnel_destruct;
+	write_unlock(&sk->sk_callback_lock);
 	lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class,
 				   "l2tp_sock");
 	sk->sk_allocation = GFP_ATOMIC;
@@ -1522,7 +1524,6 @@ int l2tp_tunnel_register(struct l2tp_tun
 	if (tunnel->fd >= 0)
 		sockfd_put(sock);
 
-	write_unlock(&sk->sk_callback_lock);
 	return 0;
 
 err_sock:
@@ -1531,7 +1532,6 @@ err_sock:
 	else
 		sockfd_put(sock);
 
-	write_unlock(&sk->sk_callback_lock);
 err:
 	return ret;
 }