The keylist lock was not being acquired early enough in tcp_fastopen_check_cookie().
This opens a potential race between keylist updates and generating a cookie to give to a client who has not supplied a valid one, which can result in the effective add time of a new key being slightly later that it would have been otherwise, as viewed by the client. There is no danger here, but it should be fixed.