1 files changed, 7 insertions, 2 deletions

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 318c6786d653..1b5d669e3029 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -235,8 +235,12 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk,
                                               sctp_assoc_t id)
 {
         struct sctp_association *addr_asoc = NULL, *id_asoc = NULL;
-        struct sctp_transport *transport;
+        struct sctp_af *af = sctp_get_af_specific(addr->ss_family);
         union sctp_addr *laddr = (union sctp_addr *)addr;
+        struct sctp_transport *transport;
+
+        if (!af || sctp_verify_addr(sk, laddr, af->sockaddr_len))
+                return NULL;
 
         addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep,
                                                laddr,
@@ -7422,7 +7426,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                  */
                 release_sock(sk);
                 current_timeo = schedule_timeout(current_timeo);
-                BUG_ON(sk != asoc->base.sk);
+                if (sk != asoc->base.sk)
+                        goto do_error;
                 lock_sock(sk);
 
                 *timeo_p = current_timeo;