[SCTP]: Make sure the chunk is off the transmitted list prior to freeing.

In a few instances, we need to remove the chunk from the transmitted list
prior to freeing it.  This is because the free code doesn't do that any
more and so we need to do it manually.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>

2 files changed, 4 insertions, 1 deletions

diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 3c2a281347e1..1bb3c5c35d2a 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1179,8 +1179,10 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
                 tchunk = list_entry(lchunk, struct sctp_chunk,
                                     transmitted_list);
                 tsn = ntohl(tchunk->subh.data_hdr->tsn);
-                if (TSN_lte(tsn, ctsn))
+                if (TSN_lte(tsn, ctsn)) {
+                        list_del_init(&tchunk->transmitted_list);
                         sctp_chunk_free(tchunk);
+                }
         }
 
         /* ii) Set rwnd equal to the newly received a_rwnd minus the
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 80b3c4f09e6c..e45be4e3f80d 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3224,6 +3224,7 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         }
 
         /* Free the cached last sent asconf chunk. */
+        list_del_init(&asconf->transmitted_list);
         sctp_chunk_free(asconf);
         asoc->addip_last_asconf = NULL;