[SCTP]: Fix potential race condition between sctp_close() and sctp_rcv().

Do not release the reference to association/endpoint if an incoming skb is
added to backlog. Instead release it after the chunk is processed in
sctp_backlog_rcv().

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index 2d33922c044b..297b8951463e 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -73,8 +73,10 @@ void sctp_inq_free(struct sctp_inq *queue)
         /* If there is a packet which is currently being worked on,
          * free it as well.
          */
-        if (queue->in_progress)
+        if (queue->in_progress) {
                 sctp_chunk_free(queue->in_progress);
+                queue->in_progress = NULL;
+        }
 
         if (queue->malloced) {
                 /* Dump the master memory segment.  */