1 files changed, 7 insertions, 2 deletions

diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index ada17464b65b..63afddcbcd2c 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -969,11 +969,16 @@ static __u16 sctp_ulpq_renege_list(struct sctp_ulpq *ulpq,
 
         tsnmap = &ulpq->asoc->peer.tsn_map;
 
-        while ((skb = __skb_dequeue_tail(list)) != NULL) {
-                freed += skb_headlen(skb);
+        while ((skb = skb_peek_tail(list)) != NULL) {
                 event = sctp_skb2event(skb);
                 tsn = event->tsn;
 
+                /* Don't renege below the Cumulative TSN ACK Point. */
+                if (TSN_lte(tsn, sctp_tsnmap_get_ctsn(tsnmap)))
+                        break;
+
+                __skb_unlink(skb, list);
+                freed += skb_headlen(skb);
                 sctp_ulpevent_free(event);
                 sctp_tsnmap_renege(tsnmap, tsn);
                 if (freed >= needed)