2 files changed, 4 insertions, 1 deletions

diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 3c2a281347e1..1bb3c5c35d2a 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1179,8 +1179,10 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
                 tchunk = list_entry(lchunk, struct sctp_chunk,
                                     transmitted_list);
                 tsn = ntohl(tchunk->subh.data_hdr->tsn);
-                if (TSN_lte(tsn, ctsn))
+                if (TSN_lte(tsn, ctsn)) {
+                        list_del_init(&tchunk->transmitted_list);
                         sctp_chunk_free(tchunk);
+                }
         }
 
         /* ii) Set rwnd equal to the newly received a_rwnd minus the
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 80b3c4f09e6c..e45be4e3f80d 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3224,6 +3224,7 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         }
 
         /* Free the cached last sent asconf chunk. */
+        list_del_init(&asconf->transmitted_list);
         sctp_chunk_free(asconf);
         asoc->addip_last_asconf = NULL;