2 files changed, 2 insertions, 7 deletions

diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 632090b961c3..3a1767ef3201 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1421,8 +1421,8 @@ static void sctp_chunk_destroy(struct sctp_chunk *chunk)
         BUG_ON(!list_empty(&chunk->list));
         list_del_init(&chunk->transmitted_list);
 
-        /* Free the chunk skb data and the SCTP_chunk stub itself. */
-        dev_kfree_skb(chunk->skb);
+        consume_skb(chunk->skb);
+        consume_skb(chunk->auth_chunk);
 
         SCTP_DBG_OBJCNT_DEC(chunk);
         kmem_cache_free(sctp_chunk_cachep, chunk);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index ae65b6b5973a..01e002430c85 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -760,7 +760,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
 
                 /* Make sure that we and the peer are AUTH capable */
                 if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
-                        kfree_skb(chunk->auth_chunk);
                         sctp_association_free(new_asoc);
                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
                 }
@@ -775,10 +774,6 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
                 auth.transport = chunk->transport;
 
                 ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
-
-                /* We can now safely free the auth_chunk clone */
-                kfree_skb(chunk->auth_chunk);
-
                 if (ret != SCTP_IERROR_NO_ERROR) {
                         sctp_association_free(new_asoc);
                         return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);