Hi, On Fri, Nov 13, 2020 at 05:18:24PM +0800, Xin Long wrote: ... > diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c > index 813d307..0a51150 100644 > --- a/net/sctp/sm_sideeffect.c > +++ b/net/sctp/sm_sideeffect.c > @@ -419,7 +419,7 @@ void sctp_generate_proto_unreach_event(struct timer_list *t) > /* Try again later. */ > if (!mod_timer(&transport->proto_unreach_timer, > jiffies + (HZ/20))) > - sctp_association_hold(asoc); > + sctp_transport_hold(transport); > goto out_unlock; > } > The chunk above covers the socket busy case, but for the normal cases it also needs: @@ -435,7 +435,7 @@ void sctp_generate_proto_unreach_event(struct timer_list *t) out_unlock: bh_unlock_sock(sk); - sctp_association_put(asoc); + sctp_transport_put(asoc); } /* Handle the timeout of the RE-CONFIG timer. */ > diff --git a/net/sctp/transport.c b/net/sctp/transport.c > index 806af58..60fcf31 100644 > --- a/net/sctp/transport.c > +++ b/net/sctp/transport.c > @@ -133,7 +133,7 @@ void sctp_transport_free(struct sctp_transport *transport) > > /* Delete the ICMP proto unreachable timer if it's active. */ > if (del_timer(&transport->proto_unreach_timer)) > - sctp_association_put(transport->asoc); > + sctp_transport_put(transport); > > sctp_transport_put(transport); Btw, quite noticeable on the above list of timers that only this timer was using a reference on the asoc. Seems we're good now, then. :-) Marcelo