@@ -28,7 +28,7 @@ struct netns_sctp {
 	 * It is a list of sctp_sockaddr_entry.
 	 */
 	struct list_head local_addr_list;
-	struct list_head addr_waitq;
+	struct list_head __rcu addr_waitq;
 	struct timer_list addr_wq_timer;
 	struct list_head auto_asconf_splist;
 	spinlock_t addr_wq_lock;

@@ -593,15 +593,47 @@ static void sctp_v4_ecn_capable(struct sock *sk)
 	INET_ECN_xmit(sk);
 }
 
+static void sctp_free_addr_wq(struct net *net)
+{
+	struct sctp_sockaddr_entry *addrw;
+
+	spin_lock_bh(&net->sctp.addr_wq_lock);
+	del_timer(&net->sctp.addr_wq_timer);
+	list_for_each_entry_rcu(addrw, &net->sctp.addr_waitq, list) {
+		list_del_rcu(&addrw->list);
+		kfree_rcu(addrw, rcu);
+	}
+	spin_unlock_bh(&net->sctp.addr_wq_lock);
+}
+
+/* As there is no refcnt on sctp_sockaddr_entry, we must check inside
+ * the lock if it wasn't removed from addr_waitq already, otherwise we
+ * could double-free it.
+ */
+static void sctp_free_addr_wq_entry(struct net *net,
+				    struct sctp_sockaddr_entry *addrw)
+{
+	struct sctp_sockaddr_entry *temp;
+
+	spin_lock_bh(&net->sctp.addr_wq_lock);
+	list_for_each_entry_rcu(temp, &net->sctp.addr_waitq, list) {
+		if (temp == addrw) {
+			list_del_rcu(&addrw->list);
+			kfree_rcu(addrw, rcu);
+			break;
+		}
+	}
+	spin_unlock_bh(&net->sctp.addr_wq_lock);
+}
+
 static void sctp_addr_wq_timeout_handler(unsigned long arg)
 {
 	struct net *net = (struct net *)arg;
-	struct sctp_sockaddr_entry *addrw, *temp;
+	struct sctp_sockaddr_entry *addrw;
 	struct sctp_sock *sp;
 
-	spin_lock_bh(&net->sctp.addr_wq_lock);
-
-	list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) {
+	rcu_read_lock_bh();
+	list_for_each_entry_rcu(addrw, &net->sctp.addr_waitq, list) {
 		pr_debug("%s: the first ent in wq:%p is addr:%pISc for cmd:%d at "
 			 "entry:%p\n", __func__, &net->sctp.addr_waitq, &addrw->a.sa,
 			 addrw->state, addrw);

@@ -647,35 +679,20 @@ static void sctp_addr_wq_timeout_handler(unsigned long arg)
 #if IS_ENABLED(CONFIG_IPV6)
 free_next:
 #endif
-		list_del(&addrw->list);
-		kfree(addrw);
-	}
-	spin_unlock_bh(&net->sctp.addr_wq_lock);
-}
-
-static void sctp_free_addr_wq(struct net *net)
-{
-	struct sctp_sockaddr_entry *addrw;
-	struct sctp_sockaddr_entry *temp;
-
-	spin_lock_bh(&net->sctp.addr_wq_lock);
-	del_timer(&net->sctp.addr_wq_timer);
-	list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) {
-		list_del(&addrw->list);
-		kfree(addrw);
+		sctp_free_addr_wq_entry(net, addrw);
 	}
-	spin_unlock_bh(&net->sctp.addr_wq_lock);
+	rcu_read_unlock_bh();
 }
 
 /* lookup the entry for the same address in the addr_waitq
- * sctp_addr_wq MUST be locked
+ * rcu read MUST be locked
  */
 static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct net *net,
 					struct sctp_sockaddr_entry *addr)
 {
 	struct sctp_sockaddr_entry *addrw;
 
-	list_for_each_entry(addrw, &net->sctp.addr_waitq, list) {
+	list_for_each_entry_rcu(addrw, &net->sctp.addr_waitq, list) {
 		if (addrw->a.sa.sa_family != addr->a.sa.sa_family)
 			continue;
 		if (addrw->a.sa.sa_family == AF_INET) {

@@ -702,7 +719,7 @@ void sctp_addr_wq_mgmt(struct net *net, struct sctp_sockaddr_entry *addr, int cm
 	 * new address after a couple of addition and deletion of that address
 	 */
 
-	spin_lock_bh(&net->sctp.addr_wq_lock);
+	rcu_read_lock_bh();
 	/* Offsets existing events in addr_wq */
 	addrw = sctp_addr_wq_lookup(net, addr);
 	if (addrw) {

@@ -710,22 +727,21 @@ void sctp_addr_wq_mgmt(struct net *net, struct sctp_sockaddr_entry *addr, int cm
 			pr_debug("%s: offsets existing entry for %d, addr:%pISc "
 				 "in wq:%p\n", __func__, addrw->state, &addrw->a.sa,
 				 &net->sctp.addr_waitq);
-
-			list_del(&addrw->list);
-			kfree(addrw);
+			sctp_free_addr_wq_entry(net, addrw);
 		}
-		spin_unlock_bh(&net->sctp.addr_wq_lock);
+		rcu_read_unlock_bh();
 		return;
 	}
+	rcu_read_unlock_bh();
 
 	/* OK, we have to add the new address to the wait queue */
 	addrw = kmemdup(addr, sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
-	if (addrw == NULL) {
-		spin_unlock_bh(&net->sctp.addr_wq_lock);
+	if (!addrw)
 		return;
-	}
 	addrw->state = cmd;
-	list_add_tail(&addrw->list, &net->sctp.addr_waitq);
+
+	spin_lock_bh(&net->sctp.addr_wq_lock);
+	list_add_tail_rcu(&addrw->list, &net->sctp.addr_waitq);
 
 	pr_debug("%s: add new entry for cmd:%d, addr:%pISc in wq:%p\n",
 		 __func__, addrw->state, &addrw->a.sa, &net->sctp.addr_waitq);