Merge http://linux-lksctp.bkbits.net/lksctp-2.5

into touki.austin.ibm.com:/home/jgrimm/bk/lksctp-2.5

include/net/sctp/constants.h

@@ -138,12 +138,10 @@ typedef enum {
  */
 
 typedef union {
-
 	sctp_cid_t chunk;
 	sctp_event_timeout_t timeout;
 	sctp_event_other_t other;
 	sctp_event_primitive_t primitive;
-
 } sctp_subtype_t;
 
 #define SCTP_SUBTYPE_CONSTRUCTOR(_name, _type, _elt) \
@@ -421,9 +419,9 @@ typedef enum {
 
 /* Reasons to retransmit. */
 typedef enum {
-	SCTP_RETRANSMIT_T3_RTX,
-	SCTP_RETRANSMIT_FAST_RTX,
-	SCTP_RETRANSMIT_PMTU_DISCOVERY,
+	SCTP_RTXR_T3_RTX,
+	SCTP_RTXR_FAST_RTX,
+	SCTP_RTXR_PMTUD,
 } sctp_retransmit_reason_t;
 
 /* Reasons to lower cwnd. */

include/net/sctp/sctp.h

@@ -130,7 +130,7 @@ extern struct sctp_pf *sctp_get_pf_specific(sa_family_t family);
 extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
 
 /*
- * sctp_socket.c
+ * sctp/socket.c
  */
 extern int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
 extern int sctp_inet_listen(struct socket *sock, int backlog);
@@ -139,7 +139,7 @@ extern unsigned int sctp_poll(struct file *file, struct socket *sock,
 		poll_table *wait);
 
 /*
- * sctp_primitive.c
+ * sctp/primitive.c
  */
 extern int sctp_primitive_ASSOCIATE(sctp_association_t *, void *arg);
 extern int sctp_primitive_SHUTDOWN(sctp_association_t *, void *arg);
@@ -148,14 +148,14 @@ extern int sctp_primitive_SEND(sctp_association_t *, void *arg);
 extern int sctp_primitive_REQUESTHEARTBEAT(sctp_association_t *, void *arg);
 
 /*
- * sctp_crc32c.c
+ * sctp/crc32c.c
  */
 extern __u32 sctp_start_cksum(__u8 *ptr, __u16 count);
 extern __u32 sctp_update_cksum(__u8 *ptr, __u16 count, __u32 cksum);
 extern __u32 sctp_end_cksum(__u32 cksum);
 
 /*
- * sctp_input.c
+ * sctp/input.c
  */
 extern int sctp_rcv(struct sk_buff *skb);
 extern void sctp_v4_err(struct sk_buff *skb, u32 info);
@@ -170,9 +170,16 @@ extern void __sctp_unhash_endpoint(sctp_endpoint_t *);
 extern sctp_association_t *__sctp_lookup_association(const union sctp_addr *,
 						     const union sctp_addr *,
 						     struct sctp_transport **);
-
+extern struct sock *sctp_err_lookup(int family, struct sk_buff *,
+				    struct sctphdr *, struct sctp_endpoint **, 
+				    struct sctp_association **, 
+				    struct sctp_transport **);
+extern void sctp_err_finish(struct sock *, struct sctp_endpoint *, 
+			    struct sctp_association *);
+extern void sctp_icmp_frag_needed(struct sock *, struct sctp_association *,
+				  struct sctp_transport *t, __u32 pmtu);
 /*
- * sctp_hashdriver.c
+ * sctp/hashdriver.c
  */
 extern void sctp_hash_digest(const char *secret, const int secret_len,
 			     const char *text, const int text_len,
@@ -184,9 +191,7 @@ extern void sctp_hash_digest(const char *secret, const int secret_len,
 
 
 #ifdef TEST_FRAME
-
 #include <test_frame.h>
-
 #else
 
 /* spin lock wrappers. */
@@ -194,28 +199,28 @@ extern void sctp_hash_digest(const char *secret, const int secret_len,
 #define sctp_spin_unlock_irqrestore(lock, flags)  \
        spin_unlock_irqrestore(lock, flags)
 #define sctp_local_bh_disable() local_bh_disable()
-#define sctp_local_bh_enable() local_bh_enable()
-#define sctp_spin_lock(lock) spin_lock(lock)
-#define sctp_spin_unlock(lock) spin_unlock(lock)
-#define sctp_write_lock(lock) write_lock(lock)
+#define sctp_local_bh_enable()  local_bh_enable()
+#define sctp_spin_lock(lock)    spin_lock(lock)
+#define sctp_spin_unlock(lock)  spin_unlock(lock)
+#define sctp_write_lock(lock)   write_lock(lock)
 #define sctp_write_unlock(lock) write_unlock(lock)
-#define sctp_read_lock(lock) read_lock(lock)
-#define sctp_read_unlock(lock) read_unlock(lock)
+#define sctp_read_lock(lock)    read_lock(lock)
+#define sctp_read_unlock(lock)  read_unlock(lock)
 
 /* sock lock wrappers. */
-#define sctp_lock_sock(sk) lock_sock(sk)
-#define sctp_release_sock(sk) release_sock(sk)
-#define sctp_bh_lock_sock(sk) bh_lock_sock(sk)
-#define sctp_bh_unlock_sock(sk) bh_unlock_sock(sk)
-#define SCTP_SOCK_SLEEP_PRE(sk) SOCK_SLEEP_PRE(sk)
+#define sctp_lock_sock(sk)       lock_sock(sk)
+#define sctp_release_sock(sk)    release_sock(sk)
+#define sctp_bh_lock_sock(sk)    bh_lock_sock(sk)
+#define sctp_bh_unlock_sock(sk)  bh_unlock_sock(sk)
+#define SCTP_SOCK_SLEEP_PRE(sk)  SOCK_SLEEP_PRE(sk)
 #define SCTP_SOCK_SLEEP_POST(sk) SOCK_SLEEP_POST(sk)
 
 /* SCTP SNMP MIB stats handlers */
 DECLARE_SNMP_STAT(struct sctp_mib, sctp_statistics);
-#define SCTP_INC_STATS(field)		SNMP_INC_STATS(sctp_statistics, field)
-#define SCTP_INC_STATS_BH(field)	SNMP_INC_STATS_BH(sctp_statistics, field)
-#define SCTP_INC_STATS_USER(field)	SNMP_INC_STATS_USER(sctp_statistics, field)
-#define SCTP_DEC_STATS(field)		SNMP_DEC_STATS(sctp_statistics, field)
+#define SCTP_INC_STATS(field)      SNMP_INC_STATS(sctp_statistics, field)
+#define SCTP_INC_STATS_BH(field)   SNMP_INC_STATS_BH(sctp_statistics, field)
+#define SCTP_INC_STATS_USER(field) SNMP_INC_STATS_USER(sctp_statistics, field)
+#define SCTP_DEC_STATS(field)      SNMP_DEC_STATS(sctp_statistics, field)
 
 /* Determine if this is a valid kernel address.  */
 static inline int sctp_is_valid_kaddr(unsigned long addr)
@@ -312,7 +317,6 @@ static inline void sctp_sysctl_register(void) { return; }
 static inline void sctp_sysctl_unregister(void) { return; }
 #endif
 
-
 /* Size of Supported Address Parameter for 'x' address types. */
 #define SCTP_SAT_LEN(x) (sizeof(struct sctp_paramhdr) + (x) * sizeof(__u16))
 
@@ -320,19 +324,15 @@ static inline void sctp_sysctl_unregister(void) { return; }
 
 extern int sctp_v6_init(void);
 extern void sctp_v6_exit(void);
-static inline int sctp_ipv6_addr_type(const struct in6_addr *addr)
-{
-	return ipv6_addr_type((struct in6_addr*) addr);
-}
+extern void sctp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+			int type, int code, int offset, __u32 info);
 
-#else /* #ifdef defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
+#else /* #ifdef defined(CONFIG_IPV6) */
 
-#define sctp_ipv6_addr_type(a) 0
 static inline int sctp_v6_init(void) { return 0; }
 static inline void sctp_v6_exit(void) { return; }
 
-#endif /* #ifdef defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */
-
+#endif /* #if defined(CONFIG_IPV6) */
 
 /* Map an association to an assoc_id. */
 static inline sctp_assoc_t sctp_assoc2id(const sctp_association_t *asoc)
@@ -356,7 +356,7 @@ for (pos = (head)->next;\
 static inline void sctp_skb_list_tail(struct sk_buff_head *list,
 				      struct sk_buff_head *head)
 {
-	int flags __attribute__ ((unused));
+	unsigned long flags;
 
 	sctp_spin_lock_irqsave(&head->lock, flags);
 	sctp_spin_lock(&list->lock);
@@ -488,21 +488,24 @@ static inline struct sctp_protocol *sctp_get_protocol(void)
 /* Convert from an IP version number to an Address Family symbol.  */
 static inline int ipver2af(__u8 ipver)
 {
-	int family;
-
 	switch (ipver) {
 	case 4:
-		family = AF_INET;
-		break;
+	        return  AF_INET;
 	case 6:
-		family = AF_INET6;
-		break;
+		return AF_INET6;
 	default:
-		family = 0;
-		break;
+		return 0;
 	};
+}
 
-	return family;
+/* Perform some sanity checks. */
+static inline int sctp_sanity_check(void)
+{
+	SCTP_ASSERT(sizeof(struct sctp_ulpevent) <= 
+		    sizeof(((struct sk_buff *)0)->cb),
+		    "SCTP: ulpevent does not fit in skb!\n", return 0);
+	
+	return 1;
 }
 
 /* Warning: The following hash functions assume a power of two 'size'. */
@@ -546,7 +549,7 @@ struct sctp_sock {
 	struct sock	  sk;
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 	struct ipv6_pinfo *pinet6;
-#endif /* CONFIG_IPV6 || CONFIG_IPV6_MODULE */
+#endif /* CONFIG_IPV6 */
 	struct inet_opt	  inet;
 	struct sctp_opt	  sctp;
 };
@@ -559,7 +562,7 @@ struct sctp6_sock {
 	struct sctp_opt	  sctp;
 	struct ipv6_pinfo inet6;
 };
-#endif /* CONFIG_IPV6 || CONFIG_IPV6_MODULE */
+#endif /* CONFIG_IPV6 */
 
 #define sctp_sk(__sk) (&((struct sctp_sock *)__sk)->sctp)
 

include/net/sctp/sm.h

@@ -197,15 +197,14 @@ sctp_state_fn_t sctp_addip_do_asconf;
 sctp_state_fn_t sctp_addip_do_asconf_ack;
 
 /* Prototypes for utility support functions.  */
-__u8 sctp_get_chunk_type(sctp_chunk_t *chunk);
+__u8 sctp_get_chunk_type(struct sctp_chunk *chunk);
 sctp_sm_table_entry_t *sctp_sm_lookup_event(sctp_event_t event_type,
 					    sctp_state_t state,
 					    sctp_subtype_t event_subtype);
-
-time_t timeval_sub(struct timeval *, struct timeval *);
-sctp_association_t *sctp_make_temp_asoc(const sctp_endpoint_t *,
-					sctp_chunk_t *,
-					const int priority);
+int sctp_chunk_iif(const struct sctp_chunk *);
+struct sctp_association *sctp_make_temp_asoc(const struct sctp_endpoint *,
+					     struct sctp_chunk *,
+					     int gfp);
 __u32 sctp_generate_verification_tag(void);
 void sctp_populate_tie_tags(__u8 *cookie, __u32 curTag, __u32 hisTag);
 
@@ -344,7 +343,7 @@ __u32 sctp_generate_tsn(const sctp_endpoint_t *);
 
 /* 4th level prototypes */
 void sctp_param2sockaddr(union sctp_addr *addr, sctp_addr_param_t *,
-			 __u16 port);
+			 __u16 port, int iif);
 int sctp_addr2sockaddr(const union sctp_params, union sctp_addr *);
 int sockaddr2sctp_addr(const union sctp_addr *, sctp_addr_param_t *);
 

include/net/sctp/ulpevent.h

@@ -38,7 +38,6 @@
  * be incorporated into the next SCTP release.
  */
 
-
 #ifndef __sctp_ulpevent_h__
 #define __sctp_ulpevent_h__
 
@@ -50,6 +49,7 @@ struct sctp_ulpevent {
 	struct sctp_association *asoc;
 	struct sctp_sndrcvinfo sndrcvinfo;
 	int msg_flags;
+	int iif;
 };
 
 /* Retrieve the skb this event sits inside of. */
@@ -61,9 +61,9 @@ static inline struct sk_buff *sctp_event2skb(struct sctp_ulpevent *ev)
 /* Retrieve & cast the event sitting inside the skb. */
 static inline struct sctp_ulpevent *sctp_skb2event(struct sk_buff *skb)
 {
-	return (struct sctp_ulpevent *)skb->cb; 
+	return (struct sctp_ulpevent *)skb->cb;
 }
-	
+
 struct sctp_ulpevent *sctp_ulpevent_new(int size, int flags, int priority);
 struct sctp_ulpevent *sctp_ulpevent_init(struct sctp_ulpevent *, int flags);
 void sctp_ulpevent_free(struct sctp_ulpevent *);

net/sctp/associola.c

@@ -290,14 +290,18 @@ sctp_association_t *sctp_association_init(sctp_association_t *asoc,
  */
 void sctp_association_free(sctp_association_t *asoc)
 {
+	struct sock *sk = asoc->base.sk;
 	struct sctp_transport *transport;
-	sctp_endpoint_t *ep;
 	struct list_head *pos, *temp;
 	int i;
 
-	ep = asoc->ep;
 	list_del(&asoc->asocs);
 
+	/* Decrement the backlog value for a TCP-style listening socket. */
+	if ((SCTP_SOCKET_TCP == sctp_sk(sk)->type) &&
+	    (SCTP_SS_LISTENING == sk->state))
+		sk->ack_backlog--;
+
 	/* Mark as dead, so other users can know this structure is
 	 * going away.
 	 */
@@ -641,8 +645,6 @@ __u32 sctp_association_get_tsn_block(sctp_association_t *asoc, int num)
 
 /* Compare two addresses to see if they match.  Wildcard addresses
  * only match themselves.
- *
- * FIXME: We do not match address scopes correctly.
  */
 int sctp_cmp_addr_exact(const union sctp_addr *ss1,
 			const union sctp_addr *ss2)
@@ -650,7 +652,7 @@ int sctp_cmp_addr_exact(const union sctp_addr *ss1,
 	struct sctp_af *af;
 
 	af = sctp_get_af_specific(ss1->sa.sa_family);
-	if (!af)
+	if (unlikely(!af))
 		return 0;
 
 	return af->cmp_addr(ss1, ss2);
@@ -664,14 +666,14 @@ sctp_chunk_t *sctp_get_ecne_prepend(struct sctp_association *asoc)
 {
 	struct sctp_chunk *chunk;
 
-	/* Send ECNE if needed. 
-	 * Not being able to allocate a chunk here is not deadly. 
+	/* Send ECNE if needed.
+	 * Not being able to allocate a chunk here is not deadly.
 	 */
 	if (asoc->need_ecne)
 		chunk = sctp_make_ecne(asoc, asoc->last_ecne_tsn);
 	else
 		chunk = NULL;
-	
+
 	return chunk;
 }
 
@@ -820,12 +822,17 @@ static void sctp_assoc_bh_rcv(sctp_association_t *asoc)
 void sctp_assoc_migrate(sctp_association_t *assoc, struct sock *newsk)
 {
 	struct sctp_opt *newsp = sctp_sk(newsk);
+	struct sock *oldsk = assoc->base.sk;
 
 	/* Delete the association from the old endpoint's list of
 	 * associations.
 	 */
 	list_del(&assoc->asocs);
 
+	/* Decrement the backlog value for a TCP-style socket. */
+	if (SCTP_SOCKET_TCP == sctp_sk(oldsk)->type)
+		oldsk->ack_backlog--;
+
 	/* Release references to the old endpoint and the sock.  */
 	sctp_endpoint_put(assoc->ep);
 	sock_put(assoc->base.sk);
@@ -988,9 +995,9 @@ static inline int sctp_peer_needs_update(struct sctp_association *asoc)
 	case SCTP_STATE_ESTABLISHED:
 	case SCTP_STATE_SHUTDOWN_PENDING:
 	case SCTP_STATE_SHUTDOWN_RECEIVED:
-		if ((asoc->rwnd > asoc->a_rwnd) && 
+		if ((asoc->rwnd > asoc->a_rwnd) &&
 		    ((asoc->rwnd - asoc->a_rwnd) >=
-		     min_t(__u32, (asoc->base.sk->rcvbuf >> 1), asoc->pmtu))) 
+		     min_t(__u32, (asoc->base.sk->rcvbuf >> 1), asoc->pmtu)))
 			return 1;
 		break;
 	default:
@@ -1057,14 +1064,14 @@ void sctp_assoc_rwnd_decrease(sctp_association_t *asoc, int len)
 		asoc->rwnd = 0;
 	}
 	SCTP_DEBUG_PRINTK("%s: asoc %p rwnd decreased by %d to (%u, %u)\n",
-			  __FUNCTION__, asoc, len, asoc->rwnd, 
+			  __FUNCTION__, asoc, len, asoc->rwnd,
 			  asoc->rwnd_over);
 }
 
 /* Build the bind address list for the association based on info from the
  * local endpoint and the remote peer.
  */
-int sctp_assoc_set_bind_addr_from_ep(sctp_association_t *asoc, int priority)
+int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc, int gfp)
 {
 	sctp_scope_t scope;
 	int flags;
@@ -1081,19 +1088,17 @@ int sctp_assoc_set_bind_addr_from_ep(sctp_association_t *asoc, int priority)
 
 	return sctp_bind_addr_copy(&asoc->base.bind_addr,
 				   &asoc->ep->base.bind_addr,
-				   scope, priority, flags);
+				   scope, gfp, flags);
 }
 
 /* Build the association's bind address list from the cookie.  */
 int sctp_assoc_set_bind_addr_from_cookie(sctp_association_t *asoc,
-					 sctp_cookie_t *cookie, int priority)
+					 sctp_cookie_t *cookie, int gfp)
 {
 	int var_size2 = ntohs(cookie->peer_init->chunk_hdr.length);
 	int var_size3 = cookie->raw_addr_list_len;
-	__u8 *raw_addr_list = (__u8 *)cookie + sizeof(sctp_cookie_t) +
-				      var_size2;
+	__u8 *raw = (__u8 *)cookie + sizeof(sctp_cookie_t) + var_size2;
 
-	return sctp_raw_to_bind_addrs(&asoc->base.bind_addr, raw_addr_list,
-				      var_size3, asoc->ep->base.bind_addr.port,
-				      priority);
+	return sctp_raw_to_bind_addrs(&asoc->base.bind_addr, raw, var_size3,
+				      asoc->ep->base.bind_addr.port, gfp);
 }

net/sctp/bind_addr.c

@@ -53,7 +53,7 @@
 
 /* Forward declarations for internal helpers. */
 static int sctp_copy_one_addr(sctp_bind_addr_t *, union sctp_addr *,
-			      sctp_scope_t scope, int priority, int flags);
+			      sctp_scope_t scope, int gfp, int flags);
 static void sctp_bind_addr_clean(sctp_bind_addr_t *);
 
 /* First Level Abstractions. */
@@ -62,7 +62,7 @@ static void sctp_bind_addr_clean(sctp_bind_addr_t *);
  * in 'src' which have a broader scope than 'scope'.
  */
 int sctp_bind_addr_copy(sctp_bind_addr_t *dest, const sctp_bind_addr_t *src,
-			sctp_scope_t scope, int priority, int flags)
+			sctp_scope_t scope, int gfp, int flags)
 {
 	struct sockaddr_storage_list *addr;
 	struct list_head *pos;
@@ -75,7 +75,7 @@ int sctp_bind_addr_copy(sctp_bind_addr_t *dest, const sctp_bind_addr_t *src,
 	list_for_each(pos, &src->address_list) {
 		addr = list_entry(pos, struct sockaddr_storage_list, list);
 		error = sctp_copy_one_addr(dest, &addr->a, scope,
-					   priority, flags);
+					   gfp, flags);
 		if (error < 0)
 			goto out;
 	}
@@ -88,11 +88,11 @@ int sctp_bind_addr_copy(sctp_bind_addr_t *dest, const sctp_bind_addr_t *src,
 }
 
 /* Create a new SCTP_bind_addr from nothing.  */
-sctp_bind_addr_t *sctp_bind_addr_new(int priority)
+sctp_bind_addr_t *sctp_bind_addr_new(int gfp)
 {
 	sctp_bind_addr_t *retval;
 
-	retval = t_new(sctp_bind_addr_t, priority);
+	retval = t_new(sctp_bind_addr_t, gfp);
 	if (!retval)
 		goto nomem;
 
@@ -144,12 +144,12 @@ void sctp_bind_addr_free(sctp_bind_addr_t *bp)
 
 /* Add an address to the bind address list in the SCTP_bind_addr structure. */
 int sctp_add_bind_addr(sctp_bind_addr_t *bp, union sctp_addr *new,
-		       int priority)
+		       int gfp)
 {
 	struct sockaddr_storage_list *addr;
 
 	/* Add the address to the bind address list.  */
-	addr = t_new(struct sockaddr_storage_list, priority);
+	addr = t_new(struct sockaddr_storage_list, gfp);
 	if (!addr)
 		return -ENOMEM;
 
@@ -197,7 +197,7 @@ int sctp_del_bind_addr(sctp_bind_addr_t *bp, union sctp_addr *del_addr)
  * The second argument is the return value for the length.
  */
 union sctp_params sctp_bind_addrs_to_raw(const sctp_bind_addr_t *bp,
-					 int *addrs_len, int priority)
+					 int *addrs_len, int gfp)
 {
 	union sctp_params addrparms;
 	union sctp_params retval;
@@ -214,7 +214,7 @@ union sctp_params sctp_bind_addrs_to_raw(const sctp_bind_addr_t *bp,
 		len += sizeof(sctp_addr_param_t);
 	}
 
-	retval.v = kmalloc(len, priority);
+	retval.v = kmalloc(len, gfp);
 	if (!retval.v)
 		goto end_raw;
 
@@ -238,7 +238,7 @@ union sctp_params sctp_bind_addrs_to_raw(const sctp_bind_addr_t *bp,
  * address parameters).
  */
 int sctp_raw_to_bind_addrs(sctp_bind_addr_t *bp, __u8 *raw_addr_list,
-			   int addrs_len, __u16 port, int priority)
+			   int addrs_len, __u16 port, int gfp)
 {
 	sctp_addr_param_t *rawaddr;
 	sctp_paramhdr_t *param;
@@ -254,8 +254,8 @@ int sctp_raw_to_bind_addrs(sctp_bind_addr_t *bp, __u8 *raw_addr_list,
 		switch (param->type) {
 		case SCTP_PARAM_IPV4_ADDRESS:
 		case SCTP_PARAM_IPV6_ADDRESS:
-			sctp_param2sockaddr(&addr, rawaddr, port);
-			retval = sctp_add_bind_addr(bp, &addr, priority);
+			sctp_param2sockaddr(&addr, rawaddr, port, 0);
+			retval = sctp_add_bind_addr(bp, &addr, gfp);
 			if (retval) {
 				/* Can't finish building the list, clean up. */
 				sctp_bind_addr_clean(bp);
@@ -300,14 +300,14 @@ int sctp_bind_addr_match(sctp_bind_addr_t *bp, const union sctp_addr *addr,
 
 /* Copy out addresses from the global local address list. */
 static int sctp_copy_one_addr(sctp_bind_addr_t *dest, union sctp_addr *addr,
-			      sctp_scope_t scope, int priority, int flags)
+			      sctp_scope_t scope, int gfp, int flags)
 {
 	struct sctp_protocol *proto = sctp_get_protocol();
 	int error = 0;
 
 	if (sctp_is_any(addr)) {
 		error = sctp_copy_local_addr_list(proto, dest, scope,
-						  priority, flags);
+						  gfp, flags);
 	} else if (sctp_in_scope(addr, scope)) {
 		/* Now that the address is in scope, check to see if
 		 * the address type is supported by local sock as
@@ -318,7 +318,7 @@ static int sctp_copy_one_addr(sctp_bind_addr_t *dest, union sctp_addr *addr,
 		    (((AF_INET6 == addr->sa.sa_family) &&
 		      (flags & SCTP_ADDR6_ALLOWED) &&
 		      (flags & SCTP_ADDR6_PEERSUPP))))
-			error = sctp_add_bind_addr(dest, addr, priority);
+			error = sctp_add_bind_addr(dest, addr, gfp);
 	}
 
 	return error;

net/sctp/endpointola.c

@@ -177,8 +177,15 @@ sctp_endpoint_t *sctp_endpoint_init(sctp_endpoint_t *ep,
 /* Add an association to an endpoint.  */
 void sctp_endpoint_add_asoc(sctp_endpoint_t *ep, sctp_association_t *asoc)
 {
+	struct sock *sk = ep->base.sk;
+
 	/* Now just add it to our list of asocs */
 	list_add_tail(&asoc->asocs, &ep->asocs);
+
+	/* Increment the backlog value for a TCP-style listening socket. */
+	if ((SCTP_SOCKET_TCP == sctp_sk(sk)->type) &&
+	    (SCTP_SS_LISTENING == sk->state))
+		sk->ack_backlog++;
 }
 
 /* Free the endpoint structure.  Delay cleanup until

net/sctp/input.c

@@ -207,21 +207,19 @@ int sctp_rcv(struct sk_buff *skb)
 	 */
 	sctp_bh_lock_sock(sk);
 
-	if (sock_owned_by_user(sk)) {
+	if (sock_owned_by_user(sk))
 		sk_add_backlog(sk, (struct sk_buff *) chunk);
-	} else {
+	else
 		sctp_backlog_rcv(sk, (struct sk_buff *) chunk);
-	}
 
 	/* Release the sock and any reference counts we took in the
 	 * lookup calls.
 	 */
 	sctp_bh_unlock_sock(sk);
-	if (asoc) {
+	if (asoc)
 		sctp_association_put(asoc);
-	} else {
+	else
 		sctp_endpoint_put(ep);
-	}
 	sock_put(sk);
 	return ret;
 
@@ -268,10 +266,8 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 }
 
 /* Handle icmp frag needed error. */
-static inline void sctp_icmp_frag_needed(struct sock *sk,
-					 sctp_association_t *asoc,
-					 struct sctp_transport *transport,
-					 __u32 pmtu)
+void sctp_icmp_frag_needed(struct sock *sk, struct sctp_association *asoc,
+			   struct sctp_transport *t, __u32 pmtu)
 {
 	if (unlikely(pmtu < SCTP_DEFAULT_MINSEGMENT)) {
 		printk(KERN_WARNING "%s: Reported pmtu %d too low, "
@@ -280,54 +276,38 @@ static inline void sctp_icmp_frag_needed(struct sock *sk,
 		pmtu = SCTP_DEFAULT_MINSEGMENT;
 	}
 
-	if (!sock_owned_by_user(sk) && transport && (transport->pmtu != pmtu)) {
-		transport->pmtu = pmtu;
+	if (!sock_owned_by_user(sk) && t && (t->pmtu != pmtu)) {
+		t->pmtu = pmtu;
 		sctp_assoc_sync_pmtu(asoc);
-		sctp_retransmit(&asoc->outqueue, transport,
-				SCTP_RETRANSMIT_PMTU_DISCOVERY );
+		sctp_retransmit(&asoc->outqueue, t, SCTP_RTXR_PMTUD);
 	}
 }
 
-/*
- * This routine is called by the ICMP module when it gets some
- * sort of error condition.  If err < 0 then the socket should
- * be closed and the error returned to the user.  If err > 0
- * it's just the icmp type << 8 | icmp code.  After adjustment
- * header points to the first 8 bytes of the sctp header.  We need
- * to find the appropriate port.
- *
- * The locking strategy used here is very "optimistic". When
- * someone else accesses the socket the ICMP is just dropped
- * and for some paths there is no check at all.
- * A more general error queue to queue errors for later handling
- * is probably better.
- *
- */
-void sctp_v4_err(struct sk_buff *skb, __u32 info)
+/* Common lookup code for icmp/icmpv6 error handler. */
+struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
+			     struct sctphdr *sctphdr,
+			     struct sctp_endpoint **epp, 
+			     struct sctp_association **app, 
+			     struct sctp_transport **tpp)
 {
-	struct iphdr *iph = (struct iphdr *)skb->data;
-	struct sctphdr *sh = (struct sctphdr *)(skb->data + (iph->ihl <<2));
-	int type = skb->h.icmph->type;
-	int code = skb->h.icmph->code;
-	union sctp_addr saddr, daddr;
-	struct inet_opt *inet;
+	union sctp_addr saddr;
+	union sctp_addr daddr;
+	struct sctp_af *af;
 	struct sock *sk = NULL;
-	sctp_endpoint_t *ep = NULL;
-	sctp_association_t *asoc = NULL;
-	struct sctp_transport *transport;
-	int err;
+	struct sctp_endpoint *ep = NULL;
+	struct sctp_association *asoc = NULL;
+	struct sctp_transport *transport = NULL;
 
-	if (skb->len < ((iph->ihl << 2) + 8)) {
-		ICMP_INC_STATS_BH(IcmpInErrors);
-		return;
+	*app = NULL; *epp = NULL; *tpp = NULL;
+
+	af = sctp_get_af_specific(family);
+	if (unlikely(!af)) {
+		return NULL;
 	}
 
-	saddr.v4.sin_family = AF_INET;
-	saddr.v4.sin_port = ntohs(sh->source);
-	memcpy(&saddr.v4.sin_addr.s_addr, &iph->saddr, sizeof(struct in_addr));	
-	daddr.v4.sin_family = AF_INET;
-	daddr.v4.sin_port = ntohs(sh->dest);
-	memcpy(&daddr.v4.sin_addr.s_addr, &iph->daddr, sizeof(struct in_addr));	
+	/* Initialize local addresses for lookups. */
+	af->from_skb(&saddr, skb, 1);
+	af->from_skb(&daddr, skb, 0);
 
 	/* Look for an association that matches the incoming ICMP error 
 	 * packet.
@@ -340,13 +320,12 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
 		 */ 
 		ep = __sctp_rcv_lookup_endpoint(&daddr);
 		if (!ep) {
-			ICMP_INC_STATS_BH(IcmpInErrors);
-			return;
+			return NULL;
 		}
 	}
 
 	if (asoc) {
-		if (ntohl(sh->vtag) != asoc->c.peer_vtag) {
+		if (ntohl(sctphdr->vtag) != asoc->c.peer_vtag) {
 			ICMP_INC_STATS_BH(IcmpInErrors);
 			goto out;
 		}
@@ -355,12 +334,90 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
 		sk = ep->base.sk;
 
 	sctp_bh_lock_sock(sk);
+
 	/* If too many ICMPs get dropped on busy
 	 * servers this needs to be solved differently.
 	 */
 	if (sock_owned_by_user(sk))
 		NET_INC_STATS_BH(LockDroppedIcmps);
 
+	*epp = ep;
+	*app = asoc;
+	*tpp = transport;
+	return sk;
+	
+out:
+	sock_put(sk);
+	if (asoc)
+		sctp_association_put(asoc);
+	if (ep)	
+		sctp_endpoint_put(ep);
+	return NULL;
+}
+
+/* Common cleanup code for icmp/icmpv6 error handler. */
+void sctp_err_finish(struct sock *sk, struct sctp_endpoint *ep, 
+		     struct sctp_association *asoc)
+{
+	sctp_bh_unlock_sock(sk);
+	sock_put(sk);
+	if (asoc)
+		sctp_association_put(asoc);
+	if (ep)	
+		sctp_endpoint_put(ep);
+}
+
+/*
+ * This routine is called by the ICMP module when it gets some
+ * sort of error condition.  If err < 0 then the socket should
+ * be closed and the error returned to the user.  If err > 0
+ * it's just the icmp type << 8 | icmp code.  After adjustment
+ * header points to the first 8 bytes of the sctp header.  We need
+ * to find the appropriate port.
+ *
+ * The locking strategy used here is very "optimistic". When
+ * someone else accesses the socket the ICMP is just dropped
+ * and for some paths there is no check at all.
+ * A more general error queue to queue errors for later handling
+ * is probably better.
+ *
+ */
+void sctp_v4_err(struct sk_buff *skb, __u32 info)
+{
+	struct iphdr *iph = (struct iphdr *)skb->data;
+	struct sctphdr *sh = (struct sctphdr *)(skb->data + (iph->ihl <<2));
+	int type = skb->h.icmph->type;
+	int code = skb->h.icmph->code;
+	struct sock *sk;
+	sctp_endpoint_t *ep;
+	sctp_association_t *asoc;
+	struct sctp_transport *transport;
+	struct inet_opt *inet;
+	char *saveip, *savesctp;
+	int err;
+
+	if (skb->len < ((iph->ihl << 2) + 8)) {
+		ICMP_INC_STATS_BH(IcmpInErrors);
+		return;
+	}
+
+	/* Fix up skb to look at the embedded net header. */
+	saveip = skb->nh.raw;
+	savesctp  = skb->h.raw;
+	skb->nh.iph = iph;
+	skb->h.raw = (char *)sh;
+	sk = sctp_err_lookup(AF_INET, skb, sh, &ep, &asoc, &transport);
+	/* Put back, the original pointers. */
+	skb->nh.raw = saveip;
+	skb->h.raw = savesctp;
+	if (!sk) {
+		ICMP_INC_STATS_BH(IcmpInErrors);
+		return;
+	}
+	/* Warning:  The sock lock is held.  Remember to call 
+	 * sctp_err_finish!
+	 */
+
 	switch (type) {
 	case ICMP_PARAMETERPROB:
 		err = EPROTO;
@@ -399,13 +456,7 @@ void sctp_v4_err(struct sk_buff *skb, __u32 info)
 	}
 
 out_unlock:
-	sctp_bh_unlock_sock(sk);
-out:
-	sock_put(sk);
-	if (asoc)
-		sctp_association_put(asoc);
-	if (ep)	
-		sctp_endpoint_put(ep);
+	sctp_err_finish(sk, ep, asoc);
 }
 
 /*
@@ -623,9 +674,9 @@ void __sctp_unhash_established(sctp_association_t *asoc)
 }
 
 /* Look up an association. */
-sctp_association_t *__sctp_lookup_association(const union sctp_addr *laddr,
-					      const union sctp_addr *paddr,
-					      struct sctp_transport **transportp)
+sctp_association_t *__sctp_lookup_association(const union sctp_addr *local,
+					      const union sctp_addr *peer,
+					      struct sctp_transport **pt)
 {
 	sctp_hashbucket_t *head;
 	sctp_endpoint_common_t *epb;
@@ -636,12 +687,12 @@ sctp_association_t *__sctp_lookup_association(const union sctp_addr *laddr,
 	/* Optimize here for direct hit, only listening connections can
 	 * have wildcards anyways.
 	 */
-	hash = sctp_assoc_hashfn(laddr->v4.sin_port, paddr->v4.sin_port);
+	hash = sctp_assoc_hashfn(local->v4.sin_port, peer->v4.sin_port);
 	head = &sctp_proto.assoc_hashbucket[hash];
 	read_lock(&head->lock);
 	for (epb = head->chain; epb; epb = epb->next) {
 		asoc = sctp_assoc(epb);
-		transport = sctp_assoc_is_match(asoc, laddr, paddr);
+		transport = sctp_assoc_is_match(asoc, local, peer);
 		if (transport)
 			goto hit;
 	}
@@ -651,7 +702,7 @@ sctp_association_t *__sctp_lookup_association(const union sctp_addr *laddr,
 	return NULL;
 
 hit:
-	*transportp = transport;
+	*pt = transport;
 	sctp_association_hold(asoc);
 	sock_hold(epb->sk);
 	read_unlock(&head->lock);
@@ -754,7 +805,7 @@ static sctp_association_t *__sctp_rcv_init_lookup(struct sk_buff *skb,
 		    (SCTP_PARAM_IPV6_ADDRESS != params.p->type))
 			continue;
 
-		sctp_param2sockaddr(paddr, params.addr, ntohs(sh->source));
+		sctp_param2sockaddr(paddr, params.addr, ntohs(sh->source), 0);
 		asoc = __sctp_lookup_association(laddr, paddr, transportp);
 		if (asoc)
 			return asoc;
@@ -782,8 +833,3 @@ sctp_association_t *__sctp_rcv_lookup(struct sk_buff *skb,
 
 	return asoc;
 }
-
-
-
-
-

net/sctp/output.c

@@ -196,11 +196,13 @@ sctp_xmit_t sctp_packet_append_chunk(struct sctp_packet *packet,
 {
 	sctp_xmit_t retval = SCTP_XMIT_OK;
 	__u16 chunk_len = WORD_ROUND(ntohs(chunk->chunk_hdr->length));
-	size_t psize = packet->size;
+	size_t psize;
 	size_t pmtu;
 	int too_big;
 
 	retval = sctp_packet_bundle_sack(packet, chunk);
+	psize = packet->size;
+
 	if (retval != SCTP_XMIT_OK)
 		goto finish;
 		
@@ -251,6 +253,8 @@ sctp_xmit_t sctp_packet_append_chunk(struct sctp_packet *packet,
 	 */
 	if (sctp_chunk_is_data(chunk)) {
 		retval = sctp_packet_append_data(packet, chunk);
+		/* Disallow SACK bundling after DATA. */
+		packet->has_sack = 1;
 		if (SCTP_XMIT_OK != retval)
 			goto finish;
 	} else if (SCTP_CID_COOKIE_ECHO == chunk->chunk_hdr->type)

net/sctp/outqueue.c

@@ -138,13 +138,13 @@ void sctp_outq_init(sctp_association_t *asoc, struct sctp_outq *q)
 }
 
 /* Free the outqueue structure and any related pending chunks.
- * FIXME: Add SEND_FAILED support.
  */
 void sctp_outq_teardown(struct sctp_outq *q)
 {
 	struct sctp_transport *transport;
 	struct list_head *lchunk, *pos, *temp;
 	sctp_chunk_t *chunk;
+	struct sctp_ulpevent *ev;
 
 	/* Throw away unacknowledged chunks. */
 	list_for_each(pos, &q->asoc->peer.transport_addr_list) {
@@ -152,6 +152,14 @@ void sctp_outq_teardown(struct sctp_outq *q)
 		while ((lchunk = sctp_list_dequeue(&transport->transmitted))) {
 			chunk = list_entry(lchunk, sctp_chunk_t,
 					   transmitted_list);
+
+			/* Generate a SEND FAILED event. */
+			ev = sctp_ulpevent_make_send_failed(q->asoc,
+					chunk, SCTP_DATA_SENT,
+					q->error, GFP_ATOMIC);
+			if (ev)
+				sctp_ulpq_tail_event(&q->asoc->ulpq, ev);
+
 			sctp_free_chunk(chunk);
 		}
 	}
@@ -171,8 +179,19 @@ void sctp_outq_teardown(struct sctp_outq *q)
 	}
 
 	/* Throw away any leftover data chunks. */
-	while ((chunk = sctp_outq_dequeue_data(q)))
+	while ((chunk = sctp_outq_dequeue_data(q))) {
+
+		/* Generate a SEND FAILED event. */
+		ev = sctp_ulpevent_make_send_failed(q->asoc,
+				chunk, SCTP_DATA_UNSENT,
+				q->error, GFP_ATOMIC);
+		if (ev)
+			sctp_ulpq_tail_event(&q->asoc->ulpq, ev);
+
 		sctp_free_chunk(chunk);
+	}
+
+	q->error = 0;
 
 	/* Throw away any leftover control chunks. */
 	while ((chunk = (sctp_chunk_t *) skb_dequeue(&q->control)))
@@ -357,7 +376,7 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
 	__u8 fast_retransmit = 0;
 
 	switch(reason) {
-	case SCTP_RETRANSMIT_T3_RTX:
+	case SCTP_RTXR_T3_RTX:
 		sctp_transport_lower_cwnd(transport, SCTP_LOWER_CWND_T3_RTX);
 		/* Update the retran path if the T3-rtx timer has expired for
 		 * the current retran path.
@@ -365,10 +384,11 @@ void sctp_retransmit(struct sctp_outq *q, struct sctp_transport *transport,
 		if (transport == transport->asoc->peer.retran_path)
 			sctp_assoc_update_retran_path(transport->asoc);
 		break;
-	case SCTP_RETRANSMIT_FAST_RTX:
+	case SCTP_RTXR_FAST_RTX:
 		sctp_transport_lower_cwnd(transport, SCTP_LOWER_CWND_FAST_RTX);
 		fast_retransmit = 1;
 		break;
+	case SCTP_RTXR_PMTUD:
 	default:
 		break;
 	}
@@ -876,7 +896,7 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
 		start_timer = 0;
 		queue = &q->out;
 
-		while (chunk = sctp_outq_dequeue_data(q)) {
+		while ((chunk = sctp_outq_dequeue_data(q))) {
 			/* RFC 2960 6.5 Every DATA chunk MUST carry a valid
 			 * stream identifier.
 			 */
@@ -1570,7 +1590,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
 
 	if (transport) {
 		if (do_fast_retransmit)
-			sctp_retransmit(q, transport, SCTP_RETRANSMIT_FAST_RTX);
+			sctp_retransmit(q, transport, SCTP_RTXR_FAST_RTX);
 
 		SCTP_DEBUG_PRINTK("%s: transport: %p, cwnd: %d, "
 				  "ssthresh: %d, flight_size: %d, pba: %d\n",

net/sctp/protocol.c

@@ -170,7 +170,7 @@ static void __sctp_get_local_addr_list(struct sctp_protocol *proto)
 
 static void sctp_get_local_addr_list(struct sctp_protocol *proto)
 {
-	long flags __attribute__ ((unused));
+	unsigned long flags;
 
 	sctp_spin_lock_irqsave(&sctp_proto.local_addr_lock, flags);
 	__sctp_get_local_addr_list(&sctp_proto);
@@ -193,7 +193,7 @@ static void __sctp_free_local_addr_list(struct sctp_protocol *proto)
 /* Free the existing local addresses.  */
 static void sctp_free_local_addr_list(struct sctp_protocol *proto)
 {
-	long flags __attribute__ ((unused));
+	unsigned long flags;
 
 	sctp_spin_lock_irqsave(&proto->local_addr_lock, flags);
 	__sctp_free_local_addr_list(proto);
@@ -208,7 +208,7 @@ int sctp_copy_local_addr_list(struct sctp_protocol *proto,
 	struct sockaddr_storage_list *addr;
 	int error = 0;
 	struct list_head *pos;
-	long flags __attribute__ ((unused));
+	unsigned long flags;
 
 	sctp_spin_lock_irqsave(&proto->local_addr_lock, flags);
 	list_for_each(pos, &proto->local_addr_list) {
@@ -233,7 +233,6 @@ int sctp_copy_local_addr_list(struct sctp_protocol *proto,
 
 end_copy:
 	sctp_spin_unlock_irqrestore(&proto->local_addr_lock, flags);
-
 	return error;
 }
 
@@ -383,7 +382,7 @@ static sctp_scope_t sctp_v4_scope(union sctp_addr *addr)
  * addresses. If an association is passed, trys to get a dst entry with a
  * source adddress that matches an address in the bind address list.
  */
-struct dst_entry *sctp_v4_get_dst(sctp_association_t *asoc,
+struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
 				  union sctp_addr *daddr,
 				  union sctp_addr *saddr)
 {
@@ -480,6 +479,12 @@ void sctp_v4_get_saddr(sctp_association_t *asoc,
 
 }
 
+/* What interface did this skb arrive on? */
+int sctp_v4_skb_iif(const struct sk_buff *skb) 
+{
+     	return ((struct rtable *)skb->dst)->rt_iif;  
+}
+
 /* Create and initialize a new sk for the socket returned by accept(). */ 
 struct sock *sctp_v4_create_accept_sk(struct sock *sk,
 				      struct sctp_association *asoc)
@@ -538,10 +543,10 @@ struct sock *sctp_v4_create_accept_sk(struct sock *sk,
 /* Event handler for inet address addition/deletion events.
  * Basically, whenever there is an event, we re-build our local address list.
  */
-static int sctp_inetaddr_event(struct notifier_block *this, unsigned long event,
+static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
 			       void *ptr)
 {
-	long flags __attribute__ ((unused));
+	unsigned long flags;
 
 	sctp_spin_lock_irqsave(&sctp_proto.local_addr_lock, flags);
 	__sctp_free_local_addr_list(&sctp_proto);
@@ -689,6 +694,14 @@ static int sctp_inet_bind_verify(struct sctp_opt *opt, union sctp_addr *addr)
 	return sctp_v4_available(addr);
 }
 
+/* Verify that sockaddr looks sendable.  Common verification has already 
+ * been taken care of.
+ */
+static int sctp_inet_send_verify(struct sctp_opt *opt, union sctp_addr *addr)
+{
+	return 1;
+}
+
 /* Fill in Supported Address Type information for INIT and INIT-ACK
  * chunks.  Returns number of addresses supported.
  */
@@ -721,6 +734,7 @@ static struct sctp_pf sctp_pf_inet = {
 	.af_supported  = sctp_inet_af_supported,
 	.cmp_addr      = sctp_inet_cmp_addr,
 	.bind_verify   = sctp_inet_bind_verify,
+	.send_verify   = sctp_inet_send_verify,
 	.supported_addrs = sctp_inet_supported_addrs,
 	.create_accept_sk = sctp_v4_create_accept_sk,
 	.af            = &sctp_ipv4_specific,
@@ -796,6 +810,7 @@ struct sctp_af sctp_ipv4_specific = {
 	.is_any         = sctp_v4_is_any,
 	.available      = sctp_v4_available,
 	.scope          = sctp_v4_scope,
+	.skb_iif        = sctp_v4_skb_iif,
 	.net_header_len = sizeof(struct iphdr),
 	.sockaddr_len   = sizeof(struct sockaddr_in),
 	.sa_family      = AF_INET,
@@ -873,6 +888,10 @@ __init int sctp_init(void)
 	int i;
 	int status = 0;
 
+	/* SCTP_DEBUG sanity check. */
+	if (!sctp_sanity_check())
+		return -EINVAL;
+
 	/* Add SCTP to inet_protos hash table.  */
 	if (inet_add_protocol(&sctp_protocol, IPPROTO_SCTP) < 0)
 		return -EAGAIN;

net/sctp/sm_statefuns.c

@@ -191,14 +191,9 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const sctp_endpoint_t *ep,
 	sctp_chunk_t *err_chunk;
 	struct sctp_packet *packet;
 	sctp_unrecognized_param_t *unk_param;
+	struct sock *sk;
 	int len;
 
-	/* If the packet is an OOTB packet which is temporarily on the
-	 * control endpoint, respond with an ABORT.
-	 */
-	if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
-		return sctp_sf_ootb(ep, asoc, type, arg, commands);
-
 	/* 6.10 Bundling
 	 * An endpoint MUST NOT bundle INIT, INIT ACK or
 	 * SHUTDOWN COMPLETE with any other chunks.
@@ -206,6 +201,22 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const sctp_endpoint_t *ep,
 	if (!chunk->singleton)
 		return SCTP_DISPOSITION_VIOLATION;
 
+	/* If the packet is an OOTB packet which is temporarily on the
+	 * control endpoint, respond with an ABORT.
+	 */
+	if (ep == sctp_sk((sctp_get_ctl_sock()))->ep)
+		return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+
+	sk = ep->base.sk;
+	/* If the endpoint is not listening or if the number of associations
+	 * on the TCP-style socket exceed the max backlog, respond with an
+	 * ABORT.
+	 */
+	if ((SCTP_SS_LISTENING != sk->state) ||
+	    ((SCTP_SOCKET_TCP == sctp_sk(sk)->type) &&
+	     (sk->ack_backlog >= sk->max_ack_backlog)))
+		return sctp_sf_tabort_8_4_8(ep, asoc, type, arg, commands);
+
 	/* Verify the INIT chunk before processing it. */
 	err_chunk = NULL;
 	if (!sctp_verify_init(asoc, chunk->chunk_hdr->type,
@@ -249,8 +260,8 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const sctp_endpoint_t *ep,
 
 	/* The call, sctp_process_init(), can fail on memory allocation.  */
 	if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
-			       sctp_source(chunk),
-			       (sctp_init_chunk_t *)chunk->chunk_hdr,
+			       sctp_source(chunk), 
+			       (sctp_init_chunk_t *)chunk->chunk_hdr, 
 			       GFP_ATOMIC))
 		goto nomem_init;
 
@@ -729,7 +740,8 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const sctp_endpoint_t *ep,
 
 	if (asoc->overall_error_count >= asoc->overall_error_threshold) {
 		/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
-		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 
+				SCTP_U32(SCTP_ERROR_NO_ERROR));
 		SCTP_INC_STATS(SctpAborteds);
 		SCTP_DEC_STATS(SctpCurrEstab);
 		return SCTP_DISPOSITION_DELETE_TCB;
@@ -1379,7 +1391,8 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(const sctp_endpoint_t *ep,
 	peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
 
 	if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
-			       sctp_source(chunk), peer_init, GFP_ATOMIC))
+			       sctp_source(chunk), peer_init, 
+			       GFP_ATOMIC))
 		goto nomem;
 
 	/* Make sure no new addresses are being added during the
@@ -1444,7 +1457,8 @@ static sctp_disposition_t sctp_sf_do_dupcook_b(const sctp_endpoint_t *ep,
 	 */
 	peer_init = &chunk->subh.cookie_hdr->c.peer_init[0];
 	if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
-			       sctp_source(chunk), peer_init, GFP_ATOMIC))
+			       sctp_source(chunk), peer_init, 
+			       GFP_ATOMIC))
 		goto nomem;
 
 	/* Update the content of current association.  */
@@ -1772,14 +1786,16 @@ sctp_disposition_t sctp_sf_cookie_echoed_err(const sctp_endpoint_t *ep,
 	sctp_chunk_t *chunk = arg;
 	sctp_errhdr_t *err;
 
+	err = (sctp_errhdr_t *)(chunk->skb->data);
+
 	/* If we have gotten too many failures, give up.  */
 	if (1 + asoc->counters[SCTP_COUNTER_INIT_ERROR] >
 					 asoc->max_init_attempts) {
 		/* INIT_FAILED will issue an ulpevent.  */
-		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 
+				SCTP_U32(err->cause));
 		return SCTP_DISPOSITION_DELETE_TCB;
 	}
-	err = (sctp_errhdr_t *)(chunk->skb->data);
 
 	/* Process the error here */
 	switch (err->cause) {
@@ -1834,7 +1850,8 @@ sctp_disposition_t sctp_sf_do_5_2_6_stale(const sctp_endpoint_t *ep,
 	attempts = asoc->counters[SCTP_COUNTER_INIT_ERROR] + 1;
 
 	if (attempts >= asoc->max_init_attempts) {
-		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 
+				SCTP_U32(SCTP_ERROR_STALE_COOKIE));
 		return SCTP_DISPOSITION_DELETE_TCB;
 	}
 
@@ -1936,12 +1953,18 @@ sctp_disposition_t sctp_sf_do_9_1_abort(const sctp_endpoint_t *ep,
 					sctp_cmd_seq_t *commands)
 {
 	sctp_chunk_t *chunk = arg;
+	__u16 error = SCTP_ERROR_NO_ERROR;
 
 	if (!sctp_vtag_verify_either(chunk, asoc))
 		return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
 
+	if (chunk && (ntohs(chunk->chunk_hdr->length) >=
+			(sizeof(struct sctp_chunkhdr) + 
+			sizeof(struct sctp_errhdr))))
+		error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
+
  	/* ASSOC_FAILED will DELETE_TCB. */
-	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_U32(error));
 	SCTP_INC_STATS(SctpAborteds);
 	SCTP_DEC_STATS(SctpCurrEstab);
 
@@ -1961,6 +1984,7 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const sctp_endpoint_t *ep,
 					     sctp_cmd_seq_t *commands)
 {
 	sctp_chunk_t *chunk = arg;
+	__u16 error = SCTP_ERROR_NO_ERROR;
 
 	if (!sctp_vtag_verify_either(chunk, asoc))
 		return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -1971,10 +1995,14 @@ sctp_disposition_t sctp_sf_cookie_wait_abort(const sctp_endpoint_t *ep,
 	sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
 			SCTP_TO(SCTP_EVENT_TIMEOUT_T1_INIT));
 
+	if (chunk && (ntohs(chunk->chunk_hdr->length) >=
+			(sizeof(struct sctp_chunkhdr) + 
+			sizeof(struct sctp_errhdr))))
+		error = ((sctp_errhdr_t *)chunk->skb->data)->cause;
+
 	/* CMD_INIT_FAILED will DELETE_TCB. */
-	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, SCTP_NULL());
+	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, SCTP_U32(error));
 
-	/* BUG?  This does not look complete... */
 	return SCTP_DISPOSITION_ABORT;
 }
 
@@ -2381,7 +2409,8 @@ sctp_disposition_t sctp_sf_eat_data_6_2(const sctp_endpoint_t *ep,
 		 * processing the rest of the chunks in the packet.
 		 */
 		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
-		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 
+				SCTP_U32(SCTP_ERROR_NO_DATA));
 		SCTP_INC_STATS(SctpAborteds);
 		SCTP_DEC_STATS(SctpCurrEstab);
 		return SCTP_DISPOSITION_CONSUME;
@@ -2596,7 +2625,8 @@ sctp_disposition_t sctp_sf_eat_data_fast_4_4(const sctp_endpoint_t *ep,
 		 * processing the rest of the chunks in the packet.
 		 */
 		sctp_add_cmd_sf(commands, SCTP_CMD_DISCARD_PACKET,SCTP_NULL());
-		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 
+				SCTP_U32(SCTP_ERROR_NO_DATA));
 		SCTP_INC_STATS(SctpAborteds);
 		SCTP_DEC_STATS(SctpCurrEstab);
 		return SCTP_DISPOSITION_CONSUME;
@@ -3547,7 +3577,8 @@ sctp_disposition_t sctp_sf_do_9_1_prm_abort(const sctp_endpoint_t *ep,
 	 */
 
 	/* Delete the established association. */
-	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 
+			SCTP_U32(SCTP_ERROR_USER_ABORT));
 
 	SCTP_INC_STATS(SctpAborteds);
 	SCTP_DEC_STATS(SctpCurrEstab);
@@ -3686,7 +3717,8 @@ sctp_disposition_t sctp_sf_cookie_wait_prm_abort(const sctp_endpoint_t *ep,
 	 */
 
 	/* Delete the established association. */
-	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, SCTP_NULL());
+	sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 
+			SCTP_U32(SCTP_ERROR_USER_ABORT));
 
 	return retval;
 }
@@ -4012,7 +4044,8 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const sctp_endpoint_t *ep,
 
 	if (asoc->overall_error_count >= asoc->overall_error_threshold) {
 		/* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
-		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 
+				SCTP_U32(SCTP_ERROR_NO_ERROR));
 		SCTP_INC_STATS(SctpAborteds);
 		SCTP_DEC_STATS(SctpCurrEstab);
 		return SCTP_DISPOSITION_DELETE_TCB;
@@ -4147,7 +4180,8 @@ sctp_disposition_t sctp_sf_t1_timer_expire(const sctp_endpoint_t *ep,
 				SCTP_TO(timer));
 		sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
 	} else {
-		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED, 
+				SCTP_U32(SCTP_ERROR_NO_ERROR));
 		return SCTP_DISPOSITION_DELETE_TCB;
 	}
 
@@ -4181,7 +4215,8 @@ sctp_disposition_t sctp_sf_t2_timer_expire(const sctp_endpoint_t *ep,
 	SCTP_DEBUG_PRINTK("Timer T2 expired.\n");
 	if (asoc->overall_error_count >= asoc->overall_error_threshold) {
 		/* Note:  CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
-		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+		sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 
+				SCTP_U32(SCTP_ERROR_NO_ERROR));
 		SCTP_INC_STATS(SctpAborteds);
 		SCTP_DEC_STATS(SctpCurrEstab);
 		return SCTP_DISPOSITION_DELETE_TCB;
@@ -4244,7 +4279,8 @@ sctp_disposition_t sctp_sf_t5_timer_expire(const sctp_endpoint_t *ep,
 		goto nomem;
 
 	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(reply));
-	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, SCTP_NULL());
+	sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED, 
+			SCTP_U32(SCTP_ERROR_NO_ERROR));
 
 	return SCTP_DISPOSITION_DELETE_TCB;
 nomem:

net/sctp/socket.c

@@ -244,9 +244,6 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 	if (!snum)
 		snum = inet_sk(sk)->num;
 
-
-
-
 	/* Add the address to the bind address list.  */
 	sctp_local_bh_disable();
 	sctp_write_lock(&ep->base.addr_lock);
@@ -257,7 +254,6 @@ SCTP_STATIC int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)
 	addr->v4.sin_port = htons(addr->v4.sin_port);
 	if (!ret && !bp->port)
 		bp->port = snum;
-
 	sctp_write_unlock(&ep->base.addr_lock);
 	sctp_local_bh_enable();
 
@@ -2750,6 +2746,9 @@ int sctp_inet_listen(struct socket *sock, int backlog)
 	err = -EINVAL;
 	if (sock->state != SS_UNCONNECTED)
 		goto out;
+	if (unlikely(backlog < 0))
+		goto out;
+
 	switch (sock->type) {
 	case SOCK_SEQPACKET:
 		err = sctp_seqpacket_listen(sk, backlog);
@@ -3152,7 +3151,10 @@ static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
 		return -EINVAL;
 
 	/* Is this a valid SCTP address?  */
-	if (!af->addr_valid((union sctp_addr *)addr))
+	if (!af->addr_valid(addr))
+		return -EINVAL;
+
+	if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
 		return -EINVAL;
 
 	return 0;

net/sctp/ulpevent.c

@@ -628,6 +628,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(sctp_association_t *asoc,
 	if (!event)
 		goto fail_init;
 
+	event->iif = sctp_chunk_iif(chunk);
 	/* Note:  Not clearing the entire event struct as
 	 * this is just a fragment of the real event.  However,
 	 * we still need to do rwnd accounting.