1 files changed, 20 insertions, 20 deletions

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6a54ff06c9da..7ff444ecee75 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -85,7 +85,7 @@
 static int sctp_writeable(struct sock *sk);
 static void sctp_wfree(struct sk_buff *skb);
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
-                                size_t msg_len, struct sock **orig_sk);
+                                size_t msg_len);
 static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
 static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
 static int sctp_wait_for_accept(struct sock *sk, long timeo);
@@ -351,16 +351,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt,
         if (len < sizeof (struct sockaddr))
                 return NULL;
 
+        if (!opt->pf->af_supported(addr->sa.sa_family, opt))
+                return NULL;
+
         /* V4 mapped address are really of AF_INET family */
         if (addr->sa.sa_family == AF_INET6 &&
-            ipv6_addr_v4mapped(&addr->v6.sin6_addr)) {
-                if (!opt->pf->af_supported(AF_INET, opt))
-                        return NULL;
-        } else {
-                /* Does this PF support this AF? */
-                if (!opt->pf->af_supported(addr->sa.sa_family, opt))
-                        return NULL;
-        }
+            ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
+            !opt->pf->af_supported(AF_INET, opt))
+                return NULL;
 
         /* If we get this far, af is valid. */
         af = sctp_get_af_specific(addr->sa.sa_family);
@@ -1900,8 +1898,14 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
                  */
                 if (sinit) {
                         if (sinit->sinit_num_ostreams) {
-                                asoc->c.sinit_num_ostreams =
-                                        sinit->sinit_num_ostreams;
+                                __u16 outcnt = sinit->sinit_num_ostreams;
+
+                                asoc->c.sinit_num_ostreams = outcnt;
+                                /* outcnt has been changed, so re-init stream */
+                                err = sctp_stream_init(&asoc->stream, outcnt, 0,
+                                                       GFP_KERNEL);
+                                if (err)
+                                        goto out_free;
                         }
                         if (sinit->sinit_max_instreams) {
                                 asoc->c.sinit_max_instreams =
@@ -1988,7 +1992,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len)
         timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
         if (!sctp_wspace(asoc)) {
                 /* sk can be changed by peel off when waiting for buf. */
-                err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk);
+                err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
                 if (err) {
                         if (err == -ESRCH) {
                                 /* asoc is already dead. */
@@ -8121,12 +8125,12 @@ void sctp_sock_rfree(struct sk_buff *skb)
 
 /* Helper function to wait for space in the sndbuf.  */
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
-                                size_t msg_len, struct sock **orig_sk)
+                                size_t msg_len)
 {
         struct sock *sk = asoc->base.sk;
-        int err = 0;
         long current_timeo = *timeo_p;
         DEFINE_WAIT(wait);
+        int err = 0;
 
         pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc,
                  *timeo_p, msg_len);
@@ -8155,17 +8159,13 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                 release_sock(sk);
                 current_timeo = schedule_timeout(current_timeo);
                 lock_sock(sk);
-                if (sk != asoc->base.sk) {
-                        release_sock(sk);
-                        sk = asoc->base.sk;
-                        lock_sock(sk);
-                }
+                if (sk != asoc->base.sk)
+                        goto do_error;
 
                 *timeo_p = current_timeo;
         }
 
 out:
-        *orig_sk = sk;
         finish_wait(&asoc->wait, &wait);
 
         /* Release the association's refcnt.  */