1 files changed, 48 insertions, 34 deletions

diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index 3892e7630f3a..2936ed17bf9e 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -84,6 +84,19 @@ static void fa_zero(struct flex_array *fa, size_t index, size_t count)
         }
 }
 
+static size_t fa_index(struct flex_array *fa, void *elem, size_t count)
+{
+        size_t index = 0;
+
+        while (count--) {
+                if (elem == flex_array_get(fa, index))
+                        break;
+                index++;
+        }
+
+        return index;
+}
+
 /* Migrates chunks from stream queues to new stream queues if needed,
  * but not across associations. Also, removes those chunks to streams
  * higher than the new max.
@@ -131,8 +144,10 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
                 }
         }
 
-        for (i = outcnt; i < stream->outcnt; i++)
+        for (i = outcnt; i < stream->outcnt; i++) {
                 kfree(SCTP_SO(stream, i)->ext);
+                SCTP_SO(stream, i)->ext = NULL;
+        }
 }
 
 static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
@@ -147,6 +162,13 @@ static int sctp_stream_alloc_out(struct sctp_stream *stream, __u16 outcnt,
 
         if (stream->out) {
                 fa_copy(out, stream->out, 0, min(outcnt, stream->outcnt));
+                if (stream->out_curr) {
+                        size_t index = fa_index(stream->out, stream->out_curr,
+                                                stream->outcnt);
+
+                        BUG_ON(index == stream->outcnt);
+                        stream->out_curr = flex_array_get(out, index);
+                }
                 fa_free(stream->out);
         }
 
@@ -585,9 +607,9 @@ struct sctp_chunk *sctp_process_strreset_outreq(
         struct sctp_strreset_outreq *outreq = param.v;
         struct sctp_stream *stream = &asoc->stream;
         __u32 result = SCTP_STRRESET_DENIED;
-        __u16 i, nums, flags = 0;
         __be16 *str_p = NULL;
         __u32 request_seq;
+        __u16 i, nums;
 
         request_seq = ntohl(outreq->request_seq);
 
@@ -615,6 +637,15 @@ struct sctp_chunk *sctp_process_strreset_outreq(
         if (!(asoc->strreset_enable & SCTP_ENABLE_RESET_STREAM_REQ))
                 goto out;
 
+        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
+        str_p = outreq->list_of_streams;
+        for (i = 0; i < nums; i++) {
+                if (ntohs(str_p[i]) >= stream->incnt) {
+                        result = SCTP_STRRESET_ERR_WRONG_SSN;
+                        goto out;
+                }
+        }
+
         if (asoc->strreset_chunk) {
                 if (!sctp_chunk_lookup_strreset_param(
                                 asoc, outreq->response_seq,
@@ -637,32 +668,19 @@ struct sctp_chunk *sctp_process_strreset_outreq(
                         sctp_chunk_put(asoc->strreset_chunk);
                         asoc->strreset_chunk = NULL;
                 }
-
-                flags = SCTP_STREAM_RESET_INCOMING_SSN;
         }
 
-        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
-        if (nums) {
-                str_p = outreq->list_of_streams;
-                for (i = 0; i < nums; i++) {
-                        if (ntohs(str_p[i]) >= stream->incnt) {
-                                result = SCTP_STRRESET_ERR_WRONG_SSN;
-                                goto out;
-                        }
-                }
-
+        if (nums)
                 for (i = 0; i < nums; i++)
                         SCTP_SI(stream, ntohs(str_p[i]))->mid = 0;
-        } else {
+        else
                 for (i = 0; i < stream->incnt; i++)
                         SCTP_SI(stream, i)->mid = 0;
-        }
 
         result = SCTP_STRRESET_PERFORMED;
 
         *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                flags | SCTP_STREAM_RESET_OUTGOING_SSN, nums, str_p,
-                GFP_ATOMIC);
+                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
 
 out:
         sctp_update_strreset_result(asoc, result);
@@ -738,9 +756,6 @@ struct sctp_chunk *sctp_process_strreset_inreq(
 
         result = SCTP_STRRESET_PERFORMED;
 
-        *evp = sctp_ulpevent_make_stream_reset_event(asoc,
-                SCTP_STREAM_RESET_INCOMING_SSN, nums, str_p, GFP_ATOMIC);
-
 out:
         sctp_update_strreset_result(asoc, result);
 err:
@@ -873,6 +888,14 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
         if (!(asoc->strreset_enable & SCTP_ENABLE_CHANGE_ASSOC_REQ))
                 goto out;
 
+        in = ntohs(addstrm->number_of_streams);
+        incnt = stream->incnt + in;
+        if (!in || incnt > SCTP_MAX_STREAM)
+                goto out;
+
+        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
+                goto out;
+
         if (asoc->strreset_chunk) {
                 if (!sctp_chunk_lookup_strreset_param(
                         asoc, 0, SCTP_PARAM_RESET_ADD_IN_STREAMS)) {
@@ -896,14 +919,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_out(
                 }
         }
 
-        in = ntohs(addstrm->number_of_streams);
-        incnt = stream->incnt + in;
-        if (!in || incnt > SCTP_MAX_STREAM)
-                goto out;
-
-        if (sctp_stream_alloc_in(stream, incnt, GFP_ATOMIC))
-                goto out;
-
         stream->incnt = incnt;
 
         result = SCTP_STRRESET_PERFORMED;
@@ -973,9 +988,6 @@ struct sctp_chunk *sctp_process_strreset_addstrm_in(
 
         result = SCTP_STRRESET_PERFORMED;
 
-        *evp = sctp_ulpevent_make_stream_change_event(asoc,
-                0, 0, ntohs(addstrm->number_of_streams), GFP_ATOMIC);
-
 out:
         sctp_update_strreset_result(asoc, result);
 err:
@@ -1036,10 +1048,10 @@ struct sctp_chunk *sctp_process_strreset_resp(
                                         sout->mid_uo = 0;
                                 }
                         }
-
-                        flags = SCTP_STREAM_RESET_OUTGOING_SSN;
                 }
 
+                flags |= SCTP_STREAM_RESET_OUTGOING_SSN;
+
                 for (i = 0; i < stream->outcnt; i++)
                         SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN;
 
@@ -1058,6 +1070,8 @@ struct sctp_chunk *sctp_process_strreset_resp(
                 nums = (ntohs(inreq->param_hdr.length) - sizeof(*inreq)) /
                        sizeof(__u16);
 
+                flags |= SCTP_STREAM_RESET_INCOMING_SSN;
+
                 *evp = sctp_ulpevent_make_stream_reset_event(asoc, flags,
                         nums, str_p, GFP_ATOMIC);
         } else if (req->type == SCTP_PARAM_RESET_TSN_REQUEST) {