8 files changed, 124 insertions, 31 deletions

diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 7b261afc47b9..7f8baa48e7c2 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -53,6 +53,7 @@ static void sctp_datamsg_init(struct sctp_datamsg *msg)
         msg->send_failed = 0;
         msg->send_error = 0;
         msg->can_delay = 1;
+        msg->abandoned = 0;
         msg->expires_at = 0;
         INIT_LIST_HEAD(&msg->chunks);
 }
@@ -304,6 +305,13 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
         if (!chunk->asoc->peer.prsctp_capable)
                 return 0;
 
+        if (chunk->msg->abandoned)
+                return 1;
+
+        if (!chunk->has_tsn &&
+            !(chunk->chunk_hdr->flags & SCTP_DATA_FIRST_FRAG))
+                return 0;
+
         if (SCTP_PR_TTL_ENABLED(chunk->sinfo.sinfo_flags) &&
             time_after(jiffies, chunk->msg->expires_at)) {
                 struct sctp_stream_out *streamout =
@@ -316,6 +324,7 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
                         chunk->asoc->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
                         streamout->ext->abandoned_unsent[SCTP_PR_INDEX(TTL)]++;
                 }
+                chunk->msg->abandoned = 1;
                 return 1;
         } else if (SCTP_PR_RTX_ENABLED(chunk->sinfo.sinfo_flags) &&
                    chunk->sent_count > chunk->sinfo.sinfo_timetolive) {
@@ -324,10 +333,12 @@ int sctp_chunk_abandoned(struct sctp_chunk *chunk)
 
                 chunk->asoc->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
                 streamout->ext->abandoned_sent[SCTP_PR_INDEX(RTX)]++;
+                chunk->msg->abandoned = 1;
                 return 1;
         } else if (!SCTP_PR_POLICY(chunk->sinfo.sinfo_flags) &&
                    chunk->msg->expires_at &&
                    time_after(jiffies, chunk->msg->expires_at)) {
+                chunk->msg->abandoned = 1;
                 return 1;
         }
         /* PRIO policy is processed by sendmsg, not here */
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 4db012aa25f7..7d67feeeffc1 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -364,10 +364,12 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
         list_for_each_entry_safe(chk, temp, queue, transmitted_list) {
                 struct sctp_stream_out *streamout;
 
-                if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
-                    chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
+                if (!chk->msg->abandoned &&
+                    (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
+                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive))
                         continue;
 
+                chk->msg->abandoned = 1;
                 list_del_init(&chk->transmitted_list);
                 sctp_insert_list(&asoc->outqueue.abandoned,
                                  &chk->transmitted_list);
@@ -377,7 +379,8 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
                 asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
                 streamout->ext->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
 
-                if (!chk->tsn_gap_acked) {
+                if (queue != &asoc->outqueue.retransmit &&
+                    !chk->tsn_gap_acked) {
                         if (chk->transport)
                                 chk->transport->flight_size -=
                                                 sctp_data_size(chk);
@@ -403,10 +406,13 @@ static int sctp_prsctp_prune_unsent(struct sctp_association *asoc,
         q->sched->unsched_all(&asoc->stream);
 
         list_for_each_entry_safe(chk, temp, &q->out_chunk_list, list) {
-                if (!SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
-                    chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive)
+                if (!chk->msg->abandoned &&
+                    (!(chk->chunk_hdr->flags & SCTP_DATA_FIRST_FRAG) ||
+                     !SCTP_PR_PRIO_ENABLED(chk->sinfo.sinfo_flags) ||
+                     chk->sinfo.sinfo_timetolive <= sinfo->sinfo_timetolive))
                         continue;
 
+                chk->msg->abandoned = 1;
                 sctp_sched_dequeue_common(q, chk);
                 asoc->sent_cnt_removable--;
                 asoc->abandoned_unsent[SCTP_PR_INDEX(PRIO)]++;
@@ -1434,7 +1440,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         /* If this chunk has not been acked, stop
                          * considering it as 'outstanding'.
                          */
-                        if (!tchunk->tsn_gap_acked) {
+                        if (transmitted_queue != &q->retransmit &&
+                            !tchunk->tsn_gap_acked) {
                                 if (tchunk->transport)
                                         tchunk->transport->flight_size -=
                                                         sctp_data_size(tchunk);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index f5172c21349b..6a38c2503649 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1499,6 +1499,7 @@ static __init int sctp_init(void)
         INIT_LIST_HEAD(&sctp_address_families);
         sctp_v4_pf_init();
         sctp_v6_pf_init();
+        sctp_sched_ops_init();
 
         status = register_pernet_subsys(&sctp_defaults_ops);
         if (status)
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 3204a9b29407..014847e25648 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -188,13 +188,13 @@ static void sctp_for_each_tx_datachunk(struct sctp_association *asoc,
                 list_for_each_entry(chunk, &t->transmitted, transmitted_list)
                         cb(chunk);
 
-        list_for_each_entry(chunk, &q->retransmit, list)
+        list_for_each_entry(chunk, &q->retransmit, transmitted_list)
                 cb(chunk);
 
-        list_for_each_entry(chunk, &q->sacked, list)
+        list_for_each_entry(chunk, &q->sacked, transmitted_list)
                 cb(chunk);
 
-        list_for_each_entry(chunk, &q->abandoned, list)
+        list_for_each_entry(chunk, &q->abandoned, transmitted_list)
                 cb(chunk);
 
         list_for_each_entry(chunk, &q->out_chunk_list, list)
diff --git a/net/sctp/stream.c b/net/sctp/stream.c
index a11db21dc8a0..76ea66be0bbe 100644
--- a/net/sctp/stream.c
+++ b/net/sctp/stream.c
@@ -64,7 +64,7 @@ static void sctp_stream_outq_migrate(struct sctp_stream *stream,
                  */
 
                 /* Mark as failed send. */
-                sctp_chunk_fail(ch, SCTP_ERROR_INV_STRM);
+                sctp_chunk_fail(ch, (__force __u32)SCTP_ERROR_INV_STRM);
                 if (asoc->peer.prsctp_capable &&
                     SCTP_PR_PRIO_ENABLED(ch->sinfo.sinfo_flags))
                         asoc->sent_cnt_removable--;
@@ -254,6 +254,30 @@ static int sctp_send_reconf(struct sctp_association *asoc,
         return retval;
 }
 
+static bool sctp_stream_outq_is_empty(struct sctp_stream *stream,
+                                      __u16 str_nums, __be16 *str_list)
+{
+        struct sctp_association *asoc;
+        __u16 i;
+
+        asoc = container_of(stream, struct sctp_association, stream);
+        if (!asoc->outqueue.out_qlen)
+                return true;
+
+        if (!str_nums)
+                return false;
+
+        for (i = 0; i < str_nums; i++) {
+                __u16 sid = ntohs(str_list[i]);
+
+                if (stream->out[sid].ext &&
+                    !list_empty(&stream->out[sid].ext->outq))
+                        return false;
+        }
+
+        return true;
+}
+
 int sctp_send_reset_streams(struct sctp_association *asoc,
                             struct sctp_reset_streams *params)
 {
@@ -317,6 +341,11 @@ int sctp_send_reset_streams(struct sctp_association *asoc,
         for (i = 0; i < str_nums; i++)
                 nstr_list[i] = htons(str_list[i]);
 
+        if (out && !sctp_stream_outq_is_empty(stream, str_nums, nstr_list)) {
+                retval = -EAGAIN;
+                goto out;
+        }
+
         chunk = sctp_make_strreset_req(asoc, str_nums, nstr_list, out, in);
 
         kfree(nstr_list);
@@ -377,6 +406,9 @@ int sctp_send_reset_assoc(struct sctp_association *asoc)
         if (asoc->strreset_outstanding)
                 return -EINPROGRESS;
 
+        if (!sctp_outq_is_empty(&asoc->outqueue))
+                return -EAGAIN;
+
         chunk = sctp_make_strreset_tsnreq(asoc);
         if (!chunk)
                 return -ENOMEM;
@@ -563,7 +595,7 @@ struct sctp_chunk *sctp_process_strreset_outreq(
                 flags = SCTP_STREAM_RESET_INCOMING_SSN;
         }
 
-        nums = (ntohs(param.p->length) - sizeof(*outreq)) / 2;
+        nums = (ntohs(param.p->length) - sizeof(*outreq)) / sizeof(__u16);
         if (nums) {
                 str_p = outreq->list_of_streams;
                 for (i = 0; i < nums; i++) {
@@ -627,7 +659,7 @@ struct sctp_chunk *sctp_process_strreset_inreq(
                 goto out;
         }
 
-        nums = (ntohs(param.p->length) - sizeof(*inreq)) / 2;
+        nums = (ntohs(param.p->length) - sizeof(*inreq)) / sizeof(__u16);
         str_p = inreq->list_of_streams;
         for (i = 0; i < nums; i++) {
                 if (ntohs(str_p[i]) >= stream->outcnt) {
@@ -636,6 +668,12 @@ struct sctp_chunk *sctp_process_strreset_inreq(
                 }
         }
 
+        if (!sctp_stream_outq_is_empty(stream, nums, str_p)) {
+                result = SCTP_STRRESET_IN_PROGRESS;
+                asoc->strreset_inseq--;
+                goto err;
+        }
+
         chunk = sctp_make_strreset_req(asoc, nums, str_p, 1, 0);
         if (!chunk)
                 goto out;
@@ -687,12 +725,18 @@ struct sctp_chunk *sctp_process_strreset_tsnreq(
                 i = asoc->strreset_inseq - request_seq - 1;
                 result = asoc->strreset_result[i];
                 if (result == SCTP_STRRESET_PERFORMED) {
-                        next_tsn = asoc->next_tsn;
+                        next_tsn = asoc->ctsn_ack_point + 1;
                         init_tsn =
                                 sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map) + 1;
                 }
                 goto err;
         }
+
+        if (!sctp_outq_is_empty(&asoc->outqueue)) {
+                result = SCTP_STRRESET_IN_PROGRESS;
+                goto err;
+        }
+
         asoc->strreset_inseq++;
 
         if (!(asoc->strreset_enable & SCTP_ENABLE_RESET_ASSOC_REQ))
@@ -703,9 +747,10 @@ struct sctp_chunk *sctp_process_strreset_tsnreq(
                 goto out;
         }
 
-        /* G3: The same processing as though a SACK chunk with no gap report
-         *     and a cumulative TSN ACK of the Sender's Next TSN minus 1 were
-         *     received MUST be performed.
+        /* G4: The same processing as though a FWD-TSN chunk (as defined in
+         *     [RFC3758]) with all streams affected and a new cumulative TSN
+         *     ACK of the Receiver's Next TSN minus 1 were received MUST be
+         *     performed.
          */
         max_tsn_seen = sctp_tsnmap_get_max_tsn_seen(&asoc->peer.tsn_map);
         sctp_ulpq_reasm_flushtsn(&asoc->ulpq, max_tsn_seen);
@@ -720,10 +765,9 @@ struct sctp_chunk *sctp_process_strreset_tsnreq(
         sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
                          init_tsn, GFP_ATOMIC);
 
-        /* G4: The same processing as though a FWD-TSN chunk (as defined in
-         *     [RFC3758]) with all streams affected and a new cumulative TSN
-         *     ACK of the Receiver's Next TSN minus 1 were received MUST be
-         *     performed.
+        /* G3: The same processing as though a SACK chunk with no gap report
+         *     and a cumulative TSN ACK of the Sender's Next TSN minus 1 were
+         *     received MUST be performed.
          */
         sctp_outq_free(&asoc->outqueue);
 
@@ -927,7 +971,8 @@ struct sctp_chunk *sctp_process_strreset_resp(
 
                 outreq = (struct sctp_strreset_outreq *)req;
                 str_p = outreq->list_of_streams;
-                nums = (ntohs(outreq->param_hdr.length) - sizeof(*outreq)) / 2;
+                nums = (ntohs(outreq->param_hdr.length) - sizeof(*outreq)) /
+                       sizeof(__u16);
 
                 if (result == SCTP_STRRESET_PERFORMED) {
                         if (nums) {
@@ -956,7 +1001,8 @@ struct sctp_chunk *sctp_process_strreset_resp(
 
                 inreq = (struct sctp_strreset_inreq *)req;
                 str_p = inreq->list_of_streams;
-                nums = (ntohs(inreq->param_hdr.length) - sizeof(*inreq)) / 2;
+                nums = (ntohs(inreq->param_hdr.length) - sizeof(*inreq)) /
+                       sizeof(__u16);
 
                 *evp = sctp_ulpevent_make_stream_reset_event(asoc, flags,
                         nums, str_p, GFP_ATOMIC);
@@ -975,6 +1021,7 @@ struct sctp_chunk *sctp_process_strreset_resp(
                 if (result == SCTP_STRRESET_PERFORMED) {
                         __u32 mtsn = sctp_tsnmap_get_max_tsn_seen(
                                                 &asoc->peer.tsn_map);
+                        LIST_HEAD(temp);
 
                         sctp_ulpq_reasm_flushtsn(&asoc->ulpq, mtsn);
                         sctp_ulpq_abort_pd(&asoc->ulpq, GFP_ATOMIC);
@@ -983,7 +1030,13 @@ struct sctp_chunk *sctp_process_strreset_resp(
                                          SCTP_TSN_MAP_INITIAL,
                                          stsn, GFP_ATOMIC);
 
+                        /* Clean up sacked and abandoned queues only. As the
+                         * out_chunk_list may not be empty, splice it to temp,
+                         * then get it back after sctp_outq_free is done.
+                         */
+                        list_splice_init(&asoc->outqueue.out_chunk_list, &temp);
                         sctp_outq_free(&asoc->outqueue);
+                        list_splice_init(&temp, &asoc->outqueue.out_chunk_list);
 
                         asoc->next_tsn = rtsn;
                         asoc->ctsn_ack_point = asoc->next_tsn - 1;
diff --git a/net/sctp/stream_sched.c b/net/sctp/stream_sched.c
index 0b83ec51e43b..d8c162a4089c 100644
--- a/net/sctp/stream_sched.c
+++ b/net/sctp/stream_sched.c
@@ -119,16 +119,27 @@ static struct sctp_sched_ops sctp_sched_fcfs = {
         .unsched_all = sctp_sched_fcfs_unsched_all,
 };
 
+static void sctp_sched_ops_fcfs_init(void)
+{
+        sctp_sched_ops_register(SCTP_SS_FCFS, &sctp_sched_fcfs);
+}
+
 /* API to other parts of the stack */
 
-extern struct sctp_sched_ops sctp_sched_prio;
-extern struct sctp_sched_ops sctp_sched_rr;
+static struct sctp_sched_ops *sctp_sched_ops[SCTP_SS_MAX + 1];
 
-static struct sctp_sched_ops *sctp_sched_ops[] = {
-        &sctp_sched_fcfs,
-        &sctp_sched_prio,
-        &sctp_sched_rr,
-};
+void sctp_sched_ops_register(enum sctp_sched_type sched,
+                             struct sctp_sched_ops *sched_ops)
+{
+        sctp_sched_ops[sched] = sched_ops;
+}
+
+void sctp_sched_ops_init(void)
+{
+        sctp_sched_ops_fcfs_init();
+        sctp_sched_ops_prio_init();
+        sctp_sched_ops_rr_init();
+}
 
 int sctp_sched_set_sched(struct sctp_association *asoc,
                          enum sctp_sched_type sched)
diff --git a/net/sctp/stream_sched_prio.c b/net/sctp/stream_sched_prio.c
index 384dbf3c8760..7997d35dd0fd 100644
--- a/net/sctp/stream_sched_prio.c
+++ b/net/sctp/stream_sched_prio.c
@@ -333,7 +333,7 @@ static void sctp_sched_prio_unsched_all(struct sctp_stream *stream)
                         sctp_sched_prio_unsched(soute);
 }
 
-struct sctp_sched_ops sctp_sched_prio = {
+static struct sctp_sched_ops sctp_sched_prio = {
         .set = sctp_sched_prio_set,
         .get = sctp_sched_prio_get,
         .init = sctp_sched_prio_init,
@@ -345,3 +345,8 @@ struct sctp_sched_ops sctp_sched_prio = {
         .sched_all = sctp_sched_prio_sched_all,
         .unsched_all = sctp_sched_prio_unsched_all,
 };
+
+void sctp_sched_ops_prio_init(void)
+{
+        sctp_sched_ops_register(SCTP_SS_PRIO, &sctp_sched_prio);
+}
diff --git a/net/sctp/stream_sched_rr.c b/net/sctp/stream_sched_rr.c
index 7612a438c5b9..1155692448f1 100644
--- a/net/sctp/stream_sched_rr.c
+++ b/net/sctp/stream_sched_rr.c
@@ -187,7 +187,7 @@ static void sctp_sched_rr_unsched_all(struct sctp_stream *stream)
                 sctp_sched_rr_unsched(stream, soute);
 }
 
-struct sctp_sched_ops sctp_sched_rr = {
+static struct sctp_sched_ops sctp_sched_rr = {
         .set = sctp_sched_rr_set,
         .get = sctp_sched_rr_get,
         .init = sctp_sched_rr_init,
@@ -199,3 +199,8 @@ struct sctp_sched_ops sctp_sched_rr = {
         .sched_all = sctp_sched_rr_sched_all,
         .unsched_all = sctp_sched_rr_unsched_all,
 };
+
+void sctp_sched_ops_rr_init(void)
+{
+        sctp_sched_ops_register(SCTP_SS_RR, &sctp_sched_rr);
+}