8 files changed, 106 insertions, 31 deletions

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 1662f9cc869..42b66e74bbb 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -141,7 +141,8 @@ int sctp_rcv(struct sk_buff *skb)
         __skb_pull(skb, skb->h.raw - skb->data);
         if (skb->len < sizeof(struct sctphdr))
                 goto discard_it;
-        if (sctp_rcv_checksum(skb) < 0)
+        if ((skb->ip_summed != CHECKSUM_UNNECESSARY) &&
+            (sctp_rcv_checksum(skb) < 0))
                 goto discard_it;
 
         skb_pull(skb, sizeof(struct sctphdr));
@@ -170,7 +171,8 @@ int sctp_rcv(struct sk_buff *skb)
          * IP broadcast addresses cannot be used in an SCTP transport
          * address."
          */
-        if (!af->addr_valid(&src, NULL) || !af->addr_valid(&dest, NULL))
+        if (!af->addr_valid(&src, NULL, skb) ||
+            !af->addr_valid(&dest, NULL, skb))
                 goto discard_it;
 
         asoc = __sctp_rcv_lookup(skb, &src, &dest, &transport);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index c20d282fac0..8ef08070c8b 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -523,7 +523,9 @@ static int sctp_v6_available(union sctp_addr *addr, struct sctp_sock *sp)
  * Return 0 - If the address is a non-unicast or an illegal address.
  * Return 1 - If the address is a unicast.
  */
-static int sctp_v6_addr_valid(union sctp_addr *addr, struct sctp_sock *sp)
+static int sctp_v6_addr_valid(union sctp_addr *addr,
+                              struct sctp_sock *sp,
+                              const struct sk_buff *skb)
 {
         int ret = ipv6_addr_type(&addr->v6.sin6_addr);
 
@@ -537,7 +539,7 @@ static int sctp_v6_addr_valid(union sctp_addr *addr, struct sctp_sock *sp)
                 if (sp && ipv6_only_sock(sctp_opt2sk(sp)))
                         return 0;
                 sctp_v6_map_v4(addr);
-                return sctp_get_af_specific(AF_INET)->addr_valid(addr, sp);
+                return sctp_get_af_specific(AF_INET)->addr_valid(addr, sp, skb);
         }
 
         /* Is this a non-unicast address */
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 437cba7260a..cdc5a393676 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -295,14 +295,14 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         struct sctp_transport *tp = packet->transport;
         struct sctp_association *asoc = tp->asoc;
         struct sctphdr *sh;
-        __u32 crc32;
+        __u32 crc32 = 0;
         struct sk_buff *nskb;
         struct sctp_chunk *chunk, *tmp;
         struct sock *sk;
         int err = 0;
         int padding;            /* How much padding do we need?  */
         __u8 has_data = 0;
-        struct dst_entry *dst;
+        struct dst_entry *dst = tp->dst;
 
         SCTP_DEBUG_PRINTK("%s: packet:%p\n", __FUNCTION__, packet);
 
@@ -327,6 +327,19 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          */
         skb_set_owner_w(nskb, sk);
 
+        /* The 'obsolete' field of dst is set to 2 when a dst is freed. */
+        if (!dst || (dst->obsolete > 1)) {
+                dst_release(dst);
+                sctp_transport_route(tp, NULL, sctp_sk(sk));
+                if (asoc && (asoc->param_flags & SPP_PMTUD_ENABLE)) {
+                        sctp_assoc_sync_pmtu(asoc);
+                }
+        }
+        nskb->dst = dst_clone(tp->dst);
+        if (!nskb->dst)
+                goto no_route;
+        dst = nskb->dst;
+
         /* Build the SCTP header.  */
         sh = (struct sctphdr *)skb_push(nskb, sizeof(struct sctphdr));
         sh->source = htons(packet->source_port);
@@ -350,7 +363,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
          * Note: Adler-32 is no longer applicable, as has been replaced
          * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
          */
-        crc32 = sctp_start_cksum((__u8 *)sh, sizeof(struct sctphdr));
+        if (!(dst->dev->features & NETIF_F_NO_CSUM))
+                crc32 = sctp_start_cksum((__u8 *)sh, sizeof(struct sctphdr));
 
         /**
          * 6.10 Bundling
@@ -402,9 +416,14 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                 if (padding)
                         memset(skb_put(chunk->skb, padding), 0, padding);
 
-                crc32 = sctp_update_copy_cksum(skb_put(nskb, chunk->skb->len),
-                                               chunk->skb->data,
-                                               chunk->skb->len, crc32);
+                if (dst->dev->features & NETIF_F_NO_CSUM)
+                        memcpy(skb_put(nskb, chunk->skb->len),
+                               chunk->skb->data, chunk->skb->len);
+                else
+                        crc32 = sctp_update_copy_cksum(skb_put(nskb,
+                                                        chunk->skb->len),
+                                                chunk->skb->data,
+                                                chunk->skb->len, crc32);
 
                 SCTP_DEBUG_PRINTK("%s %p[%s] %s 0x%x, %s %d, %s %d, %s %d\n",
                                   "*** Chunk", chunk,
@@ -427,7 +446,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         }
 
         /* Perform final transformation on checksum. */
-        crc32 = sctp_end_cksum(crc32);
+        if (!(dst->dev->features & NETIF_F_NO_CSUM))
+                crc32 = sctp_end_cksum(crc32);
 
         /* 3) Put the resultant value into the checksum field in the
          *    common header, and leave the rest of the bits unchanged.
@@ -477,20 +497,6 @@ int sctp_packet_transmit(struct sctp_packet *packet)
                 }
         }
 
-        dst = tp->dst;
-        /* The 'obsolete' field of dst is set to 2 when a dst is freed. */
-        if (!dst || (dst->obsolete > 1)) {
-                dst_release(dst);
-                sctp_transport_route(tp, NULL, sctp_sk(sk));
-                if (asoc->param_flags & SPP_PMTUD_ENABLE) {
-                        sctp_assoc_sync_pmtu(asoc);
-                }
-        }
-
-        nskb->dst = dst_clone(tp->dst);
-        if (!nskb->dst)
-                goto no_route;
-
         SCTP_DEBUG_PRINTK("***sctp_transmit_packet*** skb len %d\n",
                           nskb->len);
 
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index f148f9576dd..e5faa351aaa 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1262,6 +1262,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                 if (!tchunk->tsn_gap_acked &&
                                     !tchunk->resent &&
                                     tchunk->rtt_in_progress) {
+                                        tchunk->rtt_in_progress = 0;
                                         rtt = jiffies - tchunk->sent_at;
                                         sctp_transport_update_rto(transport,
                                                                   rtt);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 2088aa992b7..816c033d788 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -365,12 +365,18 @@ static int sctp_v4_is_any(const union sctp_addr *addr)
  * Return 0 - If the address is a non-unicast or an illegal address.
  * Return 1 - If the address is a unicast.
  */
-static int sctp_v4_addr_valid(union sctp_addr *addr, struct sctp_sock *sp)
+static int sctp_v4_addr_valid(union sctp_addr *addr,
+                              struct sctp_sock *sp,
+                              const struct sk_buff *skb)
 {
         /* Is this a non-unicast address or a unusable SCTP address? */
         if (IS_IPV4_UNUSABLE_ADDRESS(&addr->v4.sin_addr.s_addr))
                 return 0;
 
+        /* Is this a broadcast address? */
+        if (skb && ((struct rtable *)skb->dst)->rt_flags & RTCF_BROADCAST)
+                return 0;
+
         return 1;
 }
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 8bc279219a7..9e58144f485 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5293,10 +5293,18 @@ static int sctp_eat_data(const struct sctp_association *asoc,
          * seems a bit troublesome in that frag_point varies based on
          * PMTU.  In cases, such as loopback, this might be a rather
          * large spill over.
+         * NOTE: If we have a full receive buffer here, we only renege if
+         * our receiver can still make progress without the tsn being
+         * received. We do this because in the event that the associations
+         * receive queue is empty we are filling a leading gap, and since
+         * reneging moves the gap to the end of the tsn stream, we are likely
+         * to stall again very shortly. Avoiding the renege when we fill a
+         * leading gap is a good heuristic for avoiding such steady state
+         * stalls.
          */
         if (!asoc->rwnd || asoc->rwnd_over ||
             (datalen > asoc->rwnd + asoc->frag_point) ||
-            rcvbuf_over) {
+            (rcvbuf_over && (!skb_queue_len(&sk->sk_receive_queue)))) {
 
                 /* If this is the next TSN, consider reneging to make
                  * room.   Note: Playing nice with a confused sender.  A
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 174d4d35e95..b811691c35b 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -172,7 +172,7 @@ static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr,
                 return -EINVAL;
 
         /* Is this a valid SCTP address?  */
-        if (!af->addr_valid(addr, sctp_sk(sk)))
+        if (!af->addr_valid(addr, sctp_sk(sk), NULL))
                 return -EINVAL;
 
         if (!sctp_sk(sk)->pf->send_verify(sctp_sk(sk), (addr)))
@@ -2530,8 +2530,32 @@ static int sctp_setsockopt_associnfo(struct sock *sk, char __user *optval, int o
 
         /* Set the values to the specific association */
         if (asoc) {
-                if (assocparams.sasoc_asocmaxrxt != 0)
+                if (assocparams.sasoc_asocmaxrxt != 0) {
+                        __u32 path_sum = 0;
+                        int   paths = 0;
+                        struct list_head *pos;
+                        struct sctp_transport *peer_addr;
+
+                        list_for_each(pos, &asoc->peer.transport_addr_list) {
+                                peer_addr = list_entry(pos,
+                                                struct sctp_transport,
+                                                transports);
+                                path_sum += peer_addr->pathmaxrxt;
+                                paths++;
+                        }
+
+                        /* Only validate asocmaxrxt if we have more then
+                         * one path/transport.  We do this because path
+                         * retransmissions are only counted when we have more
+                         * then one path.
+                         */
+                        if (paths > 1 &&
+                            assocparams.sasoc_asocmaxrxt > path_sum)
+                                return -EINVAL;
+
                         asoc->max_retrans = assocparams.sasoc_asocmaxrxt;
+                }
+
                 if (assocparams.sasoc_cookie_life != 0) {
                         asoc->cookie_life.tv_sec =
                                         assocparams.sasoc_cookie_life / 1000;
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index ba97f974f57..ee236784a6b 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -51,6 +51,8 @@
 static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
                                        struct sctp_association *asoc);
 static void sctp_ulpevent_release_data(struct sctp_ulpevent *event);
+static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event);
+
 
 /* Initialize an ULP event from an given skb.  */
 SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
@@ -883,6 +885,7 @@ static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
 static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
 {
         struct sk_buff *skb, *frag;
+        unsigned int    len;
 
         /* Current stack structures assume that the rcv buffer is
          * per socket.   For UDP style sockets this is not true as
@@ -892,7 +895,30 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
          */
 
         skb = sctp_event2skb(event);
-        sctp_assoc_rwnd_increase(event->asoc, skb_headlen(skb));
+        len = skb->len;
+
+        if (!skb->data_len)
+                goto done;
+
+        /* Don't forget the fragments. */
+        for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next) {
+                /* NOTE:  skb_shinfos are recursive. Although IP returns
+                 * skb's with only 1 level of fragments, SCTP reassembly can
+                 * increase the levels.
+                 */
+                sctp_ulpevent_release_frag_data(sctp_skb2event(frag));
+        }
+
+done:
+        sctp_assoc_rwnd_increase(event->asoc, len);
+        sctp_ulpevent_release_owner(event);
+}
+
+static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
+{
+        struct sk_buff *skb, *frag;
+
+        skb = sctp_event2skb(event);
 
         if (!skb->data_len)
                 goto done;
@@ -903,7 +929,7 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
                  * skb's with only 1 level of fragments, SCTP reassembly can
                  * increase the levels.
                  */
-                sctp_ulpevent_release_data(sctp_skb2event(frag));
+                sctp_ulpevent_release_frag_data(sctp_skb2event(frag));
         }
 
 done: