12 files changed, 469 insertions, 84 deletions

diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 4a62888f2e4..49814827f81 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -173,7 +173,7 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->timeouts[SCTP_EVENT_TIMEOUT_HEARTBEAT] = 0;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_SACK] = asoc->sackdelay;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_AUTOCLOSE] =
-                (unsigned long)sp->autoclose * HZ;
+                min_t(unsigned long, sp->autoclose, sctp_max_autoclose) * HZ;
 
         /* Initializes the timers */
         for (i = SCTP_EVENT_TIMEOUT_NONE; i < SCTP_NUM_TIMEOUT_TYPES; ++i)
@@ -280,6 +280,8 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         asoc->peer.asconf_capable = 0;
         if (sctp_addip_noauth)
                 asoc->peer.asconf_capable = 1;
+        asoc->asconf_addr_del_pending = NULL;
+        asoc->src_out_of_asoc_ok = 0;
 
         /* Create an input queue.  */
         sctp_inq_init(&asoc->base.inqueue);
@@ -446,6 +448,10 @@ void sctp_association_free(struct sctp_association *asoc)
 
         sctp_asconf_queue_teardown(asoc);
 
+        /* Free pending address space being deleted */
+        if (asoc->asconf_addr_del_pending != NULL)
+                kfree(asoc->asconf_addr_del_pending);
+
         /* AUTH - Free the endpoint shared keys */
         sctp_auth_destroy_keys(&asoc->endpoint_shared_keys);
 
diff --git a/net/sctp/bind_addr.c b/net/sctp/bind_addr.c
index 83e3011c19c..4ece451c8d2 100644
--- a/net/sctp/bind_addr.c
+++ b/net/sctp/bind_addr.c
@@ -430,7 +430,7 @@ union sctp_addr *sctp_find_unmatch_addr(struct sctp_bind_addr	*bp,
         list_for_each_entry(laddr, &bp->address_list, list) {
                 addr_buf = (union sctp_addr *)addrs;
                 for (i = 0; i < addrcnt; i++) {
-                        addr = (union sctp_addr *)addr_buf;
+                        addr = addr_buf;
                         af = sctp_get_af_specific(addr->v4.sin_family);
                         if (!af)
                                 break;
@@ -534,6 +534,21 @@ int sctp_in_scope(const union sctp_addr *addr, sctp_scope_t scope)
         return 0;
 }
 
+int sctp_is_ep_boundall(struct sock *sk)
+{
+        struct sctp_bind_addr *bp;
+        struct sctp_sockaddr_entry *addr;
+
+        bp = &sctp_sk(sk)->ep->base.bind_addr;
+        if (sctp_list_single_entry(&bp->address_list)) {
+                addr = list_entry(bp->address_list.next,
+                                  struct sctp_sockaddr_entry, list);
+                if (sctp_is_any(sk, &addr->a))
+                        return 1;
+        }
+        return 0;
+}
+
 /********************************************************************
  * 3rd Level Abstractions
  ********************************************************************/
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 741ed164883..b7692aab6e9 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -510,8 +510,7 @@ struct sock *sctp_err_lookup(int family, struct sk_buff *skb,
          * discard the packet.
          */
         if (vtag == 0) {
-                chunkhdr = (struct sctp_init_chunk *)((void *)sctphdr
-                                + sizeof(struct sctphdr));
+                chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
                 if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
                           + sizeof(__be32) ||
                     chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 0bb0d7cb9f1..aabaee41dd3 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -112,6 +112,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
                         addr->valid = 1;
                         spin_lock_bh(&sctp_local_addr_lock);
                         list_add_tail_rcu(&addr->list, &sctp_local_addr_list);
+                        sctp_addr_wq_mgmt(addr, SCTP_ADDR_NEW);
                         spin_unlock_bh(&sctp_local_addr_lock);
                 }
                 break;
@@ -122,6 +123,7 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
                         if (addr->a.sa.sa_family == AF_INET6 &&
                                         ipv6_addr_equal(&addr->a.v6.sin6_addr,
                                                 &ifa->addr)) {
+                                sctp_addr_wq_mgmt(addr, SCTP_ADDR_DEL);
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 08b3cead650..817174eb5f4 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -697,13 +697,7 @@ static void sctp_packet_append_data(struct sctp_packet *packet,
         /* Keep track of how many bytes are in flight to the receiver. */
         asoc->outqueue.outstanding_bytes += datasize;
 
-        /* Update our view of the receiver's rwnd. Include sk_buff overhead
-         * while updating peer.rwnd so that it reduces the chances of a
-         * receiver running out of receive buffer space even when receive
-         * window is still open. This can happen when a sender is sending
-         * sending small messages.
-         */
-        datasize += sizeof(struct sk_buff);
+        /* Update our view of the receiver's rwnd. */
         if (datasize < rwnd)
                 rwnd -= datasize;
         else
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index d03682109b7..6edd7deb1ad 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -411,8 +411,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                                         chunk->transport->flight_size -=
                                                         sctp_data_size(chunk);
                                 q->outstanding_bytes -= sctp_data_size(chunk);
-                                q->asoc->peer.rwnd += (sctp_data_size(chunk) +
-                                                        sizeof(struct sk_buff));
+                                q->asoc->peer.rwnd += sctp_data_size(chunk);
                         }
                         continue;
                 }
@@ -432,8 +431,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                          * (Section 7.2.4)), add the data size of those
                          * chunks to the rwnd.
                          */
-                        q->asoc->peer.rwnd += (sctp_data_size(chunk) +
-                                                sizeof(struct sk_buff));
+                        q->asoc->peer.rwnd += sctp_data_size(chunk);
                         q->outstanding_bytes -= sctp_data_size(chunk);
                         if (chunk->transport)
                                 transport->flight_size -= sctp_data_size(chunk);
@@ -754,6 +752,16 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
          */
 
         list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
+                /* RFC 5061, 5.3
+                 * F1) This means that until such time as the ASCONF
+                 * containing the add is acknowledged, the sender MUST
+                 * NOT use the new IP address as a source for ANY SCTP
+                 * packet except on carrying an ASCONF Chunk.
+                 */
+                if (asoc->src_out_of_asoc_ok &&
+                    chunk->chunk_hdr->type != SCTP_CID_ASCONF)
+                        continue;
+
                 list_del_init(&chunk->list);
 
                 /* Pick the right transport to use. */
@@ -881,6 +889,9 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                 }
         }
 
+        if (q->asoc->src_out_of_asoc_ok)
+                goto sctp_flush_out;
+
         /* Is it OK to send data chunks?  */
         switch (asoc->state) {
         case SCTP_STATE_COOKIE_ECHOED:
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 207175b2f40..48cb7b98b11 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -503,7 +503,9 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
                 sctp_v4_dst_saddr(&dst_saddr, fl4, htons(bp->port));
                 rcu_read_lock();
                 list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                        if (!laddr->valid || (laddr->state != SCTP_ADDR_SRC))
+                        if (!laddr->valid || (laddr->state == SCTP_ADDR_DEL) ||
+                            (laddr->state != SCTP_ADDR_SRC &&
+                            !asoc->src_out_of_asoc_ok))
                                 continue;
                         if (sctp_v4_cmp_addr(&dst_saddr, &laddr->a))
                                 goto out_unlock;
@@ -623,6 +625,143 @@ static void sctp_v4_ecn_capable(struct sock *sk)
         INET_ECN_xmit(sk);
 }
 
+void sctp_addr_wq_timeout_handler(unsigned long arg)
+{
+        struct sctp_sockaddr_entry *addrw, *temp;
+        struct sctp_sock *sp;
+
+        spin_lock_bh(&sctp_addr_wq_lock);
+
+        list_for_each_entry_safe(addrw, temp, &sctp_addr_waitq, list) {
+                SCTP_DEBUG_PRINTK_IPADDR("sctp_addrwq_timo_handler: the first ent in wq %p is ",
+                    " for cmd %d at entry %p\n", &sctp_addr_waitq, &addrw->a, addrw->state,
+                    addrw);
+
+#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
+                /* Now we send an ASCONF for each association */
+                /* Note. we currently don't handle link local IPv6 addressees */
+                if (addrw->a.sa.sa_family == AF_INET6) {
+                        struct in6_addr *in6;
+
+                        if (ipv6_addr_type(&addrw->a.v6.sin6_addr) &
+                            IPV6_ADDR_LINKLOCAL)
+                                goto free_next;
+
+                        in6 = (struct in6_addr *)&addrw->a.v6.sin6_addr;
+                        if (ipv6_chk_addr(&init_net, in6, NULL, 0) == 0 &&
+                            addrw->state == SCTP_ADDR_NEW) {
+                                unsigned long timeo_val;
+
+                                SCTP_DEBUG_PRINTK("sctp_timo_handler: this is on DAD, trying %d sec later\n",
+                                    SCTP_ADDRESS_TICK_DELAY);
+                                timeo_val = jiffies;
+                                timeo_val += msecs_to_jiffies(SCTP_ADDRESS_TICK_DELAY);
+                                mod_timer(&sctp_addr_wq_timer, timeo_val);
+                                break;
+                        }
+                }
+#endif
+                list_for_each_entry(sp, &sctp_auto_asconf_splist, auto_asconf_list) {
+                        struct sock *sk;
+
+                        sk = sctp_opt2sk(sp);
+                        /* ignore bound-specific endpoints */
+                        if (!sctp_is_ep_boundall(sk))
+                                continue;
+                        sctp_bh_lock_sock(sk);
+                        if (sctp_asconf_mgmt(sp, addrw) < 0)
+                                SCTP_DEBUG_PRINTK("sctp_addrwq_timo_handler: sctp_asconf_mgmt failed\n");
+                        sctp_bh_unlock_sock(sk);
+                }
+free_next:
+                list_del(&addrw->list);
+                kfree(addrw);
+        }
+        spin_unlock_bh(&sctp_addr_wq_lock);
+}
+
+static void sctp_free_addr_wq(void)
+{
+        struct sctp_sockaddr_entry *addrw;
+        struct sctp_sockaddr_entry *temp;
+
+        spin_lock_bh(&sctp_addr_wq_lock);
+        del_timer(&sctp_addr_wq_timer);
+        list_for_each_entry_safe(addrw, temp, &sctp_addr_waitq, list) {
+                list_del(&addrw->list);
+                kfree(addrw);
+        }
+        spin_unlock_bh(&sctp_addr_wq_lock);
+}
+
+/* lookup the entry for the same address in the addr_waitq
+ * sctp_addr_wq MUST be locked
+ */
+static struct sctp_sockaddr_entry *sctp_addr_wq_lookup(struct sctp_sockaddr_entry *addr)
+{
+        struct sctp_sockaddr_entry *addrw;
+
+        list_for_each_entry(addrw, &sctp_addr_waitq, list) {
+                if (addrw->a.sa.sa_family != addr->a.sa.sa_family)
+                        continue;
+                if (addrw->a.sa.sa_family == AF_INET) {
+                        if (addrw->a.v4.sin_addr.s_addr ==
+                            addr->a.v4.sin_addr.s_addr)
+                                return addrw;
+                } else if (addrw->a.sa.sa_family == AF_INET6) {
+                        if (ipv6_addr_equal(&addrw->a.v6.sin6_addr,
+                            &addr->a.v6.sin6_addr))
+                                return addrw;
+                }
+        }
+        return NULL;
+}
+
+void sctp_addr_wq_mgmt(struct sctp_sockaddr_entry *addr, int cmd)
+{
+        struct sctp_sockaddr_entry *addrw;
+        unsigned long timeo_val;
+
+        /* first, we check if an opposite message already exist in the queue.
+         * If we found such message, it is removed.
+         * This operation is a bit stupid, but the DHCP client attaches the
+         * new address after a couple of addition and deletion of that address
+         */
+
+        spin_lock_bh(&sctp_addr_wq_lock);
+        /* Offsets existing events in addr_wq */
+        addrw = sctp_addr_wq_lookup(addr);
+        if (addrw) {
+                if (addrw->state != cmd) {
+                        SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt offsets existing entry for %d ",
+                            " in wq %p\n", addrw->state, &addrw->a,
+                            &sctp_addr_waitq);
+                        list_del(&addrw->list);
+                        kfree(addrw);
+                }
+                spin_unlock_bh(&sctp_addr_wq_lock);
+                return;
+        }
+
+        /* OK, we have to add the new address to the wait queue */
+        addrw = kmemdup(addr, sizeof(struct sctp_sockaddr_entry), GFP_ATOMIC);
+        if (addrw == NULL) {
+                spin_unlock_bh(&sctp_addr_wq_lock);
+                return;
+        }
+        addrw->state = cmd;
+        list_add_tail(&addrw->list, &sctp_addr_waitq);
+        SCTP_DEBUG_PRINTK_IPADDR("sctp_addr_wq_mgmt add new entry for cmd:%d ",
+            " in wq %p\n", addrw->state, &addrw->a, &sctp_addr_waitq);
+
+        if (!timer_pending(&sctp_addr_wq_timer)) {
+                timeo_val = jiffies;
+                timeo_val += msecs_to_jiffies(SCTP_ADDRESS_TICK_DELAY);
+                mod_timer(&sctp_addr_wq_timer, timeo_val);
+        }
+        spin_unlock_bh(&sctp_addr_wq_lock);
+}
+
 /* Event handler for inet address addition/deletion events.
  * The sctp_local_addr_list needs to be protocted by a spin lock since
  * multiple notifiers (say IPv4 and IPv6) may be running at the same
@@ -650,6 +789,7 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
                         addr->valid = 1;
                         spin_lock_bh(&sctp_local_addr_lock);
                         list_add_tail_rcu(&addr->list, &sctp_local_addr_list);
+                        sctp_addr_wq_mgmt(addr, SCTP_ADDR_NEW);
                         spin_unlock_bh(&sctp_local_addr_lock);
                 }
                 break;
@@ -660,6 +800,7 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
                         if (addr->a.sa.sa_family == AF_INET &&
                                         addr->a.v4.sin_addr.s_addr ==
                                         ifa->ifa_local) {
+                                sctp_addr_wq_mgmt(addr, SCTP_ADDR_DEL);
                                 found = 1;
                                 addr->valid = 0;
                                 list_del_rcu(&addr->list);
@@ -1144,6 +1285,9 @@ SCTP_STATIC __init int sctp_init(void)
         sctp_max_instreams              = SCTP_DEFAULT_INSTREAMS;
         sctp_max_outstreams             = SCTP_DEFAULT_OUTSTREAMS;
 
+        /* Initialize maximum autoclose timeout. */
+        sctp_max_autoclose              = INT_MAX / HZ;
+
         /* Initialize handle used for association ids. */
         idr_init(&sctp_assocs_id);
 
@@ -1233,6 +1377,7 @@ SCTP_STATIC __init int sctp_init(void)
         /* Disable ADDIP by default. */
         sctp_addip_enable = 0;
         sctp_addip_noauth = 0;
+        sctp_default_auto_asconf = 0;
 
         /* Enable PR-SCTP by default. */
         sctp_prsctp_enable = 1;
@@ -1257,6 +1402,13 @@ SCTP_STATIC __init int sctp_init(void)
         spin_lock_init(&sctp_local_addr_lock);
         sctp_get_local_addr_list();
 
+        /* Initialize the address event list */
+        INIT_LIST_HEAD(&sctp_addr_waitq);
+        INIT_LIST_HEAD(&sctp_auto_asconf_splist);
+        spin_lock_init(&sctp_addr_wq_lock);
+        sctp_addr_wq_timer.expires = 0;
+        setup_timer(&sctp_addr_wq_timer, sctp_addr_wq_timeout_handler, 0);
+
         status = sctp_v4_protosw_init();
 
         if (status)
@@ -1328,6 +1480,7 @@ SCTP_STATIC __exit void sctp_exit(void)
         /* Unregister with inet6/inet layers. */
         sctp_v6_del_protocol();
         sctp_v4_del_protocol();
+        sctp_free_addr_wq();
 
         /* Free the control endpoint.  */
         inet_ctl_sock_destroy(sctp_ctl_sock);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 58eb27fed4b..81db4e38535 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2768,11 +2768,12 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
         int                     addr_param_len = 0;
         int                     totallen = 0;
         int                     i;
+        int                     del_pickup = 0;
 
         /* Get total length of all the address parameters. */
         addr_buf = addrs;
         for (i = 0; i < addrcnt; i++) {
-                addr = (union sctp_addr *)addr_buf;
+                addr = addr_buf;
                 af = sctp_get_af_specific(addr->v4.sin_family);
                 addr_param_len = af->to_addr_param(addr, &addr_param);
 
@@ -2780,6 +2781,13 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
                 totallen += addr_param_len;
 
                 addr_buf += af->sockaddr_len;
+                if (asoc->asconf_addr_del_pending && !del_pickup) {
+                        /* reuse the parameter length from the same scope one */
+                        totallen += paramlen;
+                        totallen += addr_param_len;
+                        del_pickup = 1;
+                        SCTP_DEBUG_PRINTK("mkasconf_update_ip: picked same-scope del_pending addr, totallen for all addresses is %d\n", totallen);
+                }
         }
 
         /* Create an asconf chunk with the required length. */
@@ -2790,7 +2798,7 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
         /* Add the address parameters to the asconf chunk. */
         addr_buf = addrs;
         for (i = 0; i < addrcnt; i++) {
-                addr = (union sctp_addr *)addr_buf;
+                addr = addr_buf;
                 af = sctp_get_af_specific(addr->v4.sin_family);
                 addr_param_len = af->to_addr_param(addr, &addr_param);
                 param.param_hdr.type = flags;
@@ -2802,6 +2810,17 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *asoc,
 
                 addr_buf += af->sockaddr_len;
         }
+        if (flags == SCTP_PARAM_ADD_IP && del_pickup) {
+                addr = asoc->asconf_addr_del_pending;
+                af = sctp_get_af_specific(addr->v4.sin_family);
+                addr_param_len = af->to_addr_param(addr, &addr_param);
+                param.param_hdr.type = SCTP_PARAM_DEL_IP;
+                param.param_hdr.length = htons(paramlen + addr_param_len);
+                param.crr_id = i;
+
+                sctp_addto_chunk(retval, paramlen, &param);
+                sctp_addto_chunk(retval, addr_param_len, &addr_param);
+        }
         return retval;
 }
 
@@ -2939,8 +2958,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
         union sctp_addr addr;
         union sctp_addr_param *addr_param;
 
-        addr_param = (union sctp_addr_param *)
-                        ((void *)asconf_param + sizeof(sctp_addip_param_t));
+        addr_param = (void *)asconf_param + sizeof(sctp_addip_param_t);
 
         if (asconf_param->param_hdr.type != SCTP_PARAM_ADD_IP &&
             asconf_param->param_hdr.type != SCTP_PARAM_DEL_IP &&
@@ -3014,7 +3032,7 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
                  * an Error Cause TLV set to the new error code 'Request to
                  * Delete Source IP Address'
                  */
-                if (sctp_cmp_addr_exact(sctp_source(asconf), &addr))
+                if (sctp_cmp_addr_exact(&asconf->source, &addr))
                         return SCTP_ERROR_DEL_SRC_IP;
 
                 /* Section 4.2.2
@@ -3125,7 +3143,7 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
          * asconf parameter.
          */
         length = ntohs(addr_param->p.length);
-        asconf_param = (sctp_addip_param_t *)((void *)addr_param + length);
+        asconf_param = (void *)addr_param + length;
         chunk_len -= length;
 
         /* create an ASCONF_ACK chunk.
@@ -3166,8 +3184,7 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
 
                 /* Move to the next ASCONF param. */
                 length = ntohs(asconf_param->param_hdr.length);
-                asconf_param = (sctp_addip_param_t *)((void *)asconf_param +
-                                                      length);
+                asconf_param = (void *)asconf_param + length;
                 chunk_len -= length;
         }
 
@@ -3197,8 +3214,7 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
         struct sctp_transport *transport;
         struct sctp_sockaddr_entry *saddr;
 
-        addr_param = (union sctp_addr_param *)
-                        ((void *)asconf_param + sizeof(sctp_addip_param_t));
+        addr_param = (void *)asconf_param + sizeof(sctp_addip_param_t);
 
         /* We have checked the packet before, so we do not check again. */
         af = sctp_get_af_specific(param_type2af(addr_param->p.type));
@@ -3224,6 +3240,11 @@ static void sctp_asconf_param_success(struct sctp_association *asoc,
         case SCTP_PARAM_DEL_IP:
                 local_bh_disable();
                 sctp_del_bind_addr(bp, &addr);
+                if (asoc->asconf_addr_del_pending != NULL &&
+                    sctp_cmp_addr_exact(asoc->asconf_addr_del_pending, &addr)) {
+                        kfree(asoc->asconf_addr_del_pending);
+                        asoc->asconf_addr_del_pending = NULL;
+                }
                 local_bh_enable();
                 list_for_each_entry(transport, &asoc->peer.transport_addr_list,
                                 transports) {
@@ -3278,8 +3299,7 @@ static __be16 sctp_get_asconf_response(struct sctp_chunk *asconf_ack,
                                 return SCTP_ERROR_NO_ERROR;
                         case SCTP_PARAM_ERR_CAUSE:
                                 length = sizeof(sctp_addip_param_t);
-                                err_param = (sctp_errhdr_t *)
-                                           ((void *)asconf_ack_param + length);
+                                err_param = (void *)asconf_ack_param + length;
                                 asconf_ack_len -= length;
                                 if (asconf_ack_len > 0)
                                         return err_param->cause;
@@ -3292,8 +3312,7 @@ static __be16 sctp_get_asconf_response(struct sctp_chunk *asconf_ack,
                 }
 
                 length = ntohs(asconf_ack_param->param_hdr.length);
-                asconf_ack_param = (sctp_addip_param_t *)
-                                        ((void *)asconf_ack_param + length);
+                asconf_ack_param = (void *)asconf_ack_param + length;
                 asconf_ack_len -= length;
         }
 
@@ -3325,7 +3344,7 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
          * pointer to the first asconf parameter.
          */
         length = ntohs(addr_param->p.length);
-        asconf_param = (sctp_addip_param_t *)((void *)addr_param + length);
+        asconf_param = (void *)addr_param + length;
         asconf_len -= length;
 
         /* ADDIP 4.1
@@ -3376,11 +3395,13 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
                  * one.
                  */
                 length = ntohs(asconf_param->param_hdr.length);
-                asconf_param = (sctp_addip_param_t *)((void *)asconf_param +
-                                                      length);
+                asconf_param = (void *)asconf_param + length;
                 asconf_len -= length;
         }
 
+        if (no_err && asoc->src_out_of_asoc_ok)
+                asoc->src_out_of_asoc_ok = 0;
+
         /* Free the cached last sent asconf chunk. */
         list_del_init(&asconf->transmitted_list);
         sctp_chunk_free(asconf);
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 6e0f88295aa..76388b083f2 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1210,7 +1210,7 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
         int local_cork = 0;
 
         if (SCTP_EVENT_T_TIMEOUT != event_type)
-                chunk = (struct sctp_chunk *) event_arg;
+                chunk = event_arg;
 
         /* Note:  This whole file is a huge candidate for rework.
          * For example, each command could either have its own handler, so
@@ -1689,6 +1689,11 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                 case SCTP_CMD_PURGE_ASCONF_QUEUE:
                         sctp_asconf_queue_teardown(asoc);
                         break;
+
+                case SCTP_CMD_SET_ASOC:
+                        asoc = cmd->obj.asoc;
+                        break;
+
                 default:
                         pr_warn("Impossible command: %u, %p\n",
                                 cmd->verb, cmd->obj.ptr);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 246117142b5..a0f31e6c1c6 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2047,6 +2047,12 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,
         sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
         sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
 
+        /* Restore association pointer to provide SCTP command interpeter
+         * with a valid context in case it needs to manipulate
+         * the queues */
+        sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC,
+                         SCTP_ASOC((struct sctp_association *)asoc));
+
         return retval;
 
 nomem:
@@ -4008,31 +4014,32 @@ sctp_disposition_t sctp_sf_eat_auth(const struct sctp_endpoint *ep,
         auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
         error = sctp_sf_authenticate(ep, asoc, type, chunk);
         switch (error) {
-                case SCTP_IERROR_AUTH_BAD_HMAC:
-                        /* Generate the ERROR chunk and discard the rest
-                         * of the packet
-                         */
-                        err_chunk = sctp_make_op_error(asoc, chunk,
-                                                        SCTP_ERROR_UNSUP_HMAC,
-                                                        &auth_hdr->hmac_id,
-                                                        sizeof(__u16), 0);
-                        if (err_chunk) {
-                                sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
-                                                SCTP_CHUNK(err_chunk));
-                        }
-                        /* Fall Through */
-                case SCTP_IERROR_AUTH_BAD_KEYID:
-                case SCTP_IERROR_BAD_SIG:
-                        return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
-                        break;
-                case SCTP_IERROR_PROTO_VIOLATION:
-                        return sctp_sf_violation_chunklen(ep, asoc, type, arg,
-                                                          commands);
-                        break;
-                case SCTP_IERROR_NOMEM:
-                        return SCTP_DISPOSITION_NOMEM;
-                default:
-                        break;
+        case SCTP_IERROR_AUTH_BAD_HMAC:
+                /* Generate the ERROR chunk and discard the rest
+                 * of the packet
+                 */
+                err_chunk = sctp_make_op_error(asoc, chunk,
+                                               SCTP_ERROR_UNSUP_HMAC,
+                                               &auth_hdr->hmac_id,
+                                               sizeof(__u16), 0);
+                if (err_chunk) {
+                        sctp_add_cmd_sf(commands, SCTP_CMD_REPLY,
+                                        SCTP_CHUNK(err_chunk));
+                }
+                /* Fall Through */
+        case SCTP_IERROR_AUTH_BAD_KEYID:
+        case SCTP_IERROR_BAD_SIG:
+                return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
+
+        case SCTP_IERROR_PROTO_VIOLATION:
+                return sctp_sf_violation_chunklen(ep, asoc, type, arg,
+                                                  commands);
+
+        case SCTP_IERROR_NOMEM:
+                return SCTP_DISPOSITION_NOMEM;
+
+        default:                        /* Prevent gcc warnings */
+                break;
         }
 
         if (asoc->active_key_id != ntohs(auth_hdr->shkey_id)) {
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d3ccf7973c5..4760f4e65b8 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -476,7 +476,7 @@ static int sctp_bindx_add(struct sock *sk, struct sockaddr *addrs, int addrcnt)
                 /* The list may contain either IPv4 or IPv6 address;
                  * determine the address length for walking thru the list.
                  */
-                sa_addr = (struct sockaddr *)addr_buf;
+                sa_addr = addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa_family);
                 if (!af) {
                         retval = -EINVAL;
@@ -555,7 +555,7 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
                  */
                 addr_buf = addrs;
                 for (i = 0; i < addrcnt; i++) {
-                        addr = (union sctp_addr *)addr_buf;
+                        addr = addr_buf;
                         af = sctp_get_af_specific(addr->v4.sin_family);
                         if (!af) {
                                 retval = -EINVAL;
@@ -583,22 +583,35 @@ static int sctp_send_asconf_add_ip(struct sock		*sk,
                         goto out;
                 }
 
-                retval = sctp_send_asconf(asoc, chunk);
-                if (retval)
-                        goto out;
-
                 /* Add the new addresses to the bind address list with
                  * use_as_src set to 0.
                  */
                 addr_buf = addrs;
                 for (i = 0; i < addrcnt; i++) {
-                        addr = (union sctp_addr *)addr_buf;
+                        addr = addr_buf;
                         af = sctp_get_af_specific(addr->v4.sin_family);
                         memcpy(&saveaddr, addr, af->sockaddr_len);
                         retval = sctp_add_bind_addr(bp, &saveaddr,
                                                     SCTP_ADDR_NEW, GFP_ATOMIC);
                         addr_buf += af->sockaddr_len;
                 }
+                if (asoc->src_out_of_asoc_ok) {
+                        struct sctp_transport *trans;
+
+                        list_for_each_entry(trans,
+                            &asoc->peer.transport_addr_list, transports) {
+                                /* Clear the source and route cache */
+                                dst_release(trans->dst);
+                                trans->cwnd = min(4*asoc->pathmtu, max_t(__u32,
+                                    2*asoc->pathmtu, 4380));
+                                trans->ssthresh = asoc->peer.i.a_rwnd;
+                                trans->rto = asoc->rto_initial;
+                                trans->rtt = trans->srtt = trans->rttvar = 0;
+                                sctp_transport_route(trans, NULL,
+                                    sctp_sk(asoc->base.sk));
+                        }
+                }
+                retval = sctp_send_asconf(asoc, chunk);
         }
 
 out:
@@ -646,7 +659,7 @@ static int sctp_bindx_rem(struct sock *sk, struct sockaddr *addrs, int addrcnt)
                         goto err_bindx_rem;
                 }
 
-                sa_addr = (union sctp_addr *)addr_buf;
+                sa_addr = addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa.sa_family);
                 if (!af) {
                         retval = -EINVAL;
@@ -715,7 +728,9 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
         struct sctp_sockaddr_entry *saddr;
         int                     i;
         int                     retval = 0;
+        int                     stored = 0;
 
+        chunk = NULL;
         if (!sctp_addip_enable)
                 return retval;
 
@@ -743,7 +758,7 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                  */
                 addr_buf = addrs;
                 for (i = 0; i < addrcnt; i++) {
-                        laddr = (union sctp_addr *)addr_buf;
+                        laddr = addr_buf;
                         af = sctp_get_af_specific(laddr->v4.sin_family);
                         if (!af) {
                                 retval = -EINVAL;
@@ -766,8 +781,37 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                 bp = &asoc->base.bind_addr;
                 laddr = sctp_find_unmatch_addr(bp, (union sctp_addr *)addrs,
                                                addrcnt, sp);
-                if (!laddr)
-                        continue;
+                if ((laddr == NULL) && (addrcnt == 1)) {
+                        if (asoc->asconf_addr_del_pending)
+                                continue;
+                        asoc->asconf_addr_del_pending =
+                            kzalloc(sizeof(union sctp_addr), GFP_ATOMIC);
+                        if (asoc->asconf_addr_del_pending == NULL) {
+                                retval = -ENOMEM;
+                                goto out;
+                        }
+                        asoc->asconf_addr_del_pending->sa.sa_family =
+                                    addrs->sa_family;
+                        asoc->asconf_addr_del_pending->v4.sin_port =
+                                    htons(bp->port);
+                        if (addrs->sa_family == AF_INET) {
+                                struct sockaddr_in *sin;
+
+                                sin = (struct sockaddr_in *)addrs;
+                                asoc->asconf_addr_del_pending->v4.sin_addr.s_addr = sin->sin_addr.s_addr;
+                        } else if (addrs->sa_family == AF_INET6) {
+                                struct sockaddr_in6 *sin6;
+
+                                sin6 = (struct sockaddr_in6 *)addrs;
+                                ipv6_addr_copy(&asoc->asconf_addr_del_pending->v6.sin6_addr, &sin6->sin6_addr);
+                        }
+                        SCTP_DEBUG_PRINTK_IPADDR("send_asconf_del_ip: keep the last address asoc: %p ",
+                            " at %p\n", asoc, asoc->asconf_addr_del_pending,
+                            asoc->asconf_addr_del_pending);
+                        asoc->src_out_of_asoc_ok = 1;
+                        stored = 1;
+                        goto skip_mkasconf;
+                }
 
                 /* We do not need RCU protection throughout this loop
                  * because this is done under a socket lock from the
@@ -780,12 +824,13 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                         goto out;
                 }
 
+skip_mkasconf:
                 /* Reset use_as_src flag for the addresses in the bind address
                  * list that are to be deleted.
                  */
                 addr_buf = addrs;
                 for (i = 0; i < addrcnt; i++) {
-                        laddr = (union sctp_addr *)addr_buf;
+                        laddr = addr_buf;
                         af = sctp_get_af_specific(laddr->v4.sin_family);
                         list_for_each_entry(saddr, &bp->address_list, list) {
                                 if (sctp_cmp_addr_exact(&saddr->a, laddr))
@@ -805,12 +850,37 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                                              sctp_sk(asoc->base.sk));
                 }
 
+                if (stored)
+                        /* We don't need to transmit ASCONF */
+                        continue;
                 retval = sctp_send_asconf(asoc, chunk);
         }
 out:
         return retval;
 }
 
+/* set addr events to assocs in the endpoint.  ep and addr_wq must be locked */
+int sctp_asconf_mgmt(struct sctp_sock *sp, struct sctp_sockaddr_entry *addrw)
+{
+        struct sock *sk = sctp_opt2sk(sp);
+        union sctp_addr *addr;
+        struct sctp_af *af;
+
+        /* It is safe to write port space in caller. */
+        addr = &addrw->a;
+        addr->v4.sin_port = htons(sp->ep->base.bind_addr.port);
+        af = sctp_get_af_specific(addr->sa.sa_family);
+        if (!af)
+                return -EINVAL;
+        if (sctp_verify_addr(sk, addr, af->sockaddr_len))
+                return -EINVAL;
+
+        if (addrw->state == SCTP_ADDR_NEW)
+                return sctp_send_asconf_add_ip(sk, (struct sockaddr *)addr, 1);
+        else
+                return sctp_send_asconf_del_ip(sk, (struct sockaddr *)addr, 1);
+}
+
 /* Helper for tunneling sctp_bindx() requests through sctp_setsockopt()
  *
  * API 8.1
@@ -927,7 +997,7 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
                         return -EINVAL;
                 }
 
-                sa_addr = (struct sockaddr *)addr_buf;
+                sa_addr = addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa_family);
 
                 /* If the address family is not supported or if this address
@@ -1018,7 +1088,7 @@ static int __sctp_connect(struct sock* sk,
                         goto out_free;
                 }
 
-                sa_addr = (union sctp_addr *)addr_buf;
+                sa_addr = addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa.sa_family);
 
                 /* If the address family is not supported or if this address
@@ -2129,8 +2199,6 @@ static int sctp_setsockopt_autoclose(struct sock *sk, char __user *optval,
                 return -EINVAL;
         if (copy_from_user(&sp->autoclose, optval, optlen))
                 return -EFAULT;
-        /* make sure it won't exceed MAX_SCHEDULE_TIMEOUT */
-        sp->autoclose = min_t(long, sp->autoclose, MAX_SCHEDULE_TIMEOUT / HZ);
 
         return 0;
 }
@@ -3213,11 +3281,11 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
                 return -EFAULT;
 
         switch (val.sauth_chunk) {
-                case SCTP_CID_INIT:
-                case SCTP_CID_INIT_ACK:
-                case SCTP_CID_SHUTDOWN_COMPLETE:
-                case SCTP_CID_AUTH:
-                        return -EINVAL;
+        case SCTP_CID_INIT:
+        case SCTP_CID_INIT_ACK:
+        case SCTP_CID_SHUTDOWN_COMPLETE:
+        case SCTP_CID_AUTH:
+                return -EINVAL;
         }
 
         /* add this chunk id to the endpoint */
@@ -3360,6 +3428,46 @@ static int sctp_setsockopt_del_key(struct sock *sk,
 
 }
 
+/*
+ * 8.1.23 SCTP_AUTO_ASCONF
+ *
+ * This option will enable or disable the use of the automatic generation of
+ * ASCONF chunks to add and delete addresses to an existing association.  Note
+ * that this option has two caveats namely: a) it only affects sockets that
+ * are bound to all addresses available to the SCTP stack, and b) the system
+ * administrator may have an overriding control that turns the ASCONF feature
+ * off no matter what setting the socket option may have.
+ * This option expects an integer boolean flag, where a non-zero value turns on
+ * the option, and a zero value turns off the option.
+ * Note. In this implementation, socket operation overrides default parameter
+ * being set by sysctl as well as FreeBSD implementation
+ */
+static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+                                        unsigned int optlen)
+{
+        int val;
+        struct sctp_sock *sp = sctp_sk(sk);
+
+        if (optlen < sizeof(int))
+                return -EINVAL;
+        if (get_user(val, (int __user *)optval))
+                return -EFAULT;
+        if (!sctp_is_ep_boundall(sk) && val)
+                return -EINVAL;
+        if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
+                return 0;
+
+        if (val == 0 && sp->do_auto_asconf) {
+                list_del(&sp->auto_asconf_list);
+                sp->do_auto_asconf = 0;
+        } else if (val && !sp->do_auto_asconf) {
+                list_add_tail(&sp->auto_asconf_list,
+                    &sctp_auto_asconf_splist);
+                sp->do_auto_asconf = 1;
+        }
+        return 0;
+}
+
 
 /* API 6.2 setsockopt(), getsockopt()
  *
@@ -3507,6 +3615,9 @@ SCTP_STATIC int sctp_setsockopt(struct sock *sk, int level, int optname,
         case SCTP_AUTH_DELETE_KEY:
                 retval = sctp_setsockopt_del_key(sk, optval, optlen);
                 break;
+        case SCTP_AUTO_ASCONF:
+                retval = sctp_setsockopt_auto_asconf(sk, optval, optlen);
+                break;
         default:
                 retval = -ENOPROTOOPT;
                 break;
@@ -3789,6 +3900,12 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         local_bh_disable();
         percpu_counter_inc(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        if (sctp_default_auto_asconf) {
+                list_add_tail(&sp->auto_asconf_list,
+                    &sctp_auto_asconf_splist);
+                sp->do_auto_asconf = 1;
+        } else
+                sp->do_auto_asconf = 0;
         local_bh_enable();
 
         return 0;
@@ -3797,13 +3914,17 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
 /* Cleanup any SCTP per socket resources.  */
 SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
 {
-        struct sctp_endpoint *ep;
+        struct sctp_sock *sp;
 
         SCTP_DEBUG_PRINTK("sctp_destroy_sock(sk: %p)\n", sk);
 
         /* Release our hold on the endpoint. */
-        ep = sctp_sk(sk)->ep;
-        sctp_endpoint_free(ep);
+        sp = sctp_sk(sk);
+        if (sp->do_auto_asconf) {
+                sp->do_auto_asconf = 0;
+                list_del(&sp->auto_asconf_list);
+        }
+        sctp_endpoint_free(sp->ep);
         local_bh_disable();
         percpu_counter_dec(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
@@ -5303,6 +5424,28 @@ static int sctp_getsockopt_assoc_number(struct sock *sk, int len,
 }
 
 /*
+ * 8.1.23 SCTP_AUTO_ASCONF
+ * See the corresponding setsockopt entry as description
+ */
+static int sctp_getsockopt_auto_asconf(struct sock *sk, int len,
+                                   char __user *optval, int __user *optlen)
+{
+        int val = 0;
+
+        if (len < sizeof(int))
+                return -EINVAL;
+
+        len = sizeof(int);
+        if (sctp_sk(sk)->do_auto_asconf && sctp_is_ep_boundall(sk))
+                val = 1;
+        if (put_user(len, optlen))
+                return -EFAULT;
+        if (copy_to_user(optval, &val, len))
+                return -EFAULT;
+        return 0;
+}
+
+/*
  * 8.2.6. Get the Current Identifiers of Associations
  *        (SCTP_GET_ASSOC_ID_LIST)
  *
@@ -5486,6 +5629,9 @@ SCTP_STATIC int sctp_getsockopt(struct sock *sk, int level, int optname,
         case SCTP_GET_ASSOC_ID_LIST:
                 retval = sctp_getsockopt_assoc_ids(sk, len, optval, optlen);
                 break;
+        case SCTP_AUTO_ASCONF:
+                retval = sctp_getsockopt_auto_asconf(sk, len, optval, optlen);
+                break;
         default:
                 retval = -ENOPROTOOPT;
                 break;
@@ -6538,6 +6684,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         struct sk_buff *skb, *tmp;
         struct sctp_ulpevent *event;
         struct sctp_bind_hashbucket *head;
+        struct list_head tmplist;
 
         /* Migrate socket buffer sizes and all the socket level options to the
          * new socket.
@@ -6545,7 +6692,12 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         newsk->sk_sndbuf = oldsk->sk_sndbuf;
         newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
         /* Brute force copy old sctp opt. */
-        inet_sk_copy_descendant(newsk, oldsk);
+        if (oldsp->do_auto_asconf) {
+                memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
+                inet_sk_copy_descendant(newsk, oldsk);
+                memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
+        } else
+                inet_sk_copy_descendant(newsk, oldsk);
 
         /* Restore the ep value that was overwritten with the above structure
          * copy.
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 50cb57f0919..60ffbd067ff 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -53,6 +53,10 @@ static int sack_timer_min = 1;
 static int sack_timer_max = 500;
 static int addr_scope_max = 3; /* check sctp_scope_policy_t in include/net/sctp/constants.h for max entries */
 static int rwnd_scale_max = 16;
+static unsigned long max_autoclose_min = 0;
+static unsigned long max_autoclose_max =
+        (MAX_SCHEDULE_TIMEOUT / HZ > UINT_MAX)
+        ? UINT_MAX : MAX_SCHEDULE_TIMEOUT / HZ;
 
 extern long sysctl_sctp_mem[3];
 extern int sysctl_sctp_rmem[3];
@@ -183,6 +187,13 @@ static ctl_table sctp_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
+                .procname       = "default_auto_asconf",
+                .data           = &sctp_default_auto_asconf,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
                 .procname       = "prsctp_enable",
                 .data           = &sctp_prsctp_enable,
                 .maxlen         = sizeof(int),
@@ -251,6 +262,15 @@ static ctl_table sctp_table[] = {
                 .extra1         = &one,
                 .extra2         = &rwnd_scale_max,
         },
+        {
+                .procname       = "max_autoclose",
+                .data           = &sctp_max_autoclose,
+                .maxlen         = sizeof(unsigned long),
+                .mode           = 0644,
+                .proc_handler   = &proc_doulongvec_minmax,
+                .extra1         = &max_autoclose_min,
+                .extra2         = &max_autoclose_max,
+        },
 
         { /* sentinel */ }
 };