Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  FEC: Fix kernel panic in fec_set_mac_address.
  ipv6: Fix default multicast hops setting.
  net: ep93xx_eth stops receiving packets
  drivers/net/phy: micrel phy driver
  dm9601: fix phy/eeprom write routine
  ppp_generic: handle non-linear skbs when passing them to pppd
  ppp_generic: pull 2 bytes so that PPP_PROTO(skb) is valid
  net: fix compile error due to double return type in SOCK_DEBUG
  net/usb: initiate sync sequence in sierra_net.c driver
  net/usb: remove default in Kconfig for sierra_net driver
  r8169: Fix rtl8169_rx_interrupt()
  e1000e: Fix oops caused by ASPM patch.
  net/sb1250: register mdio bus in probe
  sctp: Fix skb_over_panic resulting from multiple invalid parameter errors (CVE-2010-1173) (v4)
  p54pci: fix bugs in p54p_check_tx_ring

17 files changed, 256 insertions, 67 deletions

diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 6995169d285a..cd17d09f385c 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -311,11 +311,6 @@ err:
                 processed++;
         }
 
-        if (processed) {
-                wrw(ep, REG_RXDENQ, processed);
-                wrw(ep, REG_RXSTSENQ, processed);
-        }
-
         return processed;
 }
 
@@ -350,6 +345,11 @@ poll_some_more:
                         goto poll_some_more;
         }
 
+        if (rx) {
+                wrw(ep, REG_RXDENQ, rx);
+                wrw(ep, REG_RXSTSENQ, rx);
+        }
+
         return rx;
 }
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index fb8fc7d1b50d..dbf81788bb40 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4633,6 +4633,9 @@ static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
         reg16 &= ~state;
         pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
 
+        if (!pdev->bus->self)
+                return;
+
         pos = pci_pcie_cap(pdev->bus->self);
         pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
         reg16 &= ~state;
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 9f98c1c4a344..9b4e8f797a7a 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1653,7 +1653,7 @@ fec_set_mac_address(struct net_device *dev, void *p)
                 (dev->dev_addr[1] << 16) | (dev->dev_addr[0] << 24),
                 fep->hwp + FEC_ADDR_LOW);
         writel((dev->dev_addr[5] << 16) | (dev->dev_addr[4] << 24),
-                fep + FEC_ADDR_HIGH);
+                fep->hwp + FEC_ADDR_HIGH);
         return 0;
 }
 
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index fc5938ba3d78..a527e37728cd 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -88,6 +88,11 @@ config LSI_ET1011C_PHY
         ---help---
           Supports the LSI ET1011C PHY.
 
+config MICREL_PHY
+        tristate "Driver for Micrel PHYs"
+        ---help---
+          Supports the KSZ9021, VSC8201, KS8001 PHYs.
+
 config FIXED_PHY
         bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
         depends on PHYLIB=y
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 1342585af381..13bebab65d02 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -20,4 +20,5 @@ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
 obj-$(CONFIG_MDIO_GPIO)         += mdio-gpio.o
 obj-$(CONFIG_NATIONAL_PHY)      += national.o
 obj-$(CONFIG_STE10XP)           += ste10Xp.o
+obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
new file mode 100644
index 000000000000..0cd80e4d71d9
--- /dev/null
+++ b/drivers/net/phy/micrel.c
@@ -0,0 +1,104 @@
+/*
+ * drivers/net/phy/micrel.c
+ *
+ * Driver for Micrel PHYs
+ *
+ * Author: David J. Choi
+ *
+ * Copyright (c) 2010 Micrel, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ * Support : ksz9021 , vsc8201, ks8001
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+
+#define PHY_ID_KSZ9021                  0x00221611
+#define PHY_ID_VSC8201                  0x000FC413
+#define PHY_ID_KS8001                   0x0022161A
+
+
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        return 0;
+}
+
+
+static struct phy_driver ks8001_driver = {
+        .phy_id         = PHY_ID_KS8001,
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver vsc8201_driver = {
+        .phy_id         = PHY_ID_VSC8201,
+        .name           = "Micrel VSC8201",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver ksz9021_driver = {
+        .phy_id         = PHY_ID_KSZ9021,
+        .phy_id_mask    = 0x000fff10,
+        .name           = "Micrel KSZ9021 Gigabit PHY",
+        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE, },
+};
+
+static int __init ksphy_init(void)
+{
+        int ret;
+
+        ret = phy_driver_register(&ks8001_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&vsc8201_driver);
+        if (ret)
+                goto err2;
+
+        ret = phy_driver_register(&ksz9021_driver);
+        if (ret)
+                goto err3;
+        return 0;
+
+err3:
+        phy_driver_unregister(&vsc8201_driver);
+err2:
+        phy_driver_unregister(&ks8001_driver);
+err1:
+        return ret;
+}
+
+static void __exit ksphy_exit(void)
+{
+        phy_driver_unregister(&ks8001_driver);
+        phy_driver_unregister(&vsc8201_driver);
+        phy_driver_unregister(&ksz9021_driver);
+}
+
+module_init(ksphy_init);
+module_exit(ksphy_exit);
+
+MODULE_DESCRIPTION("Micrel PHY driver");
+MODULE_AUTHOR("David J. Choi");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6e281bc825e5..8518a2e58e53 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -405,6 +405,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         DECLARE_WAITQUEUE(wait, current);
         ssize_t ret;
         struct sk_buff *skb = NULL;
+        struct iovec iov;
 
         ret = count;
 
@@ -448,7 +449,9 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         if (skb->len > count)
                 goto outf;
         ret = -EFAULT;
-        if (copy_to_user(buf, skb->data, skb->len))
+        iov.iov_base = buf;
+        iov.iov_len = count;
+        if (skb_copy_datagram_iovec(skb, 0, &iov, skb->len))
                 goto outf;
         ret = skb->len;
 
@@ -1567,13 +1570,22 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         struct channel *pch = chan->ppp;
         int proto;
 
-        if (!pch || skb->len == 0) {
+        if (!pch) {
                 kfree_skb(skb);
                 return;
         }
 
-        proto = PPP_PROTO(skb);
         read_lock_bh(&pch->upl);
+        if (!pskb_may_pull(skb, 2)) {
+                kfree_skb(skb);
+                if (pch->ppp) {
+                        ++pch->ppp->dev->stats.rx_length_errors;
+                        ppp_receive_error(pch->ppp);
+                }
+                goto done;
+        }
+
+        proto = PPP_PROTO(skb);
         if (!pch->ppp || proto >= 0xc000 || proto == PPP_CCPFRAG) {
                 /* put it on the channel queue */
                 skb_queue_tail(&pch->file.rq, skb);
@@ -1585,6 +1597,8 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         } else {
                 ppp_do_recv(pch->ppp, skb, pch);
         }
+
+done:
         read_unlock_bh(&pch->upl);
 }
 
@@ -1617,7 +1631,8 @@ ppp_input_error(struct ppp_channel *chan, int code)
 static void
 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
-        if (pskb_may_pull(skb, 2)) {
+        /* note: a 0-length skb is used as an error indication */
+        if (skb->len > 0) {
 #ifdef CONFIG_PPP_MULTILINK
                 /* XXX do channel-level decompression here */
                 if (PPP_PROTO(skb) == PPP_MP)
@@ -1625,15 +1640,10 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                 else
 #endif /* CONFIG_PPP_MULTILINK */
                         ppp_receive_nonmp_frame(ppp, skb);
-                return;
+        } else {
+                kfree_skb(skb);
+                ppp_receive_error(ppp);
         }
-
-        if (skb->len > 0)
-                /* note: a 0-length skb is used as an error indication */
-                ++ppp->dev->stats.rx_length_errors;
-
-        kfree_skb(skb);
-        ppp_receive_error(ppp);
 }
 
 static void
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 4748c21eb72e..dd8106ff35aa 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1042,14 +1042,14 @@ static void rtl8169_vlan_rx_register(struct net_device *dev,
 }
 
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
         u32 opts2 = le32_to_cpu(desc->opts2);
         struct vlan_group *vlgrp = tp->vlgrp;
         int ret;
 
         if (vlgrp && (opts2 & RxVlanTag)) {
-                vlan_hwaccel_receive_skb(skb, vlgrp, swab16(opts2 & 0xffff));
+                __vlan_hwaccel_rx(skb, vlgrp, swab16(opts2 & 0xffff), polling);
                 ret = 0;
         } else
                 ret = -1;
@@ -1066,7 +1066,7 @@ static inline u32 rtl8169_tx_vlan_tag(struct rtl8169_private *tp,
 }
 
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
         return -1;
 }
@@ -4445,12 +4445,20 @@ out:
         return done;
 }
 
+/*
+ * Warning : rtl8169_rx_interrupt() might be called :
+ * 1) from NAPI (softirq) context
+ *      (polling = 1 : we should call netif_receive_skb())
+ * 2) from process context (rtl8169_reset_task())
+ *      (polling = 0 : we must call netif_rx() instead)
+ */
 static int rtl8169_rx_interrupt(struct net_device *dev,
                                 struct rtl8169_private *tp,
                                 void __iomem *ioaddr, u32 budget)
 {
         unsigned int cur_rx, rx_left;
         unsigned int delta, count;
+        int polling = (budget != ~(u32)0) ? 1 : 0;
 
         cur_rx = tp->cur_rx;
         rx_left = NUM_RX_DESC + tp->dirty_rx - cur_rx;
@@ -4512,8 +4520,12 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                         skb_put(skb, pkt_size);
                         skb->protocol = eth_type_trans(skb, dev);
 
-                        if (rtl8169_rx_vlan_skb(tp, desc, skb) < 0)
-                                netif_receive_skb(skb);
+                        if (rtl8169_rx_vlan_skb(tp, desc, skb, polling) < 0) {
+                                if (likely(polling))
+                                        netif_receive_skb(skb);
+                                else
+                                        netif_rx(skb);
+                        }
 
                         dev->stats.rx_bytes += pkt_size;
                         dev->stats.rx_packets++;
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 9944e5d662c0..04efc0c1bda9 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2353,17 +2353,36 @@ static int sbmac_init(struct platform_device *pldev, long long base)
 
         sc->mii_bus = mdiobus_alloc();
         if (sc->mii_bus == NULL) {
-                sbmac_uninitctx(sc);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto uninit_ctx;
         }
 
+        sc->mii_bus->name = sbmac_mdio_string;
+        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
+        sc->mii_bus->priv = sc;
+        sc->mii_bus->read = sbmac_mii_read;
+        sc->mii_bus->write = sbmac_mii_write;
+        sc->mii_bus->irq = sc->phy_irq;
+        for (i = 0; i < PHY_MAX_ADDR; ++i)
+                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
+
+        sc->mii_bus->parent = &pldev->dev;
+        /*
+         * Probe PHY address
+         */
+        err = mdiobus_register(sc->mii_bus);
+        if (err) {
+                printk(KERN_ERR "%s: unable to register MDIO bus\n",
+                       dev->name);
+                goto free_mdio;
+        }
+        dev_set_drvdata(&pldev->dev, sc->mii_bus);
+
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR "%s.%d: unable to register netdev\n",
                        sbmac_string, idx);
-                mdiobus_free(sc->mii_bus);
-                sbmac_uninitctx(sc);
-                return err;
+                goto unreg_mdio;
         }
 
         pr_info("%s.%d: registered as %s\n", sbmac_string, idx, dev->name);
@@ -2379,19 +2398,15 @@ static int sbmac_init(struct platform_device *pldev, long long base)
         pr_info("%s: SiByte Ethernet at 0x%08Lx, address: %pM\n",
                dev->name, base, eaddr);
 
-        sc->mii_bus->name = sbmac_mdio_string;
-        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
-        sc->mii_bus->priv = sc;
-        sc->mii_bus->read = sbmac_mii_read;
-        sc->mii_bus->write = sbmac_mii_write;
-        sc->mii_bus->irq = sc->phy_irq;
-        for (i = 0; i < PHY_MAX_ADDR; ++i)
-                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
-
-        sc->mii_bus->parent = &pldev->dev;
-        dev_set_drvdata(&pldev->dev, sc->mii_bus);
-
         return 0;
+unreg_mdio:
+        mdiobus_unregister(sc->mii_bus);
+        dev_set_drvdata(&pldev->dev, NULL);
+free_mdio:
+        mdiobus_free(sc->mii_bus);
+uninit_ctx:
+        sbmac_uninitctx(sc);
+        return err;
 }
 
 
@@ -2417,16 +2432,6 @@ static int sbmac_open(struct net_device *dev)
                 goto out_err;
         }
 
-        /*
-         * Probe PHY address
-         */
-        err = mdiobus_register(sc->mii_bus);
-        if (err) {
-                printk(KERN_ERR "%s: unable to register MDIO bus\n",
-                       dev->name);
-                goto out_unirq;
-        }
-
         sc->sbm_speed = sbmac_speed_none;
         sc->sbm_duplex = sbmac_duplex_none;
         sc->sbm_fc = sbmac_fc_none;
@@ -2457,11 +2462,7 @@ static int sbmac_open(struct net_device *dev)
         return 0;
 
 out_unregister:
-        mdiobus_unregister(sc->mii_bus);
-
-out_unirq:
         free_irq(dev->irq, dev);
-
 out_err:
         return err;
 }
@@ -2650,9 +2651,6 @@ static int sbmac_close(struct net_device *dev)
 
         phy_disconnect(sc->phy_dev);
         sc->phy_dev = NULL;
-
-        mdiobus_unregister(sc->mii_bus);
-
         free_irq(dev->irq, dev);
 
         sbdma_emptyring(&(sc->sbm_txdma));
@@ -2760,6 +2758,7 @@ static int __exit sbmac_remove(struct platform_device *pldev)
 
         unregister_netdev(dev);
         sbmac_uninitctx(sc);
+        mdiobus_unregister(sc->mii_bus);
         mdiobus_free(sc->mii_bus);
         iounmap(sc->sbm_base);
         free_netdev(dev);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 5d58abc224f4..d7b7018a1de1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -400,7 +400,6 @@ config USB_IPHETH
 config USB_SIERRA_NET
         tristate "USB-to-WWAN Driver for Sierra Wireless modems"
         depends on USB_USBNET
-        default y
         help
           Choose this option if you have a Sierra Wireless USB-to-WWAN device.
 
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 04b281002a76..5dfed9297b22 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -240,7 +240,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
                 goto out;
 
         dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
-        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
+        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
 
         for (i = 0; i < DM_TIMEOUT; i++) {
                 u8 tmp;
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index a44f9e0ea098..f1942d69a0d5 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -789,6 +789,9 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
         /* prepare sync message from template */
         memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
 
+        /* initiate the sync sequence */
+        sierra_net_dosync(dev);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 269fda362836..c24067f1a0cb 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ff3017744711..597f8e27aaf6 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -778,6 +778,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
                           struct iovec *data);
 void sctp_chunk_free(struct sctp_chunk *);
 void  *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
+void  *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data);
 struct sctp_chunk *sctp_chunkify(struct sk_buff *,
                                  const struct sctp_association *,
                                  struct sock *);
diff --git a/include/net/sock.h b/include/net/sock.h
index b4603cd54fcd..1ad6435f252e 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -74,7 +74,7 @@
                                         printk(KERN_DEBUG msg); } while (0)
 #else
 /* Validate arguments and do nothing */
-static void inline int __attribute__ ((format (printf, 2, 3)))
+static inline void __attribute__ ((format (printf, 2, 3)))
 SOCK_DEBUG(struct sock *sk, const char *msg, ...)
 {
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3192aa02ba5d..3f9e86b15e0d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -200,7 +200,7 @@ lookup_protocol:
 
         inet_sk(sk)->pinet6 = np = inet6_sk_generic(sk);
         np->hop_limit   = -1;
-        np->mcast_hops  = -1;
+        np->mcast_hops  = IPV6_DEFAULT_MCASTHOPS;
         np->mc_loop     = 1;
         np->pmtudisc    = IPV6_PMTUDISC_WANT;
         np->ipv6only    = net->ipv6.sysctl.bindv6only;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 0fd5b4c88358..30c1767186b8 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -108,7 +108,7 @@ static const struct sctp_paramhdr prsctp_param = {
         cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 
-/* A helper to initialize to initialize an op error inside a
+/* A helper to initialize an op error inside a
  * provided chunk, as most cause codes will be embedded inside an
  * abort chunk.
  */
@@ -125,6 +125,29 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
 }
 
+/* A helper to initialize an op error inside a
+ * provided chunk, as most cause codes will be embedded inside an
+ * abort chunk.  Differs from sctp_init_cause in that it won't oops
+ * if there isn't enough space in the op error chunk
+ */
+int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+                      size_t paylen)
+{
+        sctp_errhdr_t err;
+        __u16 len;
+
+        /* Cause code constants are now defined in network order.  */
+        err.cause = cause_code;
+        len = sizeof(sctp_errhdr_t) + paylen;
+        err.length  = htons(len);
+
+        if (skb_tailroom(chunk->skb) >  len)
+                return -ENOSPC;
+        chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+                                                     sizeof(sctp_errhdr_t),
+                                                     &err);
+        return 0;
+}
 /* 3.3.2 Initiation (INIT) (1)
  *
  * This chunk is used to initiate a SCTP association between two
@@ -1132,6 +1155,24 @@ nodata:
         return retval;
 }
 
+/* Create an Operation Error chunk of a fixed size,
+ * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
+ * This is a helper function to allocate an error chunk for
+ * for those invalid parameter codes in which we may not want
+ * to report all the errors, if the incomming chunk is large
+ */
+static inline struct sctp_chunk *sctp_make_op_error_fixed(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk)
+{
+        size_t size = asoc ? asoc->pathmtu : 0;
+
+        if (!size)
+                size = SCTP_DEFAULT_MAXSEGMENT;
+
+        return sctp_make_op_error_space(asoc, chunk, size);
+}
+
 /* Create an Operation Error chunk.  */
 struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
                                  const struct sctp_chunk *chunk,
@@ -1374,6 +1415,18 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
         return target;
 }
 
+/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
+ * space in the chunk
+ */
+void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+                             int len, const void *data)
+{
+        if (skb_tailroom(chunk->skb) > len)
+                return sctp_addto_chunk(chunk, len, data);
+        else
+                return NULL;
+}
+
 /* Append bytes from user space to the end of a chunk.  Will panic if
  * chunk is not big enough.
  * Returns a kernel err value.
@@ -1977,13 +2030,12 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
                  * returning multiple unknown parameters.
                  */
                 if (NULL == *errp)
-                        *errp = sctp_make_op_error_space(asoc, chunk,
-                                        ntohs(chunk->chunk_hdr->length));
+                        *errp = sctp_make_op_error_fixed(asoc, chunk);
 
                 if (*errp) {
-                        sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                        sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
                                         WORD_ROUND(ntohs(param.p->length)));
-                        sctp_addto_chunk(*errp,
+                        sctp_addto_chunk_fixed(*errp,
                                         WORD_ROUND(ntohs(param.p->length)),
                                         param.v);
                 } else {