Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (108 commits)
  bridge: ensure to unlock in error path in br_multicast_query().
  drivers/net/tulip/eeprom.c: fix bogus "(null)" in tulip init messages
  sky2: Avoid rtnl_unlock without rtnl_lock
  ipv6: Send netlink notification when DAD fails
  drivers/net/tg3.c: change the field used with the TG3_FLAG_10_100_ONLY constant
  ipconfig: Handle devices which take some time to come up.
  mac80211: Fix memory leak in ieee80211_if_write()
  mac80211: Fix (dynamic) power save entry
  ipw2200: use kmalloc for large local variables
  ath5k: read eeprom IQ calibration values correctly for G mode
  ath5k: fix I/Q calibration (for real)
  ath5k: fix TSF reset
  ath5k: use fixed antenna for tx descriptors
  libipw: split ieee->networks into small pieces
  mac80211: Fix sta_mtx unlocking on insert STA failure path
  rt2x00: remove KSEG1ADDR define from rt2x00soc.h
  net: add ColdFire support to the smc91x driver
  asix: fix setting mac address for AX88772
  ipv6 ip6_tunnel: eliminate unused recursion field from ip6_tnl{}.
  net: Fix dev_mc_add()
  ...

2 files changed, 30 insertions, 15 deletions

diff --git a/net/sctp/input.c b/net/sctp/input.c
index c0c973e67add..3d74b264ea22 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -75,7 +75,7 @@ static struct sctp_association *__sctp_lookup_association(
                                         const union sctp_addr *peer,
                                         struct sctp_transport **pt);
 
-static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
+static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb);
 
 
 /* Calculate the SCTP checksum of an SCTP packet.  */
@@ -265,8 +265,13 @@ int sctp_rcv(struct sk_buff *skb)
         }
 
         if (sock_owned_by_user(sk)) {
+                if (sctp_add_backlog(sk, skb)) {
+                        sctp_bh_unlock_sock(sk);
+                        sctp_chunk_free(chunk);
+                        skb = NULL; /* sctp_chunk_free already freed the skb */
+                        goto discard_release;
+                }
                 SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_BACKLOG);
-                sctp_add_backlog(sk, skb);
         } else {
                 SCTP_INC_STATS_BH(SCTP_MIB_IN_PKT_SOFTIRQ);
                 sctp_inq_push(&chunk->rcvr->inqueue, chunk);
@@ -336,8 +341,10 @@ int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb)
                 sctp_bh_lock_sock(sk);
 
                 if (sock_owned_by_user(sk)) {
-                        sk_add_backlog(sk, skb);
-                        backloged = 1;
+                        if (sk_add_backlog(sk, skb))
+                                sctp_chunk_free(chunk);
+                        else
+                                backloged = 1;
                 } else
                         sctp_inq_push(inqueue, chunk);
 
@@ -362,22 +369,27 @@ done:
         return 0;
 }
 
-static void sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
+static int sctp_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
         struct sctp_chunk *chunk = SCTP_INPUT_CB(skb)->chunk;
         struct sctp_ep_common *rcvr = chunk->rcvr;
+        int ret;
 
-        /* Hold the assoc/ep while hanging on the backlog queue.
-         * This way, we know structures we need will not disappear from us
-         */
-        if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
-                sctp_association_hold(sctp_assoc(rcvr));
-        else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
-                sctp_endpoint_hold(sctp_ep(rcvr));
-        else
-                BUG();
+        ret = sk_add_backlog(sk, skb);
+        if (!ret) {
+                /* Hold the assoc/ep while hanging on the backlog queue.
+                 * This way, we know structures we need will not disappear
+                 * from us
+                 */
+                if (SCTP_EP_TYPE_ASSOCIATION == rcvr->type)
+                        sctp_association_hold(sctp_assoc(rcvr));
+                else if (SCTP_EP_TYPE_SOCKET == rcvr->type)
+                        sctp_endpoint_hold(sctp_ep(rcvr));
+                else
+                        BUG();
+        }
+        return ret;
 
-        sk_add_backlog(sk, skb);
 }
 
 /* Handle icmp frag needed error. */
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index f6d1e59c4151..dfc5c127efd4 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3720,6 +3720,9 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         SCTP_DBG_OBJCNT_INC(sock);
         percpu_counter_inc(&sctp_sockets_allocated);
 
+        /* Set socket backlog limit. */
+        sk->sk_backlog.limit = sysctl_sctp_rmem[1];
+
         local_bh_disable();
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         local_bh_enable();