Merge branch 'upstream-fixes'

4 files changed, 13 insertions, 11 deletions

diff --git a/net/sctp/output.c b/net/sctp/output.c
index a40991ef72c9..437cba7260a4 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -608,7 +608,7 @@ static sctp_xmit_t sctp_packet_append_data(struct sctp_packet *packet,
          *    When a Fast Retransmit is being performed the sender SHOULD
          *    ignore the value of cwnd and SHOULD NOT delay retransmission.
          */
-        if (!chunk->fast_retransmit)
+        if (chunk->fast_retransmit <= 0)
                 if (transport->flight_size >= transport->cwnd) {
                         retval = SCTP_XMIT_RWND_FULL;
                         goto finish;
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index efb72faba20c..f148f9576dd2 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -406,7 +406,7 @@ void sctp_retransmit_mark(struct sctp_outq *q,
                  * chunks that are not yet acked should be added to the
                  * retransmit queue.
                  */
-                if ((fast_retransmit && chunk->fast_retransmit) ||
+                if ((fast_retransmit && (chunk->fast_retransmit > 0)) ||
                    (!fast_retransmit && !chunk->tsn_gap_acked)) {
                         /* RFC 2960 6.2.1 Processing a Received SACK
                          *
@@ -603,7 +603,8 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                         /* Mark the chunk as ineligible for fast retransmit 
                          * after it is retransmitted.
                          */
-                        chunk->fast_retransmit = 0;
+                        if (chunk->fast_retransmit > 0)
+                                chunk->fast_retransmit = -1;
 
                         *start_timer = 1;
                         q->empty = 0;
@@ -621,7 +622,8 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                         list_for_each(lchunk1, lqueue) {
                                 chunk1 = list_entry(lchunk1, struct sctp_chunk,
                                                     transmitted_list);
-                                chunk1->fast_retransmit = 0;
+                                if (chunk1->fast_retransmit > 0)
+                                        chunk1->fast_retransmit = -1;
                         }
                 }
         }
@@ -1562,11 +1564,11 @@ static void sctp_mark_missing(struct sctp_outq *q,
                 /*
                  * M4) If any DATA chunk is found to have a
                  * 'TSN.Missing.Report'
-                 * value larger than or equal to 4, mark that chunk for
+                 * value larger than or equal to 3, mark that chunk for
                  * retransmission and start the fast retransmit procedure.
                  */
 
-                if (chunk->tsn_missing_report >= 4) {
+                if (chunk->tsn_missing_report >= 3) {
                         chunk->fast_retransmit = 1;
                         do_fast_retransmit = 1;
                 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 71c9a961c321..2b9a832b29a7 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -884,7 +884,7 @@ sctp_disposition_t sctp_sf_sendbeat_8_3(const struct sctp_endpoint *ep,
 {
         struct sctp_transport *transport = (struct sctp_transport *) arg;
 
-        if (asoc->overall_error_count > asoc->max_retrans) {
+        if (asoc->overall_error_count >= asoc->max_retrans) {
                 /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
                 sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
                                 SCTP_U32(SCTP_ERROR_NO_ERROR));
@@ -2122,7 +2122,7 @@ static sctp_disposition_t sctp_sf_do_5_2_6_stale(const struct sctp_endpoint *ep,
         struct sctp_bind_addr *bp;
         int attempts = asoc->init_err_counter + 1;
 
-        if (attempts >= asoc->max_init_attempts) {
+        if (attempts > asoc->max_init_attempts) {
                 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_FAILED,
                                 SCTP_U32(SCTP_ERROR_STALE_COOKIE));
                 return SCTP_DISPOSITION_DELETE_TCB;
@@ -4640,7 +4640,7 @@ sctp_disposition_t sctp_sf_t1_init_timer_expire(const struct sctp_endpoint *ep,
 
         SCTP_DEBUG_PRINTK("Timer T1 expired (INIT).\n");
 
-        if (attempts < asoc->max_init_attempts) {
+        if (attempts <= asoc->max_init_attempts) {
                 bp = (struct sctp_bind_addr *) &asoc->base.bind_addr;
                 repl = sctp_make_init(asoc, bp, GFP_ATOMIC, 0);
                 if (!repl)
@@ -4697,7 +4697,7 @@ sctp_disposition_t sctp_sf_t1_cookie_timer_expire(const struct sctp_endpoint *ep
 
         SCTP_DEBUG_PRINTK("Timer T1 expired (COOKIE-ECHO).\n");
 
-        if (attempts < asoc->max_init_attempts) {
+        if (attempts <= asoc->max_init_attempts) {
                 repl = sctp_make_cookie_echo(asoc, NULL);
                 if (!repl)
                         return SCTP_DISPOSITION_NOMEM;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index fb1821d9f338..0ea947eb6813 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5426,7 +5426,7 @@ out:
         return err;
 
 do_error:
-        if (asoc->init_err_counter + 1 >= asoc->max_init_attempts)
+        if (asoc->init_err_counter + 1 > asoc->max_init_attempts)
                 err = -ETIMEDOUT;
         else
                 err = -ECONNREFUSED;